On Thu, 14 Aug 2003 22:12:28 -0500 (CDT) Rob Thomas <robt@cymru.com> wrote:

Hi, Mark.

] Anybody watching the bgp routing table.. I see about 5,000 less routes than ] usual. Anybody know a good pointer..

I saw a drop of 2655 prefixes and 425 ASN. Reminds me of the drop several days _after_ 9/11, when the generators ran out of power. As a guess, these must be enterprise ASN without backup power. Regards Marshall Eubanks

I'm seeing a decrease of 3510 prefixes. There is a bit of churn, though things are reasonably calm overall.

Total prefix count: <http://www.cymru.com/BGP/robbgp01.html>

Prefix delta: <http://www.cymru.com/BGP/deltapref.html>

Other bits of critical infrastructure seem to be unimpacted.

Root server response: <http://www.cymru.com/DNS/dns.html>

com/net gTLD server response: <http://www.cymru.com/DNS/gtlddns-cn.html>

Interestingly enough, some of the error conditions in the global table have decreased.

Prefixes with inconsistent-as: <http://www.cymru.com/BGP/incon01.html>

Others have not:

Bogus ASN leakage: <http://www.cymru.com/BGP/asnbogusrep.html>

] (im just getting bored waiting for us to run out of fuel)

Hang in there! I hope the power is restored to everyone soon. If there is anything I or Team Cymru can do to assist, don't hesitate to ping on us.

Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

On Thursday, August 14, 2003, at 11:34 PM, Danny McPherson wrote:

Current_Total: 120,475 Max_Total: 123,814 Average_Total: 122,029

I failed to consider that today's average has been skewed by the outage data being factored for the last 10 hours or so towards the "Daily Average". I looked at yesterday's daily average which was 122855, just over 800 more prefixes.

Current v. Average: 98.73% (1554 prefixes)

So comparing yesterday's average to today's current I get closer to the value Rob and others posted: Current v. Yesterday's Average: 98.06% (2380 prefixes) -danny

Some updated images of routing table size and 7-day prefix withdrawals: http://gradus.renesys.com/aug2003/blackout3-rtsize.gif http://gradus.renesys.com/aug2003/aug7-aug15-withdrawals.gif (Blackout is event #3 on the right.) We're about halfway back to the table sizes we started with yesterday before the grid tripped. If it trends the same way through the afternoon, it could be back to its old self sometime around midnight GMT; previous experience suggests that it might stabilize somewhat higher than before the event. At any rate, steady improvement as power returns across the East. ---------- James Cowie Renesys Corporation cowie@renesys.com

Okay, here are a couple quick screenshots of what we're looking at tonight.

First, a plot that shows the routing table size shrinkage since the onset of the blackout at 16:13:07 +/- EDT, across a group of routers.

http://gradus.renesys.com/aug2003/blackout1-rtsize.gif

Second, a wider-angle 3D plot of prefix withdrawal rates over the last week, reported by various peers (one line per).

http://gradus.renesys.com/aug2003/aug7-aug14-withdrawals.gif

The blackout is the big event at the right hand edge (#3).

Note the sustained high rates of route withdrawal that have been the norm since the onset of MSBlast. Unlike typical single-cause events (like the one marked #1), MSBlast scanning has caused prefix withdrawal rates to gently "lift off" into a noiser mode across the board, lasting for days (so far).

...

(im just getting bored waiting for us to run out of fuel)

Ouch ..

---------- James Cowie Renesys Corporation cowie@renesys.com