Yeah this is why I split out these connection counts in this way. There were dozens of subnets and single IPs that spun up hundreds or thousands of connections, so I automated null routing those sources once crossing the 1024 threshold.
so at any point in time I believe there were hundreds of nodes that -only- connected to me, and that doesn’t sound good.
when the infra ran uninterrupted for 60+ days these single source counts were double or higher.
I should not be able to do something like this for $2k/mo.