So am I just excitable?
I have been watching the "Weekly Global IPv4 Routing Table Report" for a while now, and have been itching to see the *BGP routing table entries examined line* hit 1M. Now, perhaps I am naive, I am assuming that line correlates to the actual number of routing table entries, true? Am I the only one a bit excited to see this? Is this a non-event? michael brooks Network/Systems Administrator IV Adams 12 Five Star Schools michael.brooks@adams12.org :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: "flying is learning how to throw yourself at the ground and miss" -- <http://www.adams12.org> -- This is a staff email account managed by Adams 12 Five Star Schools. This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender.
michael brooks - ESC via NANOG wrote on 29/08/2025 20:42:
I have been watching the "Weekly Global IPv4 Routing Table Report" for a while now, and have been itching to see the *BGP routing table entries examined line* hit 1M. Now, perhaps I am naive, I am assuming that line correlates to the actual number of routing table entries, true?
Am I the only one a bit excited to see this? Is this a non-event?
not a non-event. There's almost certainly kit still in deployment which has forwarding table capacity to handle 2^20 = 1048576 entries. Typically once you exceed these limits on a hardware platform, you lose synchronisation between rib and fib, and end up with non-deterministic routing / unexpected blackholing. Add in even a medium sized internal routing table and a bunch of l3vpns, and the limit will be reached even sooner on these platforms. So yeah, this will be an issue for some operators. Nick
Geoff's data at Potaroo had the FIB clearing 1M back in Febuary if memory serves. So this already happened months ago. On Fri, Aug 29, 2025 at 3:43 PM michael brooks - ESC via NANOG < nanog@lists.nanog.org> wrote:
I have been watching the "Weekly Global IPv4 Routing Table Report" for a while now, and have been itching to see the *BGP routing table entries examined line* hit 1M. Now, perhaps I am naive, I am assuming that line correlates to the actual number of routing table entries, true?
Am I the only one a bit excited to see this? Is this a non-event?
michael brooks Network/Systems Administrator IV Adams 12 Five Star Schools michael.brooks@adams12.org :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: "flying is learning how to throw yourself at the ground and miss"
-- This is a staff email account managed by Adams 12 Five Star Schools. This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. _______________________________________________ NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/T2DMKVJR...
Geoff's data at Potaroo had the FIB clearing 1M back in Febuary if memory serves. So this already happened months ago.
Well, NOW you tell me... ...but that does ring a faint bell. michael brooks Network/Systems Administrator IV Adams 12 Five Star Schools michael.brooks@adams12.org :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: "flying is learning how to throw yourself at the ground and miss" On Fri, Aug 29, 2025 at 2:16 PM Tom Beecher <beecher@beecher.cc> wrote:
Geoff's data at Potaroo had the FIB clearing 1M back in Febuary if memory serves. So this already happened months ago.
On Fri, Aug 29, 2025 at 3:43 PM michael brooks - ESC via NANOG < nanog@lists.nanog.org> wrote:
I have been watching the "Weekly Global IPv4 Routing Table Report" for a while now, and have been itching to see the *BGP routing table entries examined line* hit 1M. Now, perhaps I am naive, I am assuming that line correlates to the actual number of routing table entries, true?
Am I the only one a bit excited to see this? Is this a non-event?
michael brooks Network/Systems Administrator IV Adams 12 Five Star Schools michael.brooks@adams12.org :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: "flying is learning how to throw yourself at the ground and miss"
-- This is a staff email account managed by Adams 12 Five Star Schools. This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. _______________________________________________ NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/T2DMKVJR... <https://urldefense.com/v3/__https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/T2DMKVJRCXO6QQ2LHV6GD4LWPZAV5BNU/__;!!IR39LLzvxw!LyvZoDt5n3KvXic2XYOIxSKeFcb53tXrNsufA4ruTB3v_3yUtwr1OFA16N-yJ_1WqEOJl-Xqn98JL9ti4b9AG9k4uA$>
-- <http://www.adams12.org> -- This is a staff email account managed by Adams 12 Five Star Schools. This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender.
It is not a non-event. On Fri, Aug 29, 2025, 3:47 PM michael brooks - ESC via NANOG < nanog@lists.nanog.org> wrote:
I have been watching the "Weekly Global IPv4 Routing Table Report" for a while now, and have been itching to see the *BGP routing table entries examined line* hit 1M. Now, perhaps I am naive, I am assuming that line correlates to the actual number of routing table entries, true?
