Re: Larger and larger invalid BGP updates starting at 4:25 AM ET

[Christopher Morrow via NANOG <nanog () lists nanog org>]

On Mon, Sep 14, 2026 at 11:57 AM Bryton Herdes via NANOG
<nanog () lists nanog org> wrote:
> Could you elaborate a little more on what the "invalid" updates are that
> you're seeing?

Adding more data from Drew would be handy, but... RV's archive says:

 Bytes   Date         filename
 1090608 Sep 14 03:30 updates.20260914.0715.bz2
 1158653 Sep 14 03:45 updates.20260914.0730.bz2
 1418127 Sep 14 04:00 updates.20260914.0745.bz2
 1364405 Sep 14 04:15 updates.20260914.0800.bz2
 1253632 Sep 14 04:30 updates.20260914.0815.bz2
 1643384 Sep 14 04:45 updates.20260914.0830.bz2
 1230451 Sep 14 05:00 updates.20260914.0845.bz2
 2864012 Sep 14 05:15 updates.20260914.0900.bz2
 2946458 Sep 14 05:30 updates.20260914.0915.bz2
 1134150 Sep 14 05:44 updates.20260914.0930.bz2
 1062511 Sep 14 06:00 updates.20260914.0945.bz2
 1171551 Sep 14 06:15 updates.20260914.1000.bz2
 3794313 Sep 14 06:30 updates.20260914.1015.bz2
 1476709 Sep 14 06:45 updates.20260914.1030.bz2
 2026845 Sep 14 07:00 updates.20260914.1045.bz2
 1225161 Sep 14 07:15 updates.20260914.1100.bz2
 1705264 Sep 14 07:29 updates.20260914.1115.bz2
 3248787 Sep 14 07:45 updates.20260914.1130.bz2
 2267389 Sep 14 08:00 updates.20260914.1145.bz2
 3948724 Sep 14 08:15 updates.20260914.1200.bz2
 1221499 Sep 14 08:30 updates.20260914.1215.bz2
 4237352 Sep 14 08:45 updates.20260914.1230.bz2
 4292869 Sep 14 09:00 updates.20260914.1245.bz2
 1234557 Sep 14 09:15 updates.20260914.1300.bz2
 1394623 Sep 14 09:30 updates.20260914.1315.bz2
 1239241 Sep 14 09:45 updates.20260914.1330.bz2
 1198730 Sep 14 10:00 updates.20260914.1345.bz2
 1352655 Sep 14 10:15 updates.20260914.1400.bz2
 1365174 Sep 14 10:30 updates.20260914.1415.bz2
 3617869 Sep 14 10:45 updates.20260914.1430.bz2
 3219326 Sep 14 11:00 updates.20260914.1445.bz2
 4269638 Sep 14 11:15 updates.20260914.1500.bz2
 1485468 Sep 14 11:30 updates.20260914.1515.bz2
 4276591 Sep 14 11:45 updates.20260914.1530.bz2
 3682236 Sep 14 12:00 updates.20260914.1545.bz2

(err, 0425ET ~0825UTC? timzones and I do not agree about much)
it LOOKS like prior to the 0425 ET timeperiod mostly we caught 1mb of
update data in each 15 min window.
After 0845 there's a ~doubling in content, with sometimes 4x content.

Using a nifty tool (https://github.com/morrowc/mrtparser in c++ and
rust! <shameless plug>) to look at that mrt data a bit...
you probably want to look at: 202.171.8.0/24

analysis says that this has an ever-growing AS_PATH attribute :( it
looks like the prefix is being passed
between 2 ASN in a loop, neither is loop-preventing the announcement ;(

There's also POSSIBLY an AWS de-aggregation event at about 2026-09-14
08:31:27 UTC....
but the 202 prefix seems like your most likely candidate for the problem child.

I look forward to someone else's bgp analysis :)

-chris
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/ALVJBT2NQOACLP4RT7URNWH6E2ABRTK5/