RE: Facebook post-mortems...

[Jean St-Laurent via NANOG <nanog () nanog org>]

Does anyone have info whether this network 69.171.240.0/20 was reachable during the outage.

 

Jean

 

From: NANOG <nanog-bounces+jean=ddostest.me () nanog org> On Behalf Of Tom Beecher
Sent: October 5, 2021 10:30 AM
To: NANOG <nanog () nanog org>
Subject: Re: Facebook post-mortems...

 

People keep repeating this but I don't think it's true.

 

My comment is solely sourced on my direct observations on my network, maybe 30-45 minutes in. 

 

Everything except a few /24s disappeared from DFZ providers, but I still heard those prefixes from direct peerings. 
There was no disaggregation that I saw, just the big stuff gone. This was consistent over 5 continents from my 
viewpoints.

 

Others may have seen different things at different times. I do not run an eyeball so I had no need to continually 
monitor.  

 

On Tue, Oct 5, 2021 at 10:22 AM Niels Bakker <niels=nanog () bakker net <mailto:nanog () bakker net> > wrote:

* telescope40 () gmail com <mailto:telescope40 () gmail com>  (Lou D) [Tue 05 Oct 2021, 15:12 CEST]:
> Facebook stopped announcing the vast majority of their IP space to 
> the DFZ during this.

People keep repeating this but I don't think it's true.

It's probably based on this tweet: 
https://twitter.com/ryan505/status/1445118376339140618

but that's an aggregate adding up prefix counts from many sessions. 
The total number of hosts covered by those announcements didn't vary 
by nearly as much, since to a significant extent it were more specifics 
(/24) of larger prefixes (e.g. /17) that disappeared, while those /17s 
stayed.

(There were no covering prefixes for WhatsApp's NS addresses so those 
were completely unreachable from the DFZ.)


        -- Niels.