Jared Mauch wrote:
> Can anyone verify whether Cisco still does BGP this way? (Propagate, then
> kill origionating session). If so, it rather clearly answers the question
> about how this managed to make it throughout the network...I'm fairly sure that is not the case anymore.
> (For the record: I'm not trying to Cisco-bash here. All vendors have
> problems, and when you have a huge market share, your problems tend to
> show up much more obviously, when they appear. However, Cisco does still
> have a huge market share, meaning this affected a whole lot of people,
> if true... so, I'm curious).From what I can tell this time it was not ciscos fault. It
appears that the vendor that had the problem just had an issue with
a specific "valid" announcement that others propogated to it.
All I can say is that the only report I have had about what caused the
whole mess to start was a Cisco BugID regarding a mangling done by some
IOS versions on a particular sort of route update that made it invalid
(or perhaps, "more invalid"). And if Cisco is no longer propagating routes
before shutting down the source session, then we're back to wondering how
this particular issue managed to cause flaps at the same time across at
least 5 "big player" networks that I've had reports about (including 3
by direct observation), at the same time. This person must have some pretty
impressive connectivity, if they managed to get what appears to be well
over a dozen routers at the absolute minimum, and more likely in the range
of "hundreds" if the rumor volume is at all accurate, to each display the
bug (since, if a bad announcement isn't propagated, it will never reach
anything but the direct peers; thus, this person would have to be directly
peered with every router that anyone saw flapping sessions to a customer).
Now, I'll grant, it would be possible to do this, but for them to have
hit just *our* network, they would have to be on 3 major carries in 3
states, including some places that a normal class B-type announcer just
isn't terribly likely to have a peering session.
What is interesting is one could use this to see what
providers are using vendor "X" at exchange points.
Quite true. Though I suspect that in some cases, this might only tell you
what routing code they use. Making too many inferences is probably unwise.
Especially given the number of folks who thought they knew who "X" was,
only to state their guess and come out wrong...