IPv4 routes did a quick bounce to 600,949 around 9:30AM EST, than went back down to 599,241 shortly after. Seemed like a big jump so I setup an alert, just wondering if anyone else noticed anything, I’m not overly concerned, but seemed like a route leak possibly and I didn’t really see anything on bgpstream. Sincerely, Eric Tykwinski TrueNet, Inc. P: 610-429-8300
Hi Eric, On Wed, Oct 12, 2016 at 06:43:18PM -0400, Eric Tykwinski wrote:
IPv4 routes did a quick bounce to 600,949 around 9:30AM EST, than went back down to 599,241 shortly after. Seemed like a big jump so I setup an alert, just wondering if anyone else noticed anything, I’m not overly concerned, but seemed like a route leak possibly and I didn’t really see anything on bgpstream.
Those numbers are entirely reasonable. In fact, the aggregate of unique IPv4 routes on the NLNOG RING Looking Glass is 685,926. Hanging of AS 2914 it is 601,186 in Amsterdam. Similar numbers are observed by AS 131072 at http://www.cidr-report.org/as2.0/ Kind regards, Job
Hi Eric, My secret spy satellite informs me that Eric Tykwinski wrote On 2016-10-12, 3:43 PM:
IPv4 routes did a quick bounce to 600,949 around 9:30AM EST, than went back down to 599,241 shortly after. Seemed like a big jump so I setup an alert, just wondering if anyone else noticed anything, I’m not overly concerned, but seemed like a route leak possibly and I didn’t really see anything on bgpstream.
Looks like AS45899 (Vietnam Posts and Telecommunications Group) de-aggregated a bunch of their prefixes into 2,090 new more specifics at around the time you mentioned. BGPmon.net data observed the two thousand new prefixes or so originated by AS45899 at around 2016-10-12 13:26 (UTC). Most peers lost the prefix a few minutes later at 13:29 UTC you can find an example here: https://stat.ripe.net/widget/bgplay#w.resource=14.191.200.0%2F22 some other example prefixes include: 14.191.200.0/22 14.191.228.0/22 14.191.24.0/21 14.191.24.0/21 14.191.140.0/22 Looking at the data it appears the same de-aggregation event involving AS45899 happened on 2016-08-03 as well. You didn't see this on BGPstream.com because we currently don't publish de-aggregation event (ie. more specifics (by the same AS). Cheers Andree
participants (3)
-
Andree Toonk -
Eric Tykwinski -
Job Snijders