ATT BGP - Advertising my network on accident

Richard Barnes richard.barnes at gmail.com
Tue Jun 29 00:45:09 UTC 2010


So, as periodically happens to me, what started as an idle curiosity
turned into an experiment.  I took a look at a RIB snapshot from
Friday, from one of the RouteViews collectors, to see how common it is
that a block gets advertised by two different ASes, as a whole block
by one, and as a set of smaller blocks by the other.

It turns out there's a non-trivial amount out there -- 490 blocks
broken up, adding 1,815 prefixes announced, accounting for 19,623 RIB
entries.  More details below; let me know if you're interested in even
more.  Seems kind of interesting, as a form of deaggregation that
doesn't show up in things like the CIDR report (since it's not within
a single AS).

(Standard caveats apply: This is a quick pass, not controlled for
things like two ASes belonging to the same entity.)

--Richard


Total number of deaggregated prefixes: 490
Total additional prefixes advertised: 1815
Total additional RIB entries: 19623 (0.5% out of 3530845 total entries)
Total addresses affected: 78863360 (roughly 1,203 /16s)

Extremal points:

1. Largest deaggregated block: 17.0.0.0/8, advertised by AS7018
(AT&T), deaggregated into two /9s by AS714 (Apple Engineering)

2. Most fractured block: 58.140.0.0/14, advertised by AS3786 (LG
DACOM, KR), deaggregated into 69 prefixes (ranging from /17 to /24) by
AS10036 (C&M Communication, KR).


Distribution of the number of additional prefixes:
Prefixes   Count
   2        343
   3         13
   4         80
   5          5
   6          1
   7          4
   8         17
   9          5
  10          1
  11          1
  14          1
  15          1
  16          6
  17          1
  20          2
  32          7
  34          1
  69          1

Distribution of prefix lengths deaggregated:
Len   Count
 8      1
11      1
12      3
13      9
14     17
15     22
16     47
17     25
18     29
19     65
20     52
21     56
22     69
23     92
24      2

Distribution of the number of addresses affected:
Addresses     Count
     512         2
    1024        92
    2048        69
    4096        56
    8192        52
   16384        65
   32768        29
   65536        25
  131072        47
  262144        22
  524288        17
 1048576         9
 2097152         3
 4194304         1
33554432         1




More information about the NANOG mailing list