Longest prepend( 255 times) as path found

Hey everyone,

Too many hops found as below.
Usually What shoud we do ? Should we filter it ?

91.246.12.0/24

AS path: 4788 9002 41313 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 I

AS path: 9930 9002 41313 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 51196 I

/noname

There are some generally accepted and useful filters found at https://bgpfilterguide.nlnog.net/. There is one which covers excess prepends.

It’s generally accepted to filter very long as paths.

As Alistair pointed to. The guide mentions 100x max path length as a (current!) value that won’t filter out long current as paths. (And protect you from others missing filtering.)
https://bgpfilterguide.nlnog.net/guides/long_paths/

If you want to go for a lower than 100 value. RIB dumps from the ripe ris collectors / route-views may be the most accessible starting point for data to analyse.

If you want to read data about avg as path lengths over the years. APNIC publishes data about it. https://blog.apnic.net/2022/01/06/bgp-in-2021-the-bgp-table/

Hello Alistair,

Are you sure there is one about excess prepends?. I just took a look and I did not find any.

I found one about filtering long as-paths but not specifically about prepends.

Thanks,

Alejandro,

I would imagine the "long as-path" one would handle excessive prepends
too, right?

50 prepends is silly but doesn't really hurt my feelings. But >100 is absurd.

Usually What shoud we do ? Should we filter it ?

As with many things, the answer depends on your situation.

If I was running an edge device with a limited FIB, perhaps I might drop it to save memory. If I had beefier devices, perhaps I would just depref it. Maybe it’s a prefix/source ASN I have to care about in some way so I had to take some other action.

There is no one size fits all answer.

Is prepending an announcement to oblivion generally useless? Yes. But people will do it. So you just have to decide if you need to care, and then what to do , or not do.

https://datatracker.ietf.org/doc/html/draft-ietf-grow-as-path-prepending

Cheers,

Jeff

If I was running an edge device with a limited FIB, perhaps I might drop it to save memory. If I had beefier devices, perhaps I would just depref it.

Note that if said prefix either existed elsewhere with fewer prepends that meant it ‘won’ bgp best-path selection, then it would not result in any difference in the FIB.
The FIB is where the ‘winning’ prefixes go as fully-resolved things from the RIB, but the RIB too would not have it, as an alternative won in BGP. And even if you depref’d it in BGP, it would still be there in the control-plane, consuming the same amount of RAM.

Reject it for excess prepends is likely the best choice.

Hi Tom,

Neither of these answers make much sense to me. If you're using a
default route to overcome a limited FIB, you want a more reliably
chosen set of routes to filter than the stray error route that
shouldn't have reached you.

Nearly all paths on the Internet are still under 64 hops wide (packet
TTL of 64) so finding a non-customer route with more than double that
number of elements in the AS path suggests someone tried to do
something fancy in a local environment and it leaked. Not only is it
reasonably safe to discard such routes, long AS paths have been
responsible for triggering bugs in multiple BGP implementations.
Failing to filter it may actually be harmful to folks downstream from
you.

Regards,
Bill Herrin

Yeah,I meant RIB, not FIB. Should have finished coffee first. :slight_smile:

Here’s a related good article:

“Excessive BGP AS-PATH prepending is a self-inflicted vulnerability”

You probably should not use a limit greater than 50 unless you want to encourage this behavior.

There have been previous substantive discussions on network operator mailing lists regarding why to use one specific limit or another.

Unfortunately I wasn’t able to find the discussion thread that I remember that represented some consensus among backbones roughly around 50, so instead here are various random configuration examples that use “bgp maxas-limit 50”

(etc… there are more)