6453 routing leaks (January and Today)
Jared Mauch
jared at puck.nether.net
Fri Feb 25 03:05:19 UTC 2011
On Feb 24, 2011, at 7:50 PM, Kevin Oberman wrote:
> Can't say if it was a leak or de aggregation, but TATA announcements to
> us jumped from about 70,000 to almost 190,000 for a while today, then
> dropped back down.
It very much appears to be a leak based on the route-views MRT format updates. There's not a good reason for this observed prefix/path combination:
41.194.32.0/24 | 3549 6453 3356 22351 36939
I don't believe 3549 nor 3356 are buying transit from 6453 to reach each other.
One of the interesting measurements I track (people accuse me of pcaping all bgp updates, which is sorta true with this MRT archive) is the average file sizes of the route-views archive:
http://archive.routeviews.org/bgpdata/2011.02/UPDATES/
This is a good measure of how stable/unstable the network is. You can typically see when a network has performed some grooming or an event like this just by getting a feel for the file sizes. When they go from ~300KiB on average to something in the multiple megs, you know something happened.
- Jared
More information about the NANOG
mailing list