Re: Bell Canada outage?

[Jared Mauch <jared () puck nether net>]

On Aug 8, 2012, at 3:50 PM, Andree Toonk wrote:

> Hi,
>
> .-- My secret spy satellite informs me that at 12-08-08 11:35 AM  Darius
> Jahandarie wrote:
> > On Wed, Aug 8, 2012 at 2:31 PM, Zachary McGibbon
> > <zachary.mcgibbon+nanog () gmail com> wrote:
> > > Anyone at Bell Canada / Sympatico can tell us what's going on?  Our routing
> > > table is going nuts with Bell advertising a lot of routes they shouldn't be
> >
> > Bell leaked a full table. To add to the fun, it seems that TATA took
> > the full table and releaked it.
>
> A quick analysis leads met to believe AS46618 ( Dery Telecom Inc) is the
> cause of this. AS46618 is dual homed to VIDEOTRON and Bell. What seems
> to have happened is that they leaked routes learned from VIDEOTRON to Bell.
>
> Based on BGP data I see that at 17:27 UTC  AS46618 ( Dery Telecom Inc)
> started to leak a 'full table', or at least a significant chunk of it to
> its provider Bell AS577.
> Bell propagated that to it's peers. Tata was one of the ones that
> accepted all of that.
>
> I can see that Bell propagated at least 74,109 prefixes learned from
> AS46618 to Tata. Tata selected 70,160 of those routes.


Taking a cursory look at the data processed by my now (very old) leak
auditing tool, this should give you an idea of the size of the impact...


bgp=# select count(*) from leakinfo where aprox_time::date='2012-08-08';
 count 
-------
 21212
bgp=# select count(*) from leakinfo where aprox_time::date='2012-08-07';
 count 
-------
  3681
bgp=# select count(*) from leakinfo where aprox_time::date='2012-08-06';
 count 
-------
  2428

You can see details of this at the leak info page here:

http://puck.nether.net/bgp/leakinfo.cgi

- Jared