Am I the only one a bit excited to see this? Is this a non-event?
michael brooks Network/Systems Administrator IV Adams 12 Five Star Schools michael.brooks@adams12.org :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: "flying is learning how to throw yourself at the ground and miss"
-- This is a staff email account managed by Adams 12 Five Star Schools. This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. _______________________________________________ NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/T2DMKVJR...
On 2025-08-29 15:15, Tom Beecher via NANOG wrote:
Geoff's data at Potaroo had the FIB clearing 1M back in Febuary if memory serves. So this already happened months ago.
I'm confused by that. I show 990450 prefixes in my FIB, 990478 in RIB. Potaroo shows 1022758 prefixes in FIB for today. Why would there be a discrepancy of over 32k prefixes? We're blocking exactly 0 prefixes from our three upstreams. I would understand a hand-waving explanation of "this is the Internet, it's always being updated, and everyone has a different view of it" if the discrepancy were 10^2 or even 10^3. But over 10^5? That's a bit like the three top ASNs for route count just disappeared from the Internet. -Brian
On 30 Aug 2025, at 7:49 am, Brian Knight via NANOG <nanog@lists.nanog.org> wrote:
On 2025-08-29 15:15, Tom Beecher via NANOG wrote:
Geoff's data at Potaroo had the FIB clearing 1M back in Febuary if memory serves. So this already happened months ago.
I'm confused by that.
I show 990450 prefixes in my FIB, 990478 in RIB.
Potaroo shows 1022758 prefixes in FIB for today.
Why would there be a discrepancy of over 32k prefixes?
We're blocking exactly 0 prefixes from our three upstreams.
I would understand a hand-waving explanation of "this is the Internet, it's always being updated, and everyone has a different view of it" if the discrepancy were 10^2 or even 10^3. But over 10^5? That's a bit like the three top ASNs for route count just disappeared from the Internet.
every eBGP speaker has a different view of the collection of announced BGP routes. Check out figure 2 of https://www.potaroo.net/ispcol/2025-01/bgp2024.html which plots the 8 hourly RIB count of every peer of Route Views and every peer of RIPE RIS over the 2024/2025 year.s The range of RIB counts varies consistently by 40,000 entries across this set of peers. The IPv6 RIB data has a similar variance of 20,000 entries (out of 200,000). (Figure 15 of the sam article) And, yes, each of these peers has a subtly different set of reachable address prefixes. As of a fre hours ago the "consensus" core spaned some 3,107,033,088 IPv4 /32's in the RIB, but each peer generall cannot see some 50,000 to 150,000 prefixes in its RIB, and sees a further 20,000 to 100,000 /32 prefixes that are not part of a common consensus. So, yes, it really is a case of "this is the Internet, it's always being updated, and everyone has a different view of it", :-) regards, Geoff
I would understand a hand-waving explanation of "this is the Internet, it's always being updated, and everyone has a different view of it" if the discrepancy were 10^2 or even 10^3. But over 10^5? That's a bit like the three top ASNs for route count just disappeared from the Internet.
It really isn't hand waving. It's honestly the correct answer. :) When you dig into the BGP update data that you can see from your upstreams, (or parse through Geoff's data :) ) you can really get some fascinating insight into how dynamic this stuff actually is. With the frequent side effect of wondering just how drunk a given ASN may be some days. ( Or most days. :p ) On Fri, Aug 29, 2025 at 5:49 PM Brian Knight via NANOG < nanog@lists.nanog.org> wrote:
On 2025-08-29 15:15, Tom Beecher via NANOG wrote:
Geoff's data at Potaroo had the FIB clearing 1M back in Febuary if memory serves. So this already happened months ago.
I'm confused by that.
I show 990450 prefixes in my FIB, 990478 in RIB.
Potaroo shows 1022758 prefixes in FIB for today.
Why would there be a discrepancy of over 32k prefixes?
We're blocking exactly 0 prefixes from our three upstreams.
I would understand a hand-waving explanation of "this is the Internet, it's always being updated, and everyone has a different view of it" if the discrepancy were 10^2 or even 10^3. But over 10^5? That's a bit like the three top ASNs for route count just disappeared from the Internet.
-Brian _______________________________________________ NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/EZZSRHYM...
I see the cause of the discrepancy now. Bumped up our RIB against Route Views, and I see lots of disaggregation on Route Views that isn't present in our RIB. Had no idea we were being shielded from *that* many /24's. Many apologies for the Friday night stupidity :( -Brian On 2025-08-29 16:49, Brian Knight via NANOG wrote:
On 2025-08-29 15:15, Tom Beecher via NANOG wrote:
Geoff's data at Potaroo had the FIB clearing 1M back in Febuary if memory serves. So this already happened months ago.
I'm confused by that.
I show 990450 prefixes in my FIB, 990478 in RIB.
