Possible new RIS Beacon? (Alternating visible pair)
Hey everybody, On my seemingly never ending task to find all "stuck" BGP sessions, I feel like there is an interesting thing that could be done for the RIPE RIS Beacons, and that is a pair of prefixes that alternate between being visible and invisible (IE: unannounced). I looked at the current estate of beacon prefixes and couldn't find anything that would fit this use case already. This would be useful to be able to tell if a prefix or session has got a stuck prefix at that current moment in time, by being able to check the time and see if the presence of a prefix shouldn't be visible. In the interests of full disclosure this would be very useful for bgp.tools to instantly “spot check” BGP feeds to see if they have stuck prefixes or not. What does everybody think? This should "only" require two /24s and two /48s, and I think this would also help researchers see the severity of stuck sessions in a much more measurable way than having to wait for hours for the beacons to go on or off! (Apologies if this is not the right place for this kind of discussion, but there were previous mails about the beacons here, so I figured here was a good place) Cheers Ben
Dear Ben, On Mon, Jan 22, 2024 at 06:16:28PM +0000, Ben Cartwright-Cox via mat-wg wrote:
On my seemingly never ending task to find all "stuck" BGP sessions, I feel like there is an interesting thing that could be done for the RIPE RIS Beacons, and that is a pair of prefixes that alternate between being visible and invisible (IE: unannounced).
I looked at the current estate of beacon prefixes and couldn't find anything that would fit this use case already.
Good news - I think this is already covered by existing beacons! :-) Reading https://ris.ripe.net/docs/routing-beacons/#current-beaconing-setup """ For all beacon prefixes below we have a 2 hour up - 2 hour down schedule. Specifically: Announcements at 00:00, 04:00, 08:00, 12:00, 16:00, 20:00 (UTC) Withdrawals at 02:00, 06:00, 10:00, 14:00, 18:00, 22:00 (UTC) """ Make sure to focus on the 'type = beacon' prefixes, and use 'type = anchor' as baseline: e.g. if 'anchor' is missing but you see 'beacon', something is off. The above beacons have been used in the past to study the zombie phenomenon: https://www.iijlab.net/en/members/romain/pdf/pora_anrw2021.pdf Using these beacons in a semi-real-time fashion in your monitoring service seems productive. Kind regards, Job
I managed to totally miss that section of the docs, My bad (and thanks)! I will try with those and report back if that works though I do think that 10 mins is a little tight! Cheers Job On Mon, Jan 22, 2024 at 6:26 PM Job Snijders <job@sobornost.net> wrote:
Dear Ben,
On Mon, Jan 22, 2024 at 06:16:28PM +0000, Ben Cartwright-Cox via mat-wg wrote:
On my seemingly never ending task to find all "stuck" BGP sessions, I feel like there is an interesting thing that could be done for the RIPE RIS Beacons, and that is a pair of prefixes that alternate between being visible and invisible (IE: unannounced).
I looked at the current estate of beacon prefixes and couldn't find anything that would fit this use case already.
Good news - I think this is already covered by existing beacons! :-)
Reading https://ris.ripe.net/docs/routing-beacons/#current-beaconing-setup
""" For all beacon prefixes below we have a 2 hour up - 2 hour down schedule. Specifically:
Announcements at 00:00, 04:00, 08:00, 12:00, 16:00, 20:00 (UTC) Withdrawals at 02:00, 06:00, 10:00, 14:00, 18:00, 22:00 (UTC) """
Make sure to focus on the 'type = beacon' prefixes, and use 'type = anchor' as baseline: e.g. if 'anchor' is missing but you see 'beacon', something is off.
The above beacons have been used in the past to study the zombie phenomenon: https://www.iijlab.net/en/members/romain/pdf/pora_anrw2021.pdf
Using these beacons in a semi-real-time fashion in your monitoring service seems productive.
Kind regards,
Job
participants (2)
-
Ben Cartwright-Cox -
Job Snijders