Re: So am I just excitable?

[Tom Beecher via NANOG <nanog () lists nanog org>]

> At least a few people on this thread are more used to examining and
> analyzing this point than I am; but, if I'm not mistaken, at least some of
> that de-aggregation in Route Views, RIS, or other route-collectors may
> result from networks giving feeds to the collectors that are either
> internal iBGP feeds or otherwise don't represent what they typically send
> to "the outside world".


Yes. This happens all the time. Sometimes maliciously , sometimes not.

A particular ASN used to send me some /24s that they didn't send to the DFZ
or anyone else for a specific business case. They also didn't announce a
covering aggregate for that either. At the time , we were sending our IBGP
view to a route-collector. At some point that ASN (rightly) started to
announce the covering aggregate to the DFZ, and started calling me because
whoever they were using for hijack monitoring started complaining I was
hijacking these /24s.


On Sun, Aug 31, 2025 at 11:27 AM Tony Tauber via NANOG <
nanog () lists nanog org> wrote:

> On the point of:
> > lots of disaggregation on Route Views that isn't present in our RIB
>
> At least a few people on this thread are more used to examining and
> analyzing this point than I am; but, if I'm not mistaken, at least some of
> that de-aggregation in Route Views, RIS, or other route-collectors may
> result from networks giving feeds to the collectors that are either
> internal iBGP feeds or otherwise don't represent what they typically send
> to "the outside world".
>
> Not only is it unlikely that one may ever see convergence to just one type
> of feed to collectors from all the participants, but even if one did, it's
> not straightforward whether the view that "a customer" or a non-transit
> partner might receive is preferable.
>
> See some research about "Global BGP Attacks That Evade Route Monitoring
> <https://ripe89.ripe.net/archives/video/1540/>" from 2024, for instance.
>
> Cheers,
> Tony
>
> On Sat, Aug 30, 2025 at 3:03 AM Philip Smith via NANOG <
> nanog () lists nanog org> wrote:
>
> > Brian Knight via NANOG wrote on 30/8/2025 10:00:
> > > I see the cause of the discrepancy now. Bumped up our RIB against Route
> > > Views, and I see lots of disaggregation on Route Views that isn't
> > > present in our RIB. Had no idea we were being shielded from *that*
> > > many /24's.
> >
> > Oh and if you take a general wander around all the collectors in various
> > parts of the world, and compare the full views we get there versus what
> > you see. Or what I see in my weekly Routing Table Report I send here
> > (and a few NOG lists), which is pretty much what the RouteViews
> > collector hosted for us by the WIDE project at DIXIE gets to see (my
> > Routing Table Report view is courtesy of APNIC's peering there).
> > > Many apologies for the Friday night stupidity :(
> >
> > As others have said, this global routing table is a most fascinating
> > thing, everywhere you look at it. :-)
> >
> > philip
> > -->
> > > -Brian
> > >
> > >
> > > On 2025-08-29 16:49, Brian Knight via NANOG wrote:
> > > > On 2025-08-29 15:15, Tom Beecher via NANOG wrote:
> > > > > Geoff's data at Potaroo had the FIB clearing 1M back in Febuary if
> > > > > memory
> > > > > serves. So this already happened months ago.
> > > >
> > > > I'm confused by that.
> > > >
> > > > I show 990450 prefixes in my FIB, 990478 in RIB.
> > > >
> > > > Potaroo shows 1022758 prefixes in FIB for today.
> > > >
> > > > Why would there be a discrepancy of over 32k prefixes?
> > > >
> > > > We're blocking exactly 0 prefixes from our three upstreams.
> > > >
> > > > I would understand a hand-waving explanation of "this is the Internet,
> > > > it's always being updated, and everyone has a different view of it" if
> > > > the discrepancy were 10^2 or even 10^3. But over 10^5? That's a bit
> > > > like the three top ASNs for route count just disappeared from the
> > > > Internet.
> > > >
> > > > -Brian
> _______________________________________________
> NANOG mailing list
>
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/SRSNDFOZXUFDZY5K6TFHNYGAYBLJ3OEL/
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/ABES5S47HE5VKAYJFGZDK66ENQNSRPXU/