normal accidents: rfc1918 traffic sent to roots 

updates for private addresses leak outside local domains
spectroscopy analysis of RFC1918 updates coming from DHCP/nameservers  
tens of millions a day coming to blackhole servers
51.4M updates in 86.5 hrs = 10,000/min = 165/s. up to 1200 updates/s (nov02), up to 29 pkts/update

weekday, weekend patterns; weird spikes at midnight local time (4 in US, 3 in Asia, 2 in Europe)
can see that Asians work on the weekend, Europeans not so much 
can see that Europeans and Asians get to work on time