Global view increase (was:BGP route explosion)

Thu May 2 17:56:12 UTC 2002

UUNET has "re-absorbed" 6869 routes and everything seems back to
normal here.

Marshall

David G. Andersen wrote:

> This is more w.r.t. the huge burst of announcements yesterday,
> not a persistent increase in the routing table sizes, but..
> 
> We saw absolutely huge amounts of announcements from
> 1 3459 17676 (sometimes with padding)
> 
> For example, see:
> 
> http://ginseng/bgpview.cgi?time=between&start=2002-05-01+06%3A00%3A00&end=2002-05-01+07%3A00%3A00&bins=100&prefix=&rel=eq&aspath=&asrel=contain&origin_as=17676&scale=linear&table=updates_new&action=plot&View=View
> 
> (Sorry for the long URL).  Shows that we received something like 30k 
> announcements that originated from 17676 between 6 and 7 am on May 1st.
> They were primarily announcing /23s out of large address space ranges
> allocated to APNIC, like 219.31/16 and friends.
> 
>   -Dave
> 
> 
> On Thu, May 02, 2002 at 11:33:50AM +0100, Stephen J. Wilcox mooed:
> 
>>We see that too
>>
>>Predominantly seems to be massive amounts of /24s in a couple of nets
>>which were previously /16s. Culprit would appear to be AS705
>>
>>*>i63.0.0.0/24      62.24.196.1                   100      0 286 209 701 705 i
>>*>i63.1.0.0/24      62.24.196.1                   100      0 286 209 701 705 i
>>*>i63.2.0.0/24      62.24.196.1                   100      0 286 209 701 705 i
>>.....
>>
>>Lots of new /20-24 in 67.0.0.0/8 also AS705
>>
>>In total AS705 is announcing 4432 new routes from yesterday.
>>
>>
>>If you're interested a copy of all new routes since yesterday is at:
>>
>>http://noc.opaltelecom.net/newbgp020502.txt
>>
>>THe file is 0.5Mb so I couldnt really email it :)
>>
>>Steve
>>
>>
>>
>>On Thu, 2 May 2002, James Spenceley wrote:
>>
>>
>>>Around 15mins ago an additional ~5,000 routes entered the global view, sadly
>>>they appear to be hanging around. 
>>>
>>>Last Tuesday had an increase of 2,000 routes. 
>>>
>>>+7000 routes in a week is significant de-aggregation or leak, any ideas on
>>>where these routes are flowing ?
>>>
>>>I've not seen an increase on any of our peers, so I can only assume its
>>>coming from a network who doesn't peer particularly "openly".
>>>
>>>--
>>>James
>>>
>>>
> 

-- 
                                  Regards
                                  Marshall Eubanks

This e-mail may contain confidential and proprietary information of
Multicast Technologies, Inc, subject to Non-Disclosure Agreements

T.M. Eubanks
Multicast Technologies, Inc
10301 Democracy Lane, Suite 410
Fairfax, Virginia 22030
Phone : 703-293-9624       Fax     : 703-293-9609
e-mail : tme at multicasttech.com
http://www.multicasttech.com

Test your network for multicast :
http://www.multicasttech.com/mt/
  Status of Multicast on the Web  :
  http://www.multicasttech.com/status/index.html