AS3333 <> RIS problems over the weekend?
One of those rare occasions where someone from Nanog uses RIS, but now he got confused by the vast number of updates coming to RIS from RIPE NCC (AS3333) over the weekend. Could one of you enlighten him (or the list at large) what caused this? -- Rene ---------- Forwarded message ---------- Message-ID: <2ed0bc680511061121v288974f9jdf3bf99466bb6568@mail.gmail.com> From: NetSecGuy <netsecguy@gmail.com> Sender: owner-nanog@merit.edu To: nanog@merit.edu Date: Sun, 6 Nov 2005 14:21:00 -0500 Subject: Re: BGP terminology question At the risk of sounding like a total moron, can anyone explain what is happening here? This is from RIS, specifically RRC00. Here is some sample output of route_btoa from this file: http://data.ris.ripe.net/rrc00/2005.11/updates.20051106.0430.gz <snip> BGP4MP|1131251415|STATE|193.0.0.56|3333|1|2 BGP4MP|1131251415|STATE|193.0.0.56|3333|2|4 BGP4MP|1131251415|STATE|193.0.0.56|3333|4|5 BGP4MP|1131251415|STATE|193.0.0.56|3333|5|6 BGP4MP|1131251415|A|193.0.0.56|3333|8.11.252.0/23|3333 3356 11168|IGP|193.0.0.56|0|0||NAG|| BGP4MP|1131251415|A|193.0.0.56|3333|8.11.254.0/23|3333 3356 11168|IGP|193.0.0.56|0|0||NAG|| BGP4MP|1131251415|A|193.0.0.56|3333|8.10.241.0/24|3333 1103 1273 6395 22324 22324|IGP|193.0.0.56|0|0||NAG|| BGP4MP|1131251415|A|193.0.0.56|3333|8.15.2.0/24|3333 6320 8001 6395 26049 26049 26049 26049|IGP|193.0.0.56|0|0||NAG|| </snip> I understand AS3333 is RIS itself, is this some kind of misconfig on their end? It seems to be announcing it's entire table every 5 minutes. This started late Friday and ended a few hours ago. On 11/6/05, Patrick W. Gilmore <patrick@ianai.net> wrote:
On Nov 6, 2005, at 1:05 PM, NetSecGuy wrote:
I asked this question on inet-access and it was suggested I try NANOG.
I understand BGP flapping to be announcements followed by withdraws over a short period. I am seeing a peer with a large number of announcements and the normal number of withdraws. Is there a term to describe what I am seeing? I'd like to understand what is happening, but I've been looking for more info and can't seem to find anything. I suspect I am just not using the right words to search.
If there isn't a term, why would a peer announce thousands of time an hour with very few withdraws?
There is a term, it's called "broken".
A peer should never announce a route it has already announced unless that route is withdrawn. (If the session goes down or is reset, that counts as a withdrawal.)
-- TTFN, patrick
Is Ops going to reply? I assume this is because of the RIPE NCC router upgrade. AFAIK, RIS does not use AS3333. Rene, in future maybe you should be clear who you expect to handle an issue. "someone" sometimes resolves things, but not always and you can never be sure. Rene Wilhelm wrote:
One of those rare occasions where someone from Nanog uses RIS, but now he got confused by the vast number of updates coming to RIS from RIPE NCC (AS3333) over the weekend.
Could one of you enlighten him (or the list at large) what caused this?
-- Rene
---------- Forwarded message ---------- Message-ID: <2ed0bc680511061121v288974f9jdf3bf99466bb6568@mail.gmail.com> From: NetSecGuy <netsecguy@gmail.com> Sender: owner-nanog@merit.edu To: nanog@merit.edu Date: Sun, 6 Nov 2005 14:21:00 -0500 Subject: Re: BGP terminology question
At the risk of sounding like a total moron, can anyone explain what is happening here?
This is from RIS, specifically RRC00. Here is some sample output of route_btoa from this file: http://data.ris.ripe.net/rrc00/2005.11/updates.20051106.0430.gz <snip> BGP4MP|1131251415|STATE|193.0.0.56|3333|1|2 BGP4MP|1131251415|STATE|193.0.0.56|3333|2|4 BGP4MP|1131251415|STATE|193.0.0.56|3333|4|5 BGP4MP|1131251415|STATE|193.0.0.56|3333|5|6 BGP4MP|1131251415|A|193.0.0.56|3333|8.11.252.0/23|3333 3356 11168|IGP|193.0.0.56|0|0||NAG|| BGP4MP|1131251415|A|193.0.0.56|3333|8.11.254.0/23|3333 3356 11168|IGP|193.0.0.56|0|0||NAG|| BGP4MP|1131251415|A|193.0.0.56|3333|8.10.241.0/24|3333 1103 1273 6395 22324 22324|IGP|193.0.0.56|0|0||NAG|| BGP4MP|1131251415|A|193.0.0.56|3333|8.15.2.0/24|3333 6320 8001 6395 26049 26049 26049 26049|IGP|193.0.0.56|0|0||NAG|| </snip>
I understand AS3333 is RIS itself, is this some kind of misconfig on their end? It seems to be announcing it's entire table every 5 minutes. This started late Friday and ended a few hours ago.
On 11/6/05, Patrick W. Gilmore <patrick@ianai.net> wrote:
On Nov 6, 2005, at 1:05 PM, NetSecGuy wrote:
I asked this question on inet-access and it was suggested I try NANOG.
