- NANOG - lists.nanog.org

router startup behavior
by Ratul Mahajan 15 Jan '02

15 Jan '02

at university of washington, we are doing a measurement study of bgp misconfiguration (http://www.cs.washington.edu/homes/ratul/bgp/index.html) one of the things we found is that there are a lot of announcements of more-specifics that come and go within a matter of 2-5 minutes. by talking to the operators involved in these incidents, we found that most of these are caused when the router is rebooted (intentionally or not). while some operators were aware of this side effect, most were not, and were taken by surprise that they just injected anywhere from 1-1000 routes into BGP only to withdraw them a couple of minutes later. i would like to understand this behavior better. is this behavior vendor-specific (cisco?) or pervasive? is there a configuration style that causes or avoids this "spill-over"? my understanding is limited to this happens when the bgp session comes up too soon, before the filters have taken effect. could someone familiar with router internals shed some light on it? the problem is limited to route origination only, or also propagation? in other words, can a router propagate a route it should not while starting up because export filters are not yet in place? never ever gotten my hands dirty into router configuration; your input would be invaluable. thanks, -- ratul

5 5

RE: router startup behavior
by Randy Bush 15 Jan '02

15 Jan '02

> a fix might be to not advertise any routes to a BGP peer until you > receive all the routes that peer has to send you. that will *greatly* reduce the garbage in the global routing table. to zero, in fact. and, of course, we can not know when a peer has sent all the routes it has to send to you. randy

4 4

AS109 - Contact
by German Martinez 14 Jan '02

14 Jan '02

Anyone with access to AS109 routers that can contact me off-line ? thank you German Martinez ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * THE DILBERT FUTURE * * Thriving on Stupidity in the 21st Century * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "Internet capacity will increase indefinitely to keep up with the egos of the people using it"

1 0

RE: router startup behavior
by Paul Donner 14 Jan '02

14 Jan '02

how long would you wait for? At 03:32 PM 1/14/2002, David Schwartz wrote: >On Mon, 14 Jan 2002 13:28:42 -0600, Steve Naslund wrote: > > >Here is my best guess as to what you are seeing. Most likely a large CIDR > >block is announced by a service provider A. A small CIDR block is given to > >a customer who is connected to multiple service providers and thus running > >BGP. Now the more specific route is announced by service provider B, he > >does not own the block but is announcing it on behalf of service provider As > >customer. What is happening is that the customer has a line or router > >failure and that withdraws their more specific announcement from service > >provider B. Since the service provider A is announcing a supernet route he > >now becomes the only route for that block. > > If that's the problem, a fix might be to not advertise any routes > to a BGP >peer until you receive all the routes that peer has to send you. I think it's >elegant that when two routers connect, neither sends any routes to the other >until each has received all the routes the other has to send. Very Zen, don't >you think? > > DS

