AS7170 flaps and resulting non-event

Thu Dec 2 07:22:23 UTC 1999

Starting on the 19th of this month, the Merit routing report shows 
that AT&T-DISC(AS7170) is having some serious flapping issues with 
the Merit route server at the MAE-East (ten million updates in a day, 
as an example.)  Among other things, I'm interested if these flaps 
are being made to all peers of AS7170 at the MAE-East.  If that is 
the case, then nobody has noticed, or nobody cares, or nobody has 
raised it in a public forum yet.  If the silence has been caused by 
one of the first two situations, I'm interested in which is the true 
reason that there has been no hue and cry over this abnormal number 
of route insertions/removals.

A few questions and items to chew on:
   1: Is this something that anyone other than Merit is noticing? 
Could it be that AS7170 just doesn't have that many peers, or that 
the routes are flapping only to Merit's route server?
   2: Is this just being dampened to the point where nobody notices?
   3: Is the silence on this issue somehow indicative of the increased 
speed/memory of core routers in the North American and other routing 
structures?  [main point] If so, then this changes some arguments 
about who and why one will/will not peer, as well as dragging the 
corpse of "Sprint filtering" out of the grave.[/main point]
   4: Am I just reading this data incorrectly?  I don't have a direct 
peer with 7170 anywhere, so I can't look at my own records for 
double-checking.

Side notes:
   A: This isn't AT&T's only AS number - they have two others (7018 
and 5075) that seem to be used for quite a few announcements.  In 
fact, 7170 may not be the "primary" AS for AT&T - again, I don't have 
a crystal ball to see how they structure their announcements across 
the multiple AS'es.
   B: It's not easily possible for me to find which routes were 
flapping; could this be just a few routes out of the N that 7170 
announces?  (See 
http://www.merit.edu/~ipma/cooked/routing_table/view_in/mae-east/mae-e 
ast.7170.view.991128 for an exhaustive list of 7170's routes to Merit 
on the 28th)  If it's only a few of the routes, then perhaps 
dampening by peers simply quashed the rogue networks into oblivion 
without anyone noticing that these few routes were missing.
   C: Could this be related? 
http://www.infoworld.com/cgi-bin/displayStory.pl?99121.icatt.htm  I 
don't think so, but it's an interesting note nonetheless.  I don't 
see how DNS could be attached to the route flaps, but again I don't 
have a crystal ball into AT&T's network.

I've included selected sections from Merit's daily route flap mail. 
To see a complete list of the messages, browse to 
http://www.merit.net/mail.archives/html/routing-problems/ for more 
detail.

Largest Sources of BGP Instability
----------------------------------
(announcements + withdraws = total)

Dec 01: 1.  AT&T-DISC (AS7170) at Mae-East 10432535 + 36800 = 
10469335 BGP prefix updates
Nov 30: 1.  AT&T-DISC (AS7170) at Mae-East 10432535 + 36800 = 
10469335 BGP prefix updates
Nov 29: 1.  AT&T-DISC (AS7170) at Mae-East 11122216 + 16465 = 
11138681 BGP prefix updates
Nov 28: 1.  AT&T-DISC (AS7170) at Mae-East 10256555 + 17732 = 
10274287 BGP prefix updates
Nov 27: 1.  AT&T-DISC (AS7170) at Mae-East 9882016 + 23527 = 9905543 
BGP prefix updates
.
. [similar results in here]
.
Nov 19: 1.  AT&T-DISC (AS7170) at Mae-East 2462647 + 93171 = 2555818 
BGP prefix updates

[AT&T-DISC does not show up in the mail from the 18th or 17th, 
leading me to think these flaps started during the measured interval 
reported on the 19th.]

---
JT
jtodd at loligo.com