Re: The BGP Visibility Scanner

[Jason Hellenthal <jhellenthal () dataix net>]

Awesome! Thank you to you as well!

-- 
 Jason Hellenthal
 IS&T Services Professional
 Inbox: jhellenthal () DataIX net
 JJH48-ARIN


On May 15, 2013, at 11:01, Rene Wilhelm <wilhelm () ripe net> wrote:

> On 5/15/13 3:00 PM, Jason Hellenthal wrote:
> > Pretty nice. Thanks!
> >
> > I don't suppose there is any straight text version of all this info is there ?
> At the RIPE NCC we are publishing aggregated dumps from our collective of 12 RIS route collectors every 8 hours. For 
> each prefix we list the origin AS and the number of peers (on all collectors) which observe the prefix. If you are 
> happy to do your own post-processing,  set your own boundaries on what to consider limited visibility prefixes, have 
> a look at the IPv4 and IPv6 table dumps at http://www.ris.ripe.net/dumps/
>
> Note that the fact that not all RIS peers give us a full BGP table blurs the counts somewhat. Prefixes which are 
> globally visible may (today) have anywhere between 96 and 110 peers announcing the prefix to the RIS route collectors.
>
> -- Rene
> > -- Jason Hellenthal IS&T Services Professional Inbox: jhellenthal () DataIX net JJH48-ARIN On May 15, 2013, at 6:22, 
> > Andra Lutu <andra.lutu () imdea org> wrote:
> > > > Dear all,
> > > >
> > > > We have built a tool that checks the visibility of IPv4 prefixes at the interdomain level.
> > > > The tool is available at *http://visibility.it.uc3m.es/*  and you can use it to retrieve the Limited Visibility 
> > > > Prefixes (LVPs) (i.e., prefixes that are not present in all the global routing tables we analyse) injected by a 
> > > > certain originating AS.
> > > > The query is very simple, it just requires to input the AS number for which you want to retrieve the originated 
> > > > LVPs, if any.
> > > > After checking the limited-visibility prefixes, we would appreciate any feedback that you can provide on the cause 
> > > > of the limited visibility (we provide a form with a few very short questions which you could fill in and submit).
> > > >
> > > > Using a dataset from May 2nd 2013, we generated a list with the ASes which are originating 
> > > > LVPs:*http://visibility.it.uc3m.es/fullASlist.html*
> > > > We would like to hear from any operator who might find this project interesting, and, in particular, from these 
> > > > large contributors to the LVPs set.
> > > > Please note that advertising prefixes with limited visibility does not mean that the originating AS is necessarily 
> > > > doing something wrong.
> > > > The ASes might be generating the LVPs knowingly (e.g., scoped advertisements). However, there might be cases where 
> > > > the origin AS might be unaware that some prefixes are not globally visible (when they should) or that others are 
> > > > leaking as a consequence of mis-configurations/slips.
> > > >
> > > > Our purpose is to spread awareness about these latter phenomena, help eliminate the cause of unintended/accidental 
> > > > LVPs and upgrade this tool to an anomaly detection mechanism.
> > > > For more information on the definition and characteristics of a Limited Visibility prefix, please check the 
> > > > Frequently Asked Questions section of the webpage, available 
> > > > here:*http://visibility.it.uc3m.es/Q_and_A_latest.html*
> > > >
> > > > The tool works with publicly available BGP routing data, retrieved from the RIPE NCC RIS and RouteViews Projects. 
> > > > The results are updated on a daily basis.
> > > > For more information on the methodology we refer you to the slides of the NANOG57 presentation about the BGP 
> > > > Visibility Scanner:
> > > > http://www.nanog.org/meetings/nanog57/presentations/Wednesday/wed.general.Lutu.BGP_visibility_scanner.19.pdf
> > > > Also, you can check the RIPE labs article about the BGP Visibility Scanner, available 
> > > > here:https://labs.ripe.net/Members/andra_lutu/the-bgp-visibility-scanner
> > > >
> > > > We are looking forward to your feedback!
> > > >
> > > > Thank you, best regards,
> > > > Andra