1 0

RE: router startup behavior
by Steve Naslund 14 Jan '02

14 Jan '02

Sorry, didn't get your first message clear in my head. The next question I would have is what do the routes look like. To get that many routes for a couple of class Cs, the router's BGP must be really broke. I would try to look at router type and software version and see if there is a correlation there. I would then try Cisco's web site to see what the known BGP issues are for that IOS version. The bug toolkit has a lot of resolved BGP bugs but you need to know the version and platform in order to get a better search. You usually need a support contract to get to this area but you might be able to talk them into helping you or having one of the service providers submit the problem as a trouble case. Can you provide a sample of the routing table during the bad advertisements ? Steve > -----Original Message----- > From: Stephen J. Wilcox [mailto:steve@opaltelecom.co.uk] > Sent: Monday, January 14, 2002 1:53 PM > To: Ratul Mahajan; Steve Naslund > Subject: RE: router startup behavior > > > > that doesnt fit with the sequence of events outlined below > > ie > reboot > 1000+ routes appear > 1000+ routes removed > > you are saying > > line failure > 1000+ routes removed > line recovery > 1000+ routes appear > > and the numbers ie 1-1000 seems very high for this small provider with one > or two class Cs at a maximum > > On Mon, 14 Jan 2002, Steve Naslund wrote: > > > > > Here is my best guess as to what you are seeing. Most likely a > large CIDR > > block is announced > > by a service provider A. A small CIDR block is given to a > customer who is > > connected to multiple > > service providers and thus running BGP. Now the more specific route is > > announced by service provider B, > > he does not own the block but is announcing it on behalf of > service provider > > As customer. What is happening is that the customer has a line > or router > > failure and that withdraws their more specific announcement from service > > provider B. Since the service provider A is announcing a > supernet route he > > now becomes the only route > > for that block. > > > > +++++++++++++++++++++++++++++++ > > Steven Naslund > > Network Engineering Manager > > Hosting.com - Chicago > > +++++++++++++++++++++++++++++++ > > > > > -----Original Message----- > > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > > > Ratul Mahajan > > > Sent: Monday, January 14, 2002 12:54 PM > > > To: nanog(a)merit.edu > > > Subject: router startup behavior > > > > > > > > > > > > > > > at university of washington, we are doing a measurement study of bgp > > > misconfiguration > > > (http://www.cs.washington.edu/homes/ratul/bgp/index.html) > > > > > > one of the things we found is that there are a lot of announcements of > > > more-specifics that come and go within a matter of 2-5 minutes. > > > > > > by talking to the operators involved in these incidents, we found that > > > most of these are caused when the router is rebooted (intentionally or > > > not). while some operators were aware of this side effect, > most were not, > > > and were taken by surprise that they just injected anywhere > from 1-1000 > > > routes into BGP only to withdraw them a couple of minutes later. > > > > > > i would like to understand this behavior better. is this behavior > > > vendor-specific (cisco?) or pervasive? is there a > configuration style that > > > causes or avoids this "spill-over"? > > > > > > my understanding is limited to this happens when the bgp > session comes up > > > too soon, before the filters have taken effect. could someone familiar > > > with router internals shed some light on it? > > > > > > the problem is limited to route origination only, or also propagation? > > > in other words, can a router propagate a route it should not while > > > starting up because export filters are not yet in place? > > > > > > never ever gotten my hands dirty into router configuration; your input > > > would be invaluable. > > > > > > thanks, > > > -- ratul > > > > > > > > > > > > -- > Stephen J. Wilcox > IP Services Manager, Opal Telecom > http://www.opaltelecom.co.uk/ > Tel: 0161 222 2000 > Fax: 0161 222 2008 > >

1 0

Zywall / smurf amplifier
by Avleen Vig 14 Jan '02

14 Jan '02

Morning all, If there is a 'competant' technical support representative from ZyXEL on this list could you please contact me? As far as I'm able to tell, your ZyWALL 10 firewall+router combo by default[1] acts as a Smurf Amplifier, and I cannot disable directed IP broadcasting[2]. Or if anyone knows how to disable directed IP broadcasting on this equipment I'd appreciate an email. Kindest regards, Avleen Vig [1] I run the SAFE project at the address below. The information I've received is from someone with the above equipment who is having this problem, and having the usual amount of luck with tech support depts. [2] Very bad ;) -- Avleen Vig Smurf Amplifier Finding Executive: http://www.ircnetops.org/smurf Currently looking for work: http://www.silverwraith.com/resume.html

1 0

SSL for IRR queries?
by Tony Tauber 14 Jan '02

14 Jan '02

If there's a desire to trust information garnered from the Internet Routing Registry (eg. RADB, RIPE), it would seem that one would like a way to verify the server responding to queries. Is there a way to query the database using SSL or something else which can use digital certificates or other manner of keys which can be verified somewhat out-of-band? It would seem that it wouldn't be such a big deal to offer this capability not in lieu of, but just in addition to, the current "whois" protocol. No changes ought to be needed to the database language or back-end. Speaking of back-end, though, is there any verification that goes on in the mirroring process? Any comments or information are appreciated. Thanks, Tony

4 4

Deutsche Telekom
by Alex Rubenstein 13 Jan '02

13 Jan '02

I've tried emailing (no response) and calling (I don't speak german) the dtag.de NOC, to find out some info. If anyone from dtag.de is listening, please feel free to respond to me vie private email (alex(a)nac.net) Thanks! -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

1 0

OT: Need a QWEST NOC contact please - contact off-list
by Rich Sena 12 Jan '02

12 Jan '02

-- Rich Sena - ras(a)thick.net ThickNET Consulting "On the way to understanding; you understand, and forget."

1 0

Contact for Yahoo - Messenger service related
by Alexander Kiwerski 12 Jan '02

12 Jan '02

Howdy All- Does anyone have a contact at Yahoo in relation to the messenger service? (preferably someone with a clue about routers and IP filters) I've got an interesting little problem that appears everyday between 9:00 and 9:30 AM and vanishes about 5:00 pm (PST). Thanks in advance, /Alexander Kiwerski

2 1