6453 routing leaks (January and Today)

Fri Feb 25 12:22:36 UTC 2011

Update:

I have had a source ask me to post the following:

-- snip --
The problem with route leaking was caused by specific routing platform resulting in some peer routes not being properly tagged.
We are deploying additional measures to prevent this from happening in the future
-- snip --

- Jared

On Feb 24, 2011, at 4:59 PM, Jared Mauch wrote:

> It appears there have been a large number of routing leaks from 6453 today based on my detection scripts that have been running.
> 
> (shameless plug for http://puck.nether.net/bgp/leakinfo.cgi)
> 
> A quick report of the data show (for today so far) a few thousand of leaks more than is normal for a day like today.  I included a snapshot of yesterday below as well.
> 
> I've included a more detailed report of the prefixes observed involved here: 
> 
> http://puck.nether.net/~jared/tata-leak-20110224.txt
> 
> This seems to be a somewhat common event for 6453, loking through the history of data available, another event happened on 2011-01-28 as well.
> 
> I'm interested in what best operational practices people have employed to help avoid the leaks seen here so I can document them for others to learn to prevent this from happening again.
> 
> - Jared
> 
> bgp=# select count(blame_asn),blame_asn,asn_responsible from leakinfo where aprox_time::date = '2011-02-24' group by blame_asn,asn_responsible order by 1 desc;
> count | blame_asn | asn_responsible 
> -------+-----------+-----------------
>  2208 | 6453      | 6453
>   360 | 7473      | 3257
>   230 |           | 
>   170 | 17379     | 5511
>   130 | 8068      | 3356
>    39 | 3225      | 6453
>    34 | 45419     | 3356
>    26 | 3356      | 3356
>    25 | 12180     | 2828
>    18 | 22351     | 701
>    16 | 7991      | 2914
>    16 | 14051     | 1239
>    10 | 29571     | 5511
>     4 | 32327     | 2828
>     4 | 8966      | 2914
>     4 | 19080     | 1239
>     4 | 30209     | 7018
>     4 | 18734     | 701
>     4 | 4657      | 3320
>     3 | 33748     | 1239
>     2 | 5056      | 1239
>     2 | 10026     | 2828
>     2 | 12252     | 2914
>     1 | 11696     | 2828
> (24 rows)
> 
> bgp=# select count(blame_asn),blame_asn,asn_responsible from leakinfo where aprox_time::date = '2011-02-23' group by blame_asn,asn_responsible order by 1 desc;
> count | blame_asn | asn_responsible 
> -------+-----------+-----------------
>   384 | 7473      | 3257
>   120 | 17379     | 5511
>    48 |           | 
>    27 | 45419     | 3356
>    24 | 12180     | 2828
>    11 | 23456     | 2914
> (6 rows)
> 
> bgp=# select count(blame_asn),blame_asn,asn_responsible from leakinfo where aprox_time::date = '2011-01-28' group by blame_asn,asn_responsible order by 1 desc;
> count | blame_asn | asn_responsible 
> -------+-----------+-----------------
>  9119 | 6453      | 6453
>  2265 |           | 
>   355 | 2914      | 2914
>   313 | 7473      | 3257
>   250 | 17379     | 5511
>   213 | 32592     | 701
>   106 | 3790      | 1239
>    72 | 19108     | 6461
>    62 | 14051     | 1239
>    51 | 34977     | 6453
>    48 | 31133     | 3356
>    47 | 8657      | 174
>    32 | 7713      | 2914
>    31 | 1257      | 1239
>    31 | 8966      | 2914
>    30 | 30209     | 7018
>    30 | 31133     | 1299
>    29 | 8342      | 1239
>    24 | 38925     | 3320
>    24 | 12180     | 2828
>    22 | 8657      | 3549
>    21 | 15641     | 3549
>    18 | 31133     | 2914
>    16 | 15412     | 2914
>    15 | 7473      | 3549
>    10 | 6762      | 1299
>    10 | 6762      | 7018
>    10 | 20299     | 1239
>    10 | 6762      | 3561
>    10 | 6762      | 174
>     9 | 4323      | 2914
>     7 | 26163     | 6461
>     7 | 9505      | 174
>     7 | 15149     | 6461
>     7 | 9070      | 3549
>     7 | 7819      | 6461
>     6 | 7473      | 174
>     6 | 3216      | 3549
>     6 | 1273      | 174
>     5 | 8657      | 3356
>     5 | 26769     | 3549
>     5 | 6762      | 2914
>     5 | 6762      | 3356
>     4 | 8047      | 701
>     4 | 8877      | 174
>     4 | 174       | 174
>     2 | 20299     | 174
>     2 | 7843      | 174
>     2 | 7473      | 6453
>     2 | 8928      | 3320
>     2 | 7991      | 2914
>     1 | 1273      | 3549
>     1 | 20485     | 2914
>     1 | 3216      | 1239
> (54 rows)
> 