The traffic through the old IPv6 tunnel ... / 2010-11-11

The traffic through the old IPv6 tunnel has picked up again, strangely enough. Lots of pings, with an interesting pattern:

22:48:16.386678 IP6 2001:44b8:4020::3ba7:c00d > old-greenblatt.idefix.net: ICMP6, echo request, seq 2551, length 64
22:48:43.153243 IP6 2001:418:2007::c611:f352 > old-greenblatt.idefix.net: ICMP6, echo request, seq 33555, length 64
22:48:47.752944 IP6 2001:559:0:300::6011:9036 > old-greenblatt.idefix.net: ICMP6, echo request, seq 14673, length 64
22:48:48.155782 IP6 2001:559:0:300::6011:9023 > old-greenblatt.idefix.net: ICMP6, echo request, seq 43716, length 64
22:48:55.208693 IP6 2001:450:2025::40d0:a419 > old-greenblatt.idefix.net: ICMP6, echo request, seq 19418, length 64
22:48:57.628638 IP6 2001:418:3808:100::48f7:2e6f > old-greenblatt.idefix.net: ICMP6, echo request, seq 51787, length 64
22:50:36.220974 IP6 2001:418:8404::cc02:a0b7 > old-greenblatt.idefix.net: ICMP6, echo request, seq 27196, length 64
22:50:47.102088 IP6 2001:418:4001:3::c657:b0c5 > old-greenblatt.idefix.net: ICMP6, echo request, seq 50291, length 64
22:50:56.675730 IP6 2001:590:0:2::d8f6:7acf > old-greenblatt.idefix.net: ICMP6, echo request, seq 19017, length 64
22:51:16.323368 IP6 2001:44b8:4020::3ba7:c00d > old-greenblatt.idefix.net: ICMP6, echo request, seq 38769, length 64
22:51:43.154029 IP6 2001:418:2007::c611:f352 > old-greenblatt.idefix.net: ICMP6, echo request, seq 14674, length 64
22:51:47.755011 IP6 2001:559:0:300::6011:9036 > old-greenblatt.idefix.net: ICMP6, echo request, seq 61327, length 64
22:51:48.168141 IP6 2001:559:0:300::6011:9023 > old-greenblatt.idefix.net: ICMP6, echo request, seq 24579, length 64

All source addresses have bits 65-96 set to 0. When I translate those to IPv4 addresses I get valid addresses (duh) which for example in the case of 2001:418:2007::c611:f352 map to the same organisation (NTT America). So I guess some type of dual-stack host is causing this, with all the same software setup. Some kind of global network probe is learning the 2001:888:1011::694 from somewhere.

I don't see this as 'wrong', it's just interesting. Why is something still using this old address.