Facebook post-mortems...

Jean St-Laurent jean at ddostest.me
Tue Oct 5 14:38:37 UTC 2021


Does anyone have info whether this network 69.171.240.0/20 was reachable during the outage.

 

Jean

 

From: NANOG <nanog-bounces+jean=ddostest.me at nanog.org> On Behalf Of Tom Beecher
Sent: October 5, 2021 10:30 AM
To: NANOG <nanog at nanog.org>
Subject: Re: Facebook post-mortems...

 

People keep repeating this but I don't think it's true.

 

My comment is solely sourced on my direct observations on my network, maybe 30-45 minutes in. 

 

Everything except a few /24s disappeared from DFZ providers, but I still heard those prefixes from direct peerings. There was no disaggregation that I saw, just the big stuff gone. This was consistent over 5 continents from my viewpoints.

 

Others may have seen different things at different times. I do not run an eyeball so I had no need to continually monitor.  

 

On Tue, Oct 5, 2021 at 10:22 AM Niels Bakker <niels=nanog at bakker.net <mailto:nanog at bakker.net> > wrote:

* telescope40 at gmail.com <mailto:telescope40 at gmail.com>  (Lou D) [Tue 05 Oct 2021, 15:12 CEST]:
>Facebook stopped announcing the vast majority of their IP space to 
>the DFZ during this.

People keep repeating this but I don't think it's true.

It's probably based on this tweet: 
https://twitter.com/ryan505/status/1445118376339140618

but that's an aggregate adding up prefix counts from many sessions. 
The total number of hosts covered by those announcements didn't vary 
by nearly as much, since to a significant extent it were more specifics 
(/24) of larger prefixes (e.g. /17) that disappeared, while those /17s 
stayed.

(There were no covering prefixes for WhatsApp's NS addresses so those 
were completely unreachable from the DFZ.)


        -- Niels.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20211005/9e1f0d87/attachment.html>


More information about the NANOG mailing list