Re: [nanog] Noisy prefixes in BGP

[Romain Fontugne via NANOG <nanog () nanog org>]

Thanks Aaron!

Romain


________________________________
From: Block, Aaron
Sent: Monday, February 10, 2025 03:58
To: [IIJ] Fontugne Romain
Cc: Geoff Huston; NANOG
Subject: Re: [nanog] Noisy prefixes in BGP

Hello,
        We are looking into this issue.

Thank you,

Aaron Block




---
Aaron Block                                   Akamai Technologies
ablock () akamai com   GPG KeyID: 0xD098B69F   Senior Principal Network Engineer
Voice: +1-617-444-2892                        as20940

> On Feb 9, 2025, at 1:56 AM, Romain Fontugne via NANOG <nanog () nanog org> wrote:
>
> Hi Geoff,
>
> > The same has been going on in IPv6. The 50 noisiest prefixes (and a whole bunch of them originate in Akamai) 
> > generate a whopping 34% of the total IPv6 update load, and the
> > noisiest 50 Origin AS's generate an even more impressive 74% of the total IpPv6 update load. Akamai's AS 36813 
> > generated 27% of total IPv6 update load over the past 14 days.
>
> Thanks that confirms what we see. If there is someone here from AS36183 I guess it is something worth looking at.
>
> Romain
>
> ________________________________________
> From: Geoff Huston <gih902 () gmail com>
> Sent: Sunday, February 9, 2025 14:41
> To: [IIJ] Fontugne Romain
> Cc: NANOG
> Subject: Re: Noisy prefixes in BGP
>
> Hi Romain
>
>
> We are seeing in RIS data a constant flow of update messages from a few ASes, here is the list of the top prefixes:
>
> ┌─────────────────────┬────────────┬──────────────┐
> │       prefix        │ origin_asn │ num_announce │
> │       varchar       │  varchar   │    int64     │
> ├─────────────────────┼────────────┼──────────────┤
> │ 169.145.140.0/23    │ 6979       │       843376 │
> │ 2a03:eec0:3212::/48 │ 22616      │       435608 │
> │ 172.224.198.0/24    │ 36183      │       380117 │
> │ 172.226.208.0/24    │ 36183      │       374040 │
> │ 172.226.148.0/24    │ 36183      │       367083 │
>
> You might also want to check out these two update reports:
>
>    
> https://urldefense.com/v3/__https://www.potaroo.net/bgpupds/reports/bgpupd.html__;!!GjvTz_vk!SD6KJxNhU4aKiWpcXriRDtauGeg5dxFRdkfMVwBPbE88V6WbzJIGdnpOXaK6Aashuw4KDnAHuQ$
>
> and
>
>    
> https://urldefense.com/v3/__https://www.potaroo.net/bgpupds/reports/v6-bgpupd.html__;!!GjvTz_vk!SD6KJxNhU4aKiWpcXriRDtauGeg5dxFRdkfMVwBPbE88V6WbzJIGdnpOXaK6Aashuw4TrhLPtg$
>
> These reports have been going on for a couple of decades now. It operates over a rolling 14 day window.
>
> Over the last 14 days in IPv4 the noisiest 50 prefixes generate 5% of the total update load, The 50 noisiest Origin 
> AS's generate 24% of the total 14-day BGP update load
>
> The same has been going on in IPv6. The 50 noisiest prefixes (and a whole bunch of them originate in Akamai) generate 
> a whopping 34% of the total IPv6 update load, and the noisiest 50 Origin AS's generate an even more impressive 74% of 
> the total IpPv6 update load. Akamai's AS 36813 generated 27% of total IPv6 update load over the past 14 days.
>
> (There are 40,300 30 second MRAI intervals in a 14 day period so when a prefix is being updated 33,000 times in 145 
> days its basically being updated as fast as many BGP implementations will let you!)
>
>
> Geoff