Re: 6453 routing leaks (January and Today)

[Jared Mauch <jared () puck nether net>]

On Feb 24, 2011, at 7:50 PM, Kevin Oberman wrote:

> Can't say if it was a leak or de aggregation, but TATA announcements to
> us jumped from about 70,000 to almost 190,000 for a while today, then
> dropped back down.

It very much appears to be a leak based on the route-views MRT format updates.  There's not a good reason for this 
observed prefix/path combination:

41.194.32.0/24   |  3549 6453 3356 22351 36939

I don't believe 3549 nor 3356 are buying transit from 6453 to reach each other.

One of the interesting measurements I track (people accuse me of pcaping all bgp updates, which is sorta true with this 
MRT archive) is the average file sizes of the route-views archive:

http://archive.routeviews.org/bgpdata/2011.02/UPDATES/

This is a good measure of how stable/unstable the network is.  You can typically see when a network has performed some 
grooming or an event like this just by getting a feel for the file sizes.  When they go from ~300KiB on average to 
something in the multiple megs, you know something happened.

- Jared