Potaroo shows 1022758 prefixes in FIB for today.
Why would there be a discrepancy of over 32k prefixes?
We're blocking exactly 0 prefixes from our three upstreams.
I would understand a hand-waving explanation of "this is the Internet, it's always being updated, and everyone has a different view of it" if the discrepancy were 10^2 or even 10^3. But over 10^5? That's a bit like the three top ASNs for route count just disappeared from the Internet.
-Brian _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/EZZSRHYM...
On 30 Aug 2025, at 10:00 am, Brian Knight via NANOG <nanog@lists.nanog.org> wrote:
I see the cause of the discrepancy now. Bumped up our RIB against Route Views, and I see lots of disaggregation on Route Views that isn't present in our RIB. Had no idea we were being shielded from *that* many /24's.
Many apologies for the Friday night stupidity :(
Absolutely no need to apologise - what you are seeing is that BGP is used for both basic reachability and traffic engineering, and the most reliable way for a route advertiser to dictate pol;icies to others is to use more specific prefixes. Little wonder that more specifics account for 52% of the BGP RIB in IPv4. Geoff
Brian Knight via NANOG wrote on 30/8/2025 10:00:
I see the cause of the discrepancy now. Bumped up our RIB against Route Views, and I see lots of disaggregation on Route Views that isn't present in our RIB. Had no idea we were being shielded from *that* many /24's.
Oh and if you take a general wander around all the collectors in various parts of the world, and compare the full views we get there versus what you see. Or what I see in my weekly Routing Table Report I send here (and a few NOG lists), which is pretty much what the RouteViews collector hosted for us by the WIDE project at DIXIE gets to see (my Routing Table Report view is courtesy of APNIC's peering there).
Many apologies for the Friday night stupidity :(
As others have said, this global routing table is a most fascinating thing, everywhere you look at it. :-) philip -->
-Brian
On 2025-08-29 16:49, Brian Knight via NANOG wrote:
On 2025-08-29 15:15, Tom Beecher via NANOG wrote:
Geoff's data at Potaroo had the FIB clearing 1M back in Febuary if memory serves. So this already happened months ago.
I'm confused by that.
I show 990450 prefixes in my FIB, 990478 in RIB.
Potaroo shows 1022758 prefixes in FIB for today.
Why would there be a discrepancy of over 32k prefixes?
We're blocking exactly 0 prefixes from our three upstreams.
I would understand a hand-waving explanation of "this is the Internet, it's always being updated, and everyone has a different view of it" if the discrepancy were 10^2 or even 10^3. But over 10^5? That's a bit like the three top ASNs for route count just disappeared from the Internet.
-Brian _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/ nanog@lists.nanog.org/message/EZZSRHYMF33CNM2V5IJ4S3B2NABQC2JF/
NANOG mailing list https://lists.nanog.org/archives/list/ nanog@lists.nanog.org/message/APLS66EDUVWPVJFF5SSV53U2IKF7SCWV/
On the point of:
lots of disaggregation on Route Views that isn't present in our RIB
At least a few people on this thread are more used to examining and analyzing this point than I am; but, if I'm not mistaken, at least some of that de-aggregation in Route Views, RIS, or other route-collectors may result from networks giving feeds to the collectors that are either internal iBGP feeds or otherwise don't represent what they typically send to "the outside world". Not only is it unlikely that one may ever see convergence to just one type of feed to collectors from all the participants, but even if one did, it's not straightforward whether the view that "a customer" or a non-transit partner might receive is preferable. See some research about "Global BGP Attacks That Evade Route Monitoring <https://ripe89.ripe.net/archives/video/1540/>" from 2024, for instance. Cheers, Tony On Sat, Aug 30, 2025 at 3:03 AM Philip Smith via NANOG < nanog@lists.nanog.org> wrote:
Brian Knight via NANOG wrote on 30/8/2025 10:00:
I see the cause of the discrepancy now. Bumped up our RIB against Route Views, and I see lots of disaggregation on Route Views that isn't present in our RIB. Had no idea we were being shielded from *that* many /24's.
Oh and if you take a general wander around all the collectors in various parts of the world, and compare the full views we get there versus what you see. Or what I see in my weekly Routing Table Report I send here (and a few NOG lists), which is pretty much what the RouteViews collector hosted for us by the WIDE project at DIXIE gets to see (my Routing Table Report view is courtesy of APNIC's peering there).
Many apologies for the Friday night stupidity :(
As others have said, this global routing table is a most fascinating thing, everywhere you look at it. :-)
philip -->
-Brian
On 2025-08-29 16:49, Brian Knight via NANOG wrote:
On 2025-08-29 15:15, Tom Beecher via NANOG wrote:
Geoff's data at Potaroo had the FIB clearing 1M back in Febuary if memory serves. So this already happened months ago.
