[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
6453 routing leaks (January and Today)
- Subject: 6453 routing leaks (January and Today)
- From: jared at puck.nether.net (Jared Mauch)
- Date: Thu, 24 Feb 2011 22:05:19 -0500
- In-reply-to: <[email protected]>
- References: <[email protected]>
On Feb 24, 2011, at 7:50 PM, Kevin Oberman wrote:
> Can't say if it was a leak or de aggregation, but TATA announcements to
> us jumped from about 70,000 to almost 190,000 for a while today, then
> dropped back down.
It very much appears to be a leak based on the route-views MRT format updates. There's not a good reason for this observed prefix/path combination:
18.104.22.168/24 | 3549 6453 3356 22351 36939
I don't believe 3549 nor 3356 are buying transit from 6453 to reach each other.
One of the interesting measurements I track (people accuse me of pcaping all bgp updates, which is sorta true with this MRT archive) is the average file sizes of the route-views archive:
This is a good measure of how stable/unstable the network is. You can typically see when a network has performed some grooming or an event like this just by getting a feel for the file sizes. When they go from ~300KiB on average to something in the multiple megs, you know something happened.