Hi Eric, My secret spy satellite informs me that Eric Tykwinski wrote On 2016-10-12, 3:43 PM:
IPv4 routes did a quick bounce to 600,949 around 9:30AM EST, than went back down to 599,241 shortly after. Seemed like a big jump so I setup an alert, just wondering if anyone else noticed anything, I’m not overly concerned, but seemed like a route leak possibly and I didn’t really see anything on bgpstream.
Looks like AS45899 (Vietnam Posts and Telecommunications Group) de-aggregated a bunch of their prefixes into 2,090 new more specifics at around the time you mentioned. BGPmon.net data observed the two thousand new prefixes or so originated by AS45899 at around 2016-10-12 13:26 (UTC). Most peers lost the prefix a few minutes later at 13:29 UTC you can find an example here: https://stat.ripe.net/widget/bgplay#w.resource=14.191.200.0%2F22 some other example prefixes include: 14.191.200.0/22 14.191.228.0/22 14.191.24.0/21 14.191.24.0/21 14.191.140.0/22 Looking at the data it appears the same de-aggregation event involving AS45899 happened on 2016-08-03 as well. You didn't see this on BGPstream.com because we currently don't publish de-aggregation event (ie. more specifics (by the same AS). Cheers Andree