On Feb 24, 2011, at 7:50 PM, Kevin Oberman wrote:
Can't say if it was a leak or de aggregation, but TATA announcements to us jumped from about 70,000 to almost 190,000 for a while today, then dropped back down.
It very much appears to be a leak based on the route-views MRT format updates. There's not a good reason for this observed prefix/path combination: 41.194.32.0/24 | 3549 6453 3356 22351 36939 I don't believe 3549 nor 3356 are buying transit from 6453 to reach each other. One of the interesting measurements I track (people accuse me of pcaping all bgp updates, which is sorta true with this MRT archive) is the average file sizes of the route-views archive: http://archive.routeviews.org/bgpdata/2011.02/UPDATES/ This is a good measure of how stable/unstable the network is. You can typically see when a network has performed some grooming or an event like this just by getting a feel for the file sizes. When they go from ~300KiB on average to something in the multiple megs, you know something happened. - Jared