RE: Global view increase (was:BGP route explosion)

Around 15mins ago an additional ~5,000 routes entered the global view, sadly
they appear to be hanging around.

Last Tuesday had an increase of 2,000 routes.

+7000 routes in a week is significant de-aggregation or leak, any ideas on
where these routes are flowing ?

I've not seen an increase on any of our peers, so I can only assume its
coming from a network who doesn't peer particularly "openly".

Around 15mins ago an additional ~5,000 routes entered the
global view, sadly
they appear to be hanging around.

This one I see.

These are coming from UUNET -at least as seen from here -
AS 705 added 4426 prefixes (from 609).

As there was not a corresponding increase in address space,
this is really more of a de-aggragation.

Same thing happened on Wed Apr 24 06:12:20, when
AS 701 added 2364 prefixes (from 2053). Again, it looked
like a de-aggragation.

If you look at Figure 1b of

you can clearly see both jumps.

AS 705 has only one ASN in transit through it from here.
The recent change was all _inside_ AS 705.

Marshall Eubanks

We see that too

Predominantly seems to be massive amounts of /24s in a couple of nets
which were previously /16s. Culprit would appear to be AS705

*>i63.0.0.0/24 100 0 286 209 701 705 i
*>i63.1.0.0/24 100 0 286 209 701 705 i
*>i63.2.0.0/24 100 0 286 209 701 705 i

Lots of new /20-24 in also AS705

In total AS705 is announcing 4432 new routes from yesterday.

If you're interested a copy of all new routes since yesterday is at:

THe file is 0.5Mb so I couldnt really email it :slight_smile:


This is more w.r.t. the huge burst of announcements yesterday,
not a persistent increase in the routing table sizes, but..

We saw absolutely huge amounts of announcements from
1 3459 17676 (sometimes with padding)

For example, see:


(Sorry for the long URL). Shows that we received something like 30k
announcements that originated from 17676 between 6 and 7 am on May 1st.
They were primarily announcing /23s out of large address space ranges
allocated to APNIC, like 219.31/16 and friends.


On Thu, May 02, 2002 at 11:33:50AM +0100, Stephen J. Wilcox mooed:

On Thu, May 02, 2002 at 12:55:45PM -0500, Gerardo Gregory mooed:




URL Seems unreachable (might be because there was a top level domain omitted
from the URL?)

Sorry, not enough sleep last night. Here's the corrected URL, with the
added bonus of stripping out some of the unnecessary goo:


UUNET has "re-absorbed" 6869 routes and everything seems back to
normal here.


David G. Andersen wrote: