- ris-users - mailman.ripe.net

RIS Servers Problem
by Shahin Gharghi 21 Jun '17

21 Jun '17

Dear Colleagues, I'm using RIS RAW data for my BGPMon software. I saw a lot of IPv6 Bogons from some RIS servers like server 15. The problem was those prefixes orginated from our AS and in soem cases from our customers AS that don't have IPv6 peer at all. Yesterday I noticed it is not a IPv6 bogon. It's the hex version of our IPv4 prefix. Check this example out: 4f7f::/19 Time: 2017-06-21 00:16:17 79.127.0.0/19 Time: 2017-06-21 00:16:17 have you noticed this problem? -- Shahin Gharghi

2 1

New RIS Remote Route Collector at NAPAfrica Johannesburg (RRC19)
by Colin Petrie 30 Jun '16

30 Jun '16

Dear colleagues, The RIPE NCC is pleased to announce a new Remote Route Collector (RRC) for the Routing Information Service (RIS). This is our first collector in Africa. RRC19 is now online at NAPAfrica JB in Johannesburg. We would like to thank Teraco and Workonline Communications for their help and support. The data from this new collector is already available via RIPEstat. The raw data will be available in the archives in the near future. Peering with RIS ---------------- If you would like to peer with us, please fill in the form at: http://www.ris.ripe.net/cgi-bin/peerreg.cgi For more information about peering with RIS, please see: https://www.ripe.net/analyse/internet-measurements/routing-information-serv… About RIS ------------- RIS aims to collect and store Border Gateway Protocol (BGP) routing information and make it publicly available for the Internet community. The RIPEstat tools that provide access to this data can help network operators troubleshoot routing problems by providing eBGP data collected over time without being limited to a single BGP view. RIS deploys RRCs at major Internet exchanges, where they peer with other networks. At this time, RIS has more than 650 peers at 21 different Internet exchanges. For more information, please see: https://ripe.net/ris/ If you have any further questions, please contact <ris at ripe.net> Regards, Colin Petrie Systems Engineer RIPE NCC

1 0

Want to more traffic/sale on your site
by K.RANA 11 Dec '15

11 Dec '15

Hi, My name is K.RANA, and I was doing some research on some of your competitors' websites when I came across your www.ripe.net site. I ran an analysis on your site using one of our software and found simple coding & optimization issues that are harming your search rankings pretty bad. Would you be interested in an analysis report and keywords suggestion list with Google 1st page projection? I want is the opportunity to discuss how I could help improve the profitability and search traffic to your site. Let us know your expectations from your website; we can help you to realize it. What time good for you to discuss? Please provide me your contact no and Skype id. Kind Regards, K.RANA - india

1 0

Issues with ASPATH from rib
by Pavel Odintsov 29 Nov '15

29 Nov '15

Hello! I'm trying to build mapping from IP to AS number with bgpdump-1.4.99.15 and my custom toolkit. So I downloaded dump http://archive.routeviews.org/bgpdata/2015.11/RIBS/rib.20151128.0600.bz2 and trying to parse it with bgpdump. For about 90% of full BGP table I'm getting correct values for ASPATH. For example for my ASN 198068 I got: TIME: 11/28/15 06:00:03 TYPE: TABLE_DUMP_V2/IPV4_UNICAST PREFIX: 46.36.223.0/24 SEQUENCE: 55029 FROM: 147.28.7.2 AS3130 ORIGINATED: 11/11/15 18:25:25 ORIGIN: IGP ASPATH: 3130 2914 9002 198068 NEXT_HOP: 147.28.7.2 MULTI_EXIT_DISC: 2 COMMUNITY: 2914:410 2914:1201 2914:2202 2914:3200 3130:380 But some prefixes I'm getting very strange ASPATH with ASN enclosed in curly quotes. For example you could look at: TIME: 11/28/15 06:00:01 TYPE: TABLE_DUMP_V2/IPV4_UNICAST PREFIX: 5.39.176.0/21 SEQUENCE: 5583 FROM: 147.28.7.1 AS3130 ORIGINATED: 11/13/15 08:02:15 ORIGIN: IGP ASPATH: 3130 2914 3356 8530 {198753} NEXT_HOP: 147.28.7.1 AGGREGATOR: AS8530 91.143.64.24 COMMUNITY: 2914:420 2914:1007 2914:2000 2914:3000 3130:380 How I should interpret this record "3130 2914 3356 8530 {198753}"? Who are origin for this prefix 8530 or 198753? After some time of digging to this data I got more strange example: TIME: 11/28/15 06:00:06 TYPE: TABLE_DUMP_V2/IPV4_UNICAST PREFIX: 69.43.64.0/18 SEQUENCE: 108538 FROM: 195.208.112.161 AS3277 ORIGINATED: 11/27/15 13:37:08 ORIGIN: IGP ASPATH: 3277 3267 174 32432 {6939,46887} NEXT_HOP: 195.208.112.161 AGGREGATOR: AS32432 38.88.209.254 COMMUNITY: 3277:3267 3277:65321 3277:65323 3277:65331 So I really haven't any ideas about this ASPATH: 3277 3267 174 32432 {6939,46887}. Could you clarify both cases (with single and multiple AS numbers) with curly quotes? -- Sincerely yours, Pavel Odintsov

2 1

New RIS Remote Route Collectors at CATNIX Barcelona, SwissIX Zurich, France-IX Paris and Marseille
by Colin Petrie 12 Nov '15

12 Nov '15

Dear colleagues, The RIPE NCC is pleased to announce three new Remote Route Collectors (RRCs) for the Routing Information Service (RIS). RRC18 is now online at CATNIX in Barcelona. We would like to thank Maria Isabel Gandia, Manel Pérez, and CSUC for their help. RRC20 is now online at SwissIX in Zurich. We would like to thank Ulf Kieber and SwissIX for their help. RRC21 is now online at France-IX Paris and France-IX Marseille, hosted in Paris. We would like to thank Arnaud Fenioux and FranceIX for their help. The data from these new collectors is already available via RIPEstat. The raw data will be available in the archives in the near future. Peering with RIS ---------------- If you would like to peer with us, please fill in the form at: http://www.ris.ripe.net/cgi-bin/peerreg.cgi For more information about peering with RIS, please see: https://www.ripe.net/analyse/internet-measurements/routing-information-serv… About RIS ------------- RIS aims to collect and store Border Gateway Protocol (BGP) routing information and make it publicly available for the Internet community. The RIPEstat tools that provide access to this data can help network operators troubleshoot routing problems by providing eBGP data collected over time without being limited to a single BGP view. RIS deploys RRCs at major Internet exchanges, where they peer with other networks. At this time, RIS has more than 600 peers at 18 different Internet exchanges. For more information, please see: https://ripe.net/ris/ If you have any further questions, please contact <ris at ripe.net> Regards, Colin Petrie Systems Engineer RIPE NCC

1 0

ZEBRA vs. libBGPdump parser
by Ado Maja 16 Oct '15

16 Oct '15

Dear all, I have noticed that when I use Zebra BGP parser the time stamp in BGP update messages (field TIME:) shows delay of exactly two hours in respect to when using libBGPdump parser. Both outputs are exactly same messages but I get two hours delay with Zebra tool. Which one can I take as correct one? libBGPdump output: TIME: 09/18/01 00:00:35TYPE: BGP4MP/MESSAGE/UpdateFROM: 192.65.185.130 AS559TO: 192.65.185.40 AS12654ORIGIN: IGPASPATH: 559 1836 286 1136 1136NEXT_HOP: 192.65.185.130ANNOUNCE 193.176.136.0/21 TIME: 09/18/01 00:00:37TYPE: BGP4MP/MESSAGE/UpdateFROM: 192.65.184.3 AS513TO: 192.65.185.40 AS12654ORIGIN: IGPASPATH: 513 209 6453 11367NEXT_HOP: 192.65.185.9ANNOUNCE 196.12.176.0/24 and Zebra output: TIME: 2001-9-18 02:00:35TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IPFROM: 192.65.185.130TO: 192.65.185.40BGP PACKET TYPE: UPDATEORIGIN: IGPAS_PATH: 559 1836 286 1136 1136NEXT_HOP: 192.65.185.130ANNOUNCED: 193.176.136.0/21 TIME: 2001-9-18 02:00:37TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IPFROM: 192.65.184.3TO: 192.65.185.40BGP PACKET TYPE: UPDATEORIGIN: IGPAS_PATH: 513 209 6453 11367NEXT_HOP: 192.65.185.9ANNOUNCED: 196.12.176.0/24 Best regards, Ado

2 1

New on RIPE Labs: Updates to the RIPE NCC Routing Information Service
by Colin Petrie 13 Oct '15

13 Oct '15

Dear colleagues, We've made some extensive improvements to the RIPE NCC Routing Information Service (RIS) which is an integral part of RIPEstat and heavily used by researchers and network operators. Please find more details on RIPE Labs: https://labs.ripe.net/Members/colin_petrie/updates-to-the-ripe-ncc-routing-… Kind regards, Colin Petrie RIPE NCC

