RE: as6198 aggregation event

["Terry Baranski" <tbaranski () mail com>]

James Cowie wrote:

> On Friday, we noted with some interest the appearance of more 
> than six hundred deaggregated /24s into the global routing 
> tables.  More unusually, they're still in there this morning.  
>
> AS6198 (BellSouth Miami) seems to have been patiently injecting 
> them over the course of several hours, between about 04:00 GMT 
> and 08:00 GMT on Friday morning (3 Oct 2003).  

If you look at the 09/19 and 09/26 CIDR Reports, BellSouth Atlanta
(AS6197) did something similar during this time period -- they added
about 350 deaggregated prefixes, most if not all /24's.  

> Usually when we see deaggregations, they hit quickly and they
> disappear quickly; nice sharp vertical jumps in the table size.
> This event lasted for hours and, more importantly, the prefixes 
> haven't come back out again, an unusual pattern for a single-origin
> change that effectively expanded global tables by half a percent. 

That AS6197's additions are still present isn't encouraging.

-Terry