Just a quick question...

Mailman List Mirror (Read Only)
1

IPv4 routes did a quick bounce to 600,949 around 9:30AM EST, than went back down to 599,241 shortly after. Seemed like a big jump so I setup an alert, just wondering if anyone else noticed anything, I’m not overly concerned, but seemed like a route leak possibly and I didn’t really see anything on bgpstream.

Sincerely,

Eric Tykwinski
TrueNet, Inc.
P: 610-429-8300

2

Hi Eric,

IPv4 routes did a quick bounce to 600,949 around 9:30AM EST, than went
back down to 599,241 shortly after. Seemed like a big jump so I setup
an alert, just wondering if anyone else noticed anything, I’m not
overly concerned, but seemed like a route leak possibly and I didn’t
really see anything on bgpstream.

Those numbers are entirely reasonable.

In fact, the aggregate of unique IPv4 routes on the NLNOG RING Looking
Glass is 685,926. Hanging of AS 2914 it is 601,186 in Amsterdam.

Similar numbers are observed by AS 131072 at
http://www.cidr-report.org/as2.0/

Kind regards,

Job

3

Hi Eric,

My secret spy satellite informs me that Eric Tykwinski wrote On
2016-10-12, 3:43 PM:

IPv4 routes did a quick bounce to 600,949 around 9:30AM EST, than went back down to 599,241 shortly after.
Seemed like a big jump so I setup an alert, just wondering if anyone else noticed anything, I’m not overly concerned, but seemed like a route leak possibly and I didn’t really see anything on bgpstream.

Looks like AS45899 (Vietnam Posts and Telecommunications Group)
de-aggregated a bunch of their prefixes into 2,090 new more specifics at
around the time you mentioned.

BGPmon.net data observed the two thousand new prefixes or so originated
by AS45899 at around 2016-10-12 13:26 (UTC).
Most peers lost the prefix a few minutes later at 13:29 UTC

you can find an example here:

some other example prefixes include:
14.191.200.0/22
14.191.228.0/22
14.191.24.0/21
14.191.24.0/21
14.191.140.0/22

Looking at the data it appears the same de-aggregation event involving
AS45899 happened on 2016-08-03 as well.

You didn't see this on BGPstream.com because we currently don't publish
de-aggregation event (ie. more specifics (by the same AS).

Cheers
Andree