Re: Noisy prefixes in BGP

[Geoff Huston <gih902 () gmail com>]

Hi Romain

> We are seeing in RIS data a constant flow of update messages from a few ASes, here is the list of the top prefixes:
>
> ┌─────────────────────┬────────────┬──────────────┐
> │       prefix        │ origin_asn │ num_announce │
> │       varchar       │  varchar   │    int64     │
> ├─────────────────────┼────────────┼──────────────┤
> │ 169.145.140.0/23    │ 6979       │       843376 │
> │ 2a03:eec0:3212::/48 │ 22616      │       435608 │
> │ 172.224.198.0/24    │ 36183      │       380117 │
> │ 172.226.208.0/24    │ 36183      │       374040 │
> │ 172.226.148.0/24    │ 36183      │       367083 │


You might also want to check out these two update reports:

    https://www.potaroo.net/bgpupds/reports/bgpupd.html

and

    https://www.potaroo.net/bgpupds/reports/v6-bgpupd.html

These reports have been going on for a couple of decades now. It operates over a rolling 14 day window.

Over the last 14 days in IPv4 the noisiest 50 prefixes generate 5% of the total update load, The 50 noisiest Origin 
AS's generate 24% of the total 14-day BGP update load

The same has been going on in IPv6. The 50 noisiest prefixes (and a whole bunch of them originate in Akamai) generate a 
whopping 34% of the total IPv6 update load, and the noisiest 50 Origin AS's generate an even more impressive 74% of the 
total IpPv6 update load. Akamai's AS 36813 generated 27% of total IPv6 update load over the past 14 days.

(There are 40,300 30 second MRAI intervals in a 14 day period so when a prefix is being updated 33,000 times in 145 
days its basically being updated as fast as many BGP implementations will let you!)


Geoff