A Day in the Life: The Global BGP Table(articles.foletta.org) |
A Day in the Life: The Global BGP Table(articles.foletta.org) |
Avi
Like the human body the more you study the Internet the more amazing it is not that it sometimes breaks, but that it works at all. Especially for video/phone/etc.
Glad the content was helpful, I have links to some of them at avi.net (tutorials and old Boardwatch articles).
I swear my motive was pure (frustration with the content out there) but it was easy to see back then that helping people out with good content yields rewards ("Can I buy a T1?") or ("Come run my big global network"). So I still encourage everyone to write about what's confusing and frustrating...
Somewhat off-topic, I’ve noticed on HN that sometimes comments end with single word on a newline, like you have done here.
Did your comment get truncated somehow, or did you mess up a copy/paste, or what?
Has anyone else noticed this? Is this a telltale sign of generated comments, or other tool usage?
I’ve only noticed this on HN, and maybe Reddit once? It happens somewhat more regularly than I can attribute to mere coincidence or accident.
That flapping from EpicUp 140.99.244.0/23 prefix should have been subject to route dampening. This is per peer or per prefix rate limiting typically enforced on all peers by ISPs to prevent this exact issue of a single prefix making up a significant portion of the global BGP churn.
I’m unconvinced of the correlation between the updates that the author attributed to knock on effects. It would be pretty janky to have your advertisements be based on the path to other autonomous systems’ prefixes, especially unstable ones.
I don’t think there is a 40 minute periodicity either (at least there wasn’t 8 years ago when I was deep in the BGP world). Smells like what this dataset happened to show either by luck or because of the network the author was getting the BGP feed from.
If you dig into the data and look at which AS’s and prefixes are experiencing changes, you’ll find it’s all over the place and there isn’t really any bigger pattern.
On any given day there are usually a few noisy ISPs because of bad circuits or misconfigurations. Then there are new prefixes flapping in and out as a new thing is brought online for the first time, etc. Then sprinkle in path changes for regular draining maintenance, etc.
It’s simultaneously both fascinating and a little horrifying how a little ISP in Kansas experiencing a fiber consuming backhoe shows up on routers in Perth. Yet the frequency of updates is kept to <10hz globally through tons of hand tuned policies.
Most setups were horribly misconfigured and (most) routers are no longer extremely CPU starved as they once were, That doesn't mean that it does not still exist of course, when I did bgp battleships ( https://blog.benjojo.co.uk/post/bgp-battleships ) I found that 3356 (at the time) was doing route dampening, so play had to be paused for a while.
I’d definitely be interested to read some follow-ups, diving into more details.
does this imply the internet has something akin to tides ?
AS15626 GREEN FLOID LLC (russian propaganda) AS34224 Neterra Ltd. (bullet proof) AS44477 STARK INDUSTRIES SOLUTIONS LTD (bullet proof) AS207656 Epinatura LLC (bullet proof)
Depending on the RA interval alone is negligence and if you encountered a small ISP that isn’t dampening your updates directly, their peering session is at risk with any of the major transit providers.
Route dampening guardrails were super common 7 years ago and there isn’t any technological development that fixes what they did so I highly doubt they fell out of favor.
That wouldn’t land in the dampening levels that were normally configured that encountered with all of the transit providers.