I understand BGP flapping to be announcements followed by withdraws over a short period. I am seeing a peer with a large number of announcements and the normal number of withdraws. Is there a term to describe what I am seeing? I'd like to understand what is happening, but I've been looking for more info and can't seem to find anything. I suspect I am just not using the right words to search.
If there isn't a term, why would a peer announce thousands of time an hour with very few withdraws?
There is a term, it's called "broken".
A peer should never announce a route it has already announced unless that route is withdrawn. (If the session goes down or is reset, that counts as a withdrawal.)
-- TTFN, patrick
At 21:39 07/11/2005, Shane Kerr wrote:
Is Ops going to reply?
I sent the original poster an offline reply explaining the difference between AS3333 and AS12654.
I assume this is because of the RIPE NCC router upgrade. AFAIK, RIS does not use AS3333.
Rene, in future maybe you should be clear who you expect to handle an issue. "someone" sometimes resolves things, but not always and you can never be sure.
Well, I guess the question is: who is responsible for handling these kind of questions? OPS (its about our network) or RIS (it is about the data)? Henk
Rene Wilhelm wrote:
One of those rare occasions where someone from Nanog uses RIS, but now he got confused by the vast number of updates coming to RIS from RIPE NCC (AS3333) over the weekend.
Could one of you enlighten him (or the list at large) what caused this?
-- Rene
---------- Forwarded message ---------- Message-ID: <2ed0bc680511061121v288974f9jdf3bf99466bb6568@mail.gmail.com> From: NetSecGuy <netsecguy@gmail.com> Sender: owner-nanog@merit.edu To: nanog@merit.edu Date: Sun, 6 Nov 2005 14:21:00 -0500 Subject: Re: BGP terminology question
At the risk of sounding like a total moron, can anyone explain what is happening here?
This is from RIS, specifically RRC00. Here is some sample output of route_btoa from this file: http://data.ris.ripe.net/rrc00/2005.11/updates.20051106.0430.gz <snip> BGP4MP|1131251415|STATE|193.0.0.56|3333|1|2 BGP4MP|1131251415|STATE|193.0.0.56|3333|2|4 BGP4MP|1131251415|STATE|193.0.0.56|3333|4|5 BGP4MP|1131251415|STATE|193.0.0.56|3333|5|6 BGP4MP|1131251415|A|193.0.0.56|3333|8.11.252.0/23|3333 3356 11168|IGP|193.0.0.56|0|0||NAG|| BGP4MP|1131251415|A|193.0.0.56|3333|8.11.254.0/23|3333 3356 11168|IGP|193.0.0.56|0|0||NAG|| BGP4MP|1131251415|A|193.0.0.56|3333|8.10.241.0/24|3333 1103 1273 6395 22324 22324|IGP|193.0.0.56|0|0||NAG|| BGP4MP|1131251415|A|193.0.0.56|3333|8.15.2.0/24|3333 6320 8001 6395 26049 26049 26049 26049|IGP|193.0.0.56|0|0||NAG|| </snip>
I understand AS3333 is RIS itself, is this some kind of misconfig on their end? It seems to be announcing it's entire table every 5 minutes. This started late Friday and ended a few hours ago.
On 11/6/05, Patrick W. Gilmore <patrick@ianai.net> wrote:
On Nov 6, 2005, at 1:05 PM, NetSecGuy wrote:
I asked this question on inet-access and it was suggested I try NANOG.
I understand BGP flapping to be announcements followed by withdraws over a short period. I am seeing a peer with a large number of announcements and the normal number of withdraws. Is there a term to describe what I am seeing? I'd like to understand what is happening, but I've been looking for more info and can't seem to find anything. I suspect I am just not using the right words to search.
If there isn't a term, why would a peer announce thousands of time an hour with very few withdraws?
There is a term, it's called "broken".
A peer should never announce a route it has already announced unless that route is withdrawn. (If the session goes down or is reset, that counts as a withdrawal.)
-- TTFN, patrick
------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)
Henk Uijterwaal wrote:
At 21:39 07/11/2005, Shane Kerr wrote:
Is Ops going to reply?
I sent the original poster an offline reply explaining the difference between AS3333 and AS12654.
I assume this is because of the RIPE NCC router upgrade. AFAIK, RIS does not use AS3333.
Rene, in future maybe you should be clear who you expect to handle an issue. "someone" sometimes resolves things, but not always and you can never be sure.
Well, I guess the question is: who is responsible for handling these kind of questions? OPS (its about our network) or RIS (it is about the data)?
In general, I think that since the question is about RIS we would be more than happy to handle it. You can forward these types of things to either ris-request or sw-bugs and we'll follow up on it. OTOH, it is not bad to send it to ops either. External users are not always clear where to send questions, so we need to be flexible in directing issues to the best support desk in any case. -- Shane
Shane,
In general, I think that since the question is about RIS we would be more than happy to handle it. You can forward these types of things to either ris-request or sw-bugs and we'll follow up on it.
Fine, that works for me: we'll just forward the question and leave it up to SED and OPS to figure out who has to reply. Henk
OTOH, it is not bad to send it to ops either. External users are not always clear where to send questions, so we need to be flexible in directing issues to the best support desk in any case.
-- Shane
------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)
participants (3)
-
Henk Uijterwaal -
Rene Wilhelm -
Shane Kerr