[137972] in North American Network Operators' Group
Re: 6453 routing leaks (January and Today)
daemon@ATHENA.MIT.EDU (Jared Mauch)
Thu Feb 24 22:06:07 2011
From: Jared Mauch <jared@puck.nether.net>
In-Reply-To: <20110225005019.825711CC0B@ptavv.es.net>
Date: Thu, 24 Feb 2011 22:05:19 -0500
To: Kevin Oberman <oberman@es.net>
Cc: NANOG list <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Feb 24, 2011, at 7:50 PM, Kevin Oberman wrote:
> Can't say if it was a leak or de aggregation, but TATA announcements =
to
> us jumped from about 70,000 to almost 190,000 for a while today, then
> dropped back down.
It very much appears to be a leak based on the route-views MRT format =
updates. There's not a good reason for this observed prefix/path =
combination:
41.194.32.0/24 | 3549 6453 3356 22351 36939
I don't believe 3549 nor 3356 are buying transit from 6453 to reach each =
other.
One of the interesting measurements I track (people accuse me of pcaping =
all bgp updates, which is sorta true with this MRT archive) is the =
average file sizes of the route-views archive:
http://archive.routeviews.org/bgpdata/2011.02/UPDATES/
This is a good measure of how stable/unstable the network is. You can =
typically see when a network has performed some grooming or an event =
like this just by getting a feel for the file sizes. When they go from =
~300KiB on average to something in the multiple megs, you know something =
happened.
- Jared=
