Just a quick question...

Andree Toonk andree+nanog at toonk.nl
Thu Oct 13 06:55:39 UTC 2016


Hi Eric,

My secret spy satellite informs me that Eric Tykwinski wrote On
2016-10-12, 3:43 PM:
> IPv4 routes did a quick bounce to 600,949 around 9:30AM EST, than went back down to 599,241 shortly after.  
> Seemed like a big jump so I setup an alert, just wondering if anyone else noticed anything, I’m not overly concerned, but seemed like a route leak possibly and I didn’t really see anything on bgpstream.


Looks like AS45899 (Vietnam Posts and Telecommunications Group)
de-aggregated a bunch of their prefixes into 2,090 new more specifics at
around the time you mentioned.

BGPmon.net data observed the two thousand new prefixes or so originated
by AS45899 at around 2016-10-12 13:26 (UTC).
Most peers lost the prefix a few minutes later at 13:29 UTC

you can find an example here:
https://stat.ripe.net/widget/bgplay#w.resource=14.191.200.0%2F22

some other example prefixes include:
14.191.200.0/22
14.191.228.0/22
14.191.24.0/21
14.191.24.0/21
14.191.140.0/22

Looking at the data it appears the same de-aggregation event involving
AS45899 happened on 2016-08-03 as well.

You didn't see this on BGPstream.com because we currently don't publish
de-aggregation event (ie. more specifics (by the same AS).

Cheers
 Andree





More information about the NANOG mailing list