I'm confused by that.
I show 990450 prefixes in my FIB, 990478 in RIB.
Potaroo shows 1022758 prefixes in FIB for today.
Why would there be a discrepancy of over 32k prefixes?
We're blocking exactly 0 prefixes from our three upstreams.
I would understand a hand-waving explanation of "this is the Internet, it's always being updated, and everyone has a different view of it" if the discrepancy were 10^2 or even 10^3. But over 10^5? That's a bit like the three top ASNs for route count just disappeared from the Internet.
-Brian
At least a few people on this thread are more used to examining and analyzing this point than I am; but, if I'm not mistaken, at least some of that de-aggregation in Route Views, RIS, or other route-collectors may result from networks giving feeds to the collectors that are either internal iBGP feeds or otherwise don't represent what they typically send to "the outside world".
Yes. This happens all the time. Sometimes maliciously , sometimes not. A particular ASN used to send me some /24s that they didn't send to the DFZ or anyone else for a specific business case. They also didn't announce a covering aggregate for that either. At the time , we were sending our IBGP view to a route-collector. At some point that ASN (rightly) started to announce the covering aggregate to the DFZ, and started calling me because whoever they were using for hijack monitoring started complaining I was hijacking these /24s. On Sun, Aug 31, 2025 at 11:27 AM Tony Tauber via NANOG < nanog@lists.nanog.org> wrote:
On the point of:
lots of disaggregation on Route Views that isn't present in our RIB
At least a few people on this thread are more used to examining and analyzing this point than I am; but, if I'm not mistaken, at least some of that de-aggregation in Route Views, RIS, or other route-collectors may result from networks giving feeds to the collectors that are either internal iBGP feeds or otherwise don't represent what they typically send to "the outside world".
Not only is it unlikely that one may ever see convergence to just one type of feed to collectors from all the participants, but even if one did, it's not straightforward whether the view that "a customer" or a non-transit partner might receive is preferable.
See some research about "Global BGP Attacks That Evade Route Monitoring <https://ripe89.ripe.net/archives/video/1540/>" from 2024, for instance.
Cheers, Tony
On Sat, Aug 30, 2025 at 3:03 AM Philip Smith via NANOG < nanog@lists.nanog.org> wrote:
Brian Knight via NANOG wrote on 30/8/2025 10:00:
I see the cause of the discrepancy now. Bumped up our RIB against Route Views, and I see lots of disaggregation on Route Views that isn't present in our RIB. Had no idea we were being shielded from *that* many /24's.
Oh and if you take a general wander around all the collectors in various parts of the world, and compare the full views we get there versus what you see. Or what I see in my weekly Routing Table Report I send here (and a few NOG lists), which is pretty much what the RouteViews collector hosted for us by the WIDE project at DIXIE gets to see (my Routing Table Report view is courtesy of APNIC's peering there).
Many apologies for the Friday night stupidity :(
As others have said, this global routing table is a most fascinating thing, everywhere you look at it. :-)
philip -->
-Brian
On 2025-08-29 16:49, Brian Knight via NANOG wrote:
On 2025-08-29 15:15, Tom Beecher via NANOG wrote:
Geoff's data at Potaroo had the FIB clearing 1M back in Febuary if memory serves. So this already happened months ago.
I'm confused by that.
I show 990450 prefixes in my FIB, 990478 in RIB.
Potaroo shows 1022758 prefixes in FIB for today.
Why would there be a discrepancy of over 32k prefixes?
We're blocking exactly 0 prefixes from our three upstreams.
I would understand a hand-waving explanation of "this is the Internet, it's always being updated, and everyone has a different view of it" if the discrepancy were 10^2 or even 10^3. But over 10^5? That's a bit like the three top ASNs for route count just disappeared from the Internet.
-Brian
NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/SRSNDFOZ...
Hi.
When you dig into the BGP update data that you can see from your upstreams, (or parse through Geoff's data :) ) you can really get some fascinating insight into how dynamic this stuff actually is.
It takes a bit of setup, but this system lets one analyse BGP update data from all the peers of RIPE RIS route collectors: https://github.com/tonusoo/ripe-ris-data-to-exabgp Perhaps it’s useful. Martin
participants (10)
-
Brian Knight -
Geoff Huston -
Joe Loiacono -
Martin Tonusoo -
michael brooks - ESC -
Nick Hilliard -
Philip Smith -
Randy Bush -
Tom Beecher -
Tony Tauber