[63425] in North American Network Operators' Group
RE: as6198 aggregation event
daemon@ATHENA.MIT.EDU (Terry Baranski)
Sun Oct 5 16:21:40 2003
From: "Terry Baranski" <tbaranski@mail.com>
To: "'James Cowie'" <cowie@renesys.com>, <nanog@merit.edu>
Date: Sun, 5 Oct 2003 15:01:20 -0400
In-Reply-To: <20031005132629.R6014@buda.renesys.com>
Errors-To: owner-nanog-outgoing@merit.edu
James Cowie wrote:
> On Friday, we noted with some interest the appearance of more
> than six hundred deaggregated /24s into the global routing
> tables. More unusually, they're still in there this morning.
>
> AS6198 (BellSouth Miami) seems to have been patiently injecting
> them over the course of several hours, between about 04:00 GMT
> and 08:00 GMT on Friday morning (3 Oct 2003).
If you look at the 09/19 and 09/26 CIDR Reports, BellSouth Atlanta
(AS6197) did something similar during this time period -- they added
about 350 deaggregated prefixes, most if not all /24's.
> Usually when we see deaggregations, they hit quickly and they
> disappear quickly; nice sharp vertical jumps in the table size.
> This event lasted for hours and, more importantly, the prefixes
> haven't come back out again, an unusual pattern for a single-origin
> change that effectively expanded global tables by half a percent.
That AS6197's additions are still present isn't encouraging.
-Terry