1 0

Parsing issues with bgpdump (unknown attribute 0)
by Alexis Fasquel 12 Oct '15

12 Oct '15

Hello everyone, I’ve been using BGPDump to collect BGP data across multiple BGP server. Unfortunately, I’ve been having some issues parsing some MRT files. So I have a file (provided in attachment) that has been created by a Quagga instance (quagga-0.99.22.1-2013051601). All the beginning of the file seems to be parsed correctly, but at some point, I get a message with unknown attributes. As you can see on the screenshot below, the strange part about it is that the attribute type is supposedly 0 —which is not a correct attribute type if I’m referring to the RFC. Different versions of bgpdump have been tested, without any changes. And the actual issues come up right after: every announcement after this message seems to have something wrong (wrong prefix length/wrong AS path values…): Does anyone already encountered such troubles? Could it be a bug from BGPDump somewhere? Let me know if you have any idea or want some more detail about the issue. Alexis Fasquel Software Engineer @ PCH <http://www.pch.net/> +1-415-694-0585

2 2

Implicit Withdrawal - BGP Update Message
by Ado Maja 11 Oct '15

11 Oct '15

DearMaurizio and Colin, Thank youfor your responses. It was bymistake that I send an example where BGP messages are not coming from the samepeer. All four messages in the example were supposed to have same peer, andannounced IP address while different AS-PATH attribute. In thatcase I would have three implicit withdrawals, right? Colin, Are yousuggesting that if I look at five-days worth of BGP update messages and tryingto count how many implicit withdrawals during that time I have that I need to checkfirst appearance of every announced IP address and check if it is ‘truly’ newannouncement or possibly an implicit withdrawal that happened prior to the timeframe I am looking at? Also, Iwas completely ignoring the state change messages. Are you referring to the messagesbelow? I am not sure what to make out of those. Bestregards, Ado TIME:2001-9-16 00:00:09 TYPE:BGP4MP/BGP4MP_STATE_CHANGE AFI_IP FROM:192.65.185.151 OLD STATE:3 NEW STATE: 2 TIME:2001-9-16 00:00:09 TYPE:BGP4MP/BGP4MP_STATE_CHANGE AFI_IP FROM:192.65.185.151 OLD STATE:2 NEW STATE: 3

2 1

Implicit Withdrawal - BGP Update Message
by Ado Maja 11 Oct '15

11 Oct '15

Dear all,I am trying to account for all implicit withdrawal messages within a certain period of time looking at BGP update messages collected at rrc, Ripe. Implicit Withdrawal Definition: If the sender announces a route to a currently reachable address and the new route is identical to the current route, this is a duplicate announcement. Otherwise, the sender is replacing the current route with a new route and this is an implicit withdrawal. (Wang et al. in the "Observation and Analysis of BGP iBehavior under Stress") What I am trying to understand is how do I count implicit withdrawals? If for example, I have 4 BGP messages shown below that have same IP address and different AS-PATH attribute, how many implicit withdrawals do I have? Is it 3? If I look at consecutive messages that have same IP address and different AS-PATH attribute the result would be 3 (I compare first to the second, second to the third and third to the fourth – assuming they have same IP address and different AS-PATH I increment implicit withdrawals). But I have come across a solution that takes a first message and compares it to the rest of the messages. Than second message compares to the rest of the messages. And lastly compares the third to the fourth. In this case number of implicit withdrawals is 6. Please advise.Thanks for your help.TIME: 2001-9-16 00:00:06TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IPFROM: 192.65.185.144TO: 192.65.185.40BGP PACKET TYPE: UPDATEORIGIN: IGPAS_PATH: 6893 8938 1 297NEXT_HOP: 192.65.185.144ANNOUNCED: 192.152.102.0/24 TIME: 2001-9-16 00:00:18TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IPFROM: 192.65.184.3TO: 192.65.185.40BGP PACKET TYPE: UPDATEORIGIN: IGPAS_PATH: 513 10764 6509 297NEXT_HOP: 192.65.185.9ANNOUNCED: 192.152.102.0/24 TIME: 2001-9-16 00:00:36TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IPFROM: 192.65.185.144TO: 192.65.185.40BGP PACKET TYPE: UPDATEORIGIN: IGPAS_PATH: 6893 3561 209 297NEXT_HOP: 192.65.185.144ANNOUNCED: 192.152.102.0/24 TIME: 2001-9-16 00:00:44TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IPFROM: 192.65.185.130TO: 192.65.185.40BGP PACKET TYPE: UPDATEORIGIN: IGPAS_PATH: 559 8933 6509 297NEXT_HOP: 192.65.185.130ANNOUNCED: 192.152.102.0/24

3 2