RE: Global view increase (was:BGP route explosion)
Around 15mins ago an additional ~5,000 routes entered the global view, sadly they appear to be hanging around. Last Tuesday had an increase of 2,000 routes. +7000 routes in a week is significant de-aggregation or leak, any ideas on where these routes are flowing ? I've not seen an increase on any of our peers, so I can only assume its coming from a network who doesn't peer particularly "openly". -- James
On Thu, 2 May 2002 19:59:52 +1000 James Spenceley <jrs@comindico.com.au> wrote:
Around 15mins ago an additional ~5,000 routes entered the global view, sadly they appear to be hanging around.
This one I see. These are coming from UUNET -at least as seen from here - AS 705 added 4426 prefixes (from 609). As there was not a corresponding increase in address space, this is really more of a de-aggragation. Same thing happened on Wed Apr 24 06:12:20, when AS 701 added 2364 prefixes (from 2053). Again, it looked like a de-aggragation. If you look at Figure 1b of http://www.multicasttech.com/status/index.html you can clearly see both jumps. AS 705 has only one ASN in transit through it from here. The recent change was all _inside_ AS 705. Regards Marshall Eubanks
Last Tuesday had an increase of 2,000 routes.
+7000 routes in a week is significant de-aggregation or leak, any ideas on where these routes are flowing ?
I've not seen an increase on any of our peers, so I can only assume its coming from a network who doesn't peer particularly "openly".
-- James
We see that too Predominantly seems to be massive amounts of /24s in a couple of nets which were previously /16s. Culprit would appear to be AS705 *>i63.0.0.0/24 62.24.196.1 100 0 286 209 701 705 i *>i63.1.0.0/24 62.24.196.1 100 0 286 209 701 705 i *>i63.2.0.0/24 62.24.196.1 100 0 286 209 701 705 i ..... Lots of new /20-24 in 67.0.0.0/8 also AS705 In total AS705 is announcing 4432 new routes from yesterday. If you're interested a copy of all new routes since yesterday is at: http://noc.opaltelecom.net/newbgp020502.txt THe file is 0.5Mb so I couldnt really email it :) Steve On Thu, 2 May 2002, James Spenceley wrote:
Around 15mins ago an additional ~5,000 routes entered the global view, sadly they appear to be hanging around.
Last Tuesday had an increase of 2,000 routes.
+7000 routes in a week is significant de-aggregation or leak, any ideas on where these routes are flowing ?
I've not seen an increase on any of our peers, so I can only assume its coming from a network who doesn't peer particularly "openly".
-- James
This is more w.r.t. the huge burst of announcements yesterday, not a persistent increase in the routing table sizes, but.. We saw absolutely huge amounts of announcements from 1 3459 17676 (sometimes with padding) For example, see: http://ginseng/bgpview.cgi?time=between&start=2002-05-01+06%3A00%3A00&end=2002-05-01+07%3A00%3A00&bins=100&prefix=&rel=eq&aspath=&asrel=contain&origin_as=17676&scale=linear&table=updates_new&action=plot&View=View (Sorry for the long URL). Shows that we received something like 30k announcements that originated from 17676 between 6 and 7 am on May 1st. They were primarily announcing /23s out of large address space ranges allocated to APNIC, like 219.31/16 and friends. -Dave On Thu, May 02, 2002 at 11:33:50AM +0100, Stephen J. Wilcox mooed:
We see that too
Predominantly seems to be massive amounts of /24s in a couple of nets which were previously /16s. Culprit would appear to be AS705
*>i63.0.0.0/24 62.24.196.1 100 0 286 209 701 705 i *>i63.1.0.0/24 62.24.196.1 100 0 286 209 701 705 i *>i63.2.0.0/24 62.24.196.1 100 0 286 209 701 705 i .....
Lots of new /20-24 in 67.0.0.0/8 also AS705
In total AS705 is announcing 4432 new routes from yesterday.
If you're interested a copy of all new routes since yesterday is at:
http://noc.opaltelecom.net/newbgp020502.txt
THe file is 0.5Mb so I couldnt really email it :)
Steve
On Thu, 2 May 2002, James Spenceley wrote:
Around 15mins ago an additional ~5,000 routes entered the global view, sadly they appear to be hanging around.
Last Tuesday had an increase of 2,000 routes.
+7000 routes in a week is significant de-aggregation or leak, any ideas on where these routes are flowing ?
I've not seen an increase on any of our peers, so I can only assume its coming from a network who doesn't peer particularly "openly".
-- James
-- work: dga@lcs.mit.edu me: dga@pobox.com MIT Laboratory for Computer Science http://www.angio.net/
UUNET has "re-absorbed" 6869 routes and everything seems back to normal here. Marshall David G. Andersen wrote:
This is more w.r.t. the huge burst of announcements yesterday, not a persistent increase in the routing table sizes, but..
We saw absolutely huge amounts of announcements from 1 3459 17676 (sometimes with padding)
For example, see:
(Sorry for the long URL). Shows that we received something like 30k announcements that originated from 17676 between 6 and 7 am on May 1st. They were primarily announcing /23s out of large address space ranges allocated to APNIC, like 219.31/16 and friends.
-Dave
On Thu, May 02, 2002 at 11:33:50AM +0100, Stephen J. Wilcox mooed:
We see that too
Predominantly seems to be massive amounts of /24s in a couple of nets which were previously /16s. Culprit would appear to be AS705
*>i63.0.0.0/24 62.24.196.1 100 0 286 209 701 705 i *>i63.1.0.0/24 62.24.196.1 100 0 286 209 701 705 i *>i63.2.0.0/24 62.24.196.1 100 0 286 209 701 705 i .....
Lots of new /20-24 in 67.0.0.0/8 also AS705
In total AS705 is announcing 4432 new routes from yesterday.
If you're interested a copy of all new routes since yesterday is at:
http://noc.opaltelecom.net/newbgp020502.txt
THe file is 0.5Mb so I couldnt really email it :)
Steve
On Thu, 2 May 2002, James Spenceley wrote:
Around 15mins ago an additional ~5,000 routes entered the global view, sadly they appear to be hanging around.
Last Tuesday had an increase of 2,000 routes.
+7000 routes in a week is significant de-aggregation or leak, any ideas on where these routes are flowing ?
I've not seen an increase on any of our peers, so I can only assume its coming from a network who doesn't peer particularly "openly".
-- James
-- Regards Marshall Eubanks This e-mail may contain confidential and proprietary information of Multicast Technologies, Inc, subject to Non-Disclosure Agreements T.M. Eubanks Multicast Technologies, Inc 10301 Democracy Lane, Suite 410 Fairfax, Virginia 22030 Phone : 703-293-9624 Fax : 703-293-9609 e-mail : tme@multicasttech.com http://www.multicasttech.com Test your network for multicast : http://www.multicasttech.com/mt/ Status of Multicast on the Web : http://www.multicasttech.com/status/index.html
participants (4)
-
David G. Andersen -
James Spenceley -
Marshall Eubanks -
Stephen J. Wilcox