Routing Arbiter Daily Route Flap Reports

[Sean Doran <smd () sprint net>]

http://www.ra.net/~ra/statistics/flap.html is actually
proving to be quite useful.  Thanks RA gang.

BTW, highlights from the 24 hours of Dec 31st:

1:AS1849        prefixes=159    flaps=5145
2:AS174         prefixes=54     flaps=3239
3:AS1257        prefixes=180    flaps=2987
4:AS278         prefixes=43     flaps=2984
5:AS114         prefixes=77     flaps=2777
6:AS3250        prefixes=68     flaps=2298
7:AS2018        prefixes=25     flaps=1393
8:AS2697        prefixes=25     flaps=1346
9:AS1324        prefixes=3      flaps=1218
10:AS1267       prefixes=16     flaps=1111
13:AS701        prefixes=22     flaps=912
16:AS2551       prefixes=16     flaps=717
19:AS813        prefixes=4      flaps=471
29:AS3561       prefixes=8      flaps=194
57:AS279        prefixes=3      flaps=79
118:AS86        prefixes=1      flaps=19

This is slightly different from what
sl-mae-e.sprintlink.net sees, but not enough to make big
complaints about, and largely it's because not
everyone peers with the RSes.

What's really appalling to me is that the top 10 origin
ASes -- and in fact, only a tiny handful of prefixes in
these origin ASes -- in the list account for 17 flaps a
minute, or about 1/9th of the entire flap we were seeing
at MAE-EAST alone during the same 24 hours.

In practice, it's really only a fraction of these 650
prefixes that cause this amout of flap.

Please everyone run bgp route dampening as close to the
edges of their networks as much as possible so that
individual prefixes like this one:

SL-MAE-E>sh ip bgp 204.157.1.0
BGP routing table entry for 204.157.1.0 255.255.255.0,version 590853
Paths: (2 available, best #2, advertised over EBGP)
  4200 5696, (suppressed due to dampening)
    192.41.177.145 from 192.41.177.145 (205.137.59.254)
      Origin incomplete, metric 1, localpref 90, valid, external
      Dampinfo: penalty 10567, flapped 3175 times in 14:25:55, reuse in 0:57:10
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^   

don't have this amount of flap propagated throughout
the Internet (except those bits that run bgp dampening at
their edges).

While manual fixes are fine and dandy, it just doesn't
scale if the only practical tool is the occasional
Seanogram to people's NOCs whenever I manually eyeball
a really heavily flapping prefix.   BGP dampening is
well tested and well understood, and will eliminate
this particular case of flap, which is to the good of everyone.

        Sean.