http://www.ra.net/~ra/statistics/flap.html is actually
proving to be quite useful. Thanks RA gang.
BTW, highlights from the 24 hours of Dec 31st:
1:AS1849 prefixes=159 flaps=5145
2:AS174 prefixes=54 flaps=3239
3:AS1257 prefixes=180 flaps=2987
4:AS278 prefixes=43 flaps=2984
5:AS114 prefixes=77 flaps=2777
6:AS3250 prefixes=68 flaps=2298
7:AS2018 prefixes=25 flaps=1393
8:AS2697 prefixes=25 flaps=1346
9:AS1324 prefixes=3 flaps=1218
10:AS1267 prefixes=16 flaps=1111
13:AS701 prefixes=22 flaps=912
16:AS2551 prefixes=16 flaps=717
19:AS813 prefixes=4 flaps=471
29:AS3561 prefixes=8 flaps=194
57:AS279 prefixes=3 flaps=79
118:AS86 prefixes=1 flaps=19
This is slightly different from what
sl-mae-e.sprintlink.net sees, but not enough to make big
complaints about, and largely it's because not
everyone peers with the RSes.
What's really appalling to me is that the top 10 origin
ASes -- and in fact, only a tiny handful of prefixes in
these origin ASes -- in the list account for 17 flaps a
minute, or about 1/9th of the entire flap we were seeing
at MAE-EAST alone during the same 24 hours.
In practice, it's really only a fraction of these 650
prefixes that cause this amout of flap.
Please everyone run bgp route dampening as close to the
edges of their networks as much as possible so that
individual prefixes like this one:
SL-MAE-E>sh ip bgp 204.157.1.0
BGP routing table entry for 204.157.1.0 255.255.255.0,version 590853
Paths: (2 available, best #2, advertised over EBGP)
4200 5696, (suppressed due to dampening)
192.41.177.145 from 192.41.177.145 (205.137.59.254)
Origin incomplete, metric 1, localpref 90, valid, external
Dampinfo: penalty 10567, flapped 3175 times in 14:25:55, reuse in 0:57:10
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
don't have this amount of flap propagated throughout
the Internet (except those bits that run bgp dampening at
their edges).
While manual fixes are fine and dandy, it just doesn't
scale if the only practical tool is the occasional
Seanogram to people's NOCs whenever I manually eyeball
a really heavily flapping prefix. BGP dampening is
well tested and well understood, and will eliminate
this particular case of flap, which is to the good of everyone.
Sean.
proving to be quite useful. Thanks RA gang.
BTW, highlights from the 24 hours of Dec 31st:
1:AS1849 prefixes=159 flaps=5145
2:AS174 prefixes=54 flaps=3239
3:AS1257 prefixes=180 flaps=2987
4:AS278 prefixes=43 flaps=2984
5:AS114 prefixes=77 flaps=2777
6:AS3250 prefixes=68 flaps=2298
7:AS2018 prefixes=25 flaps=1393
8:AS2697 prefixes=25 flaps=1346
9:AS1324 prefixes=3 flaps=1218
10:AS1267 prefixes=16 flaps=1111
13:AS701 prefixes=22 flaps=912
16:AS2551 prefixes=16 flaps=717
19:AS813 prefixes=4 flaps=471
29:AS3561 prefixes=8 flaps=194
57:AS279 prefixes=3 flaps=79
118:AS86 prefixes=1 flaps=19
This is slightly different from what
sl-mae-e.sprintlink.net sees, but not enough to make big
complaints about, and largely it's because not
everyone peers with the RSes.
What's really appalling to me is that the top 10 origin
ASes -- and in fact, only a tiny handful of prefixes in
these origin ASes -- in the list account for 17 flaps a
minute, or about 1/9th of the entire flap we were seeing
at MAE-EAST alone during the same 24 hours.
In practice, it's really only a fraction of these 650
prefixes that cause this amout of flap.
Please everyone run bgp route dampening as close to the
edges of their networks as much as possible so that
individual prefixes like this one:
SL-MAE-E>sh ip bgp 204.157.1.0
BGP routing table entry for 204.157.1.0 255.255.255.0,version 590853
Paths: (2 available, best #2, advertised over EBGP)
4200 5696, (suppressed due to dampening)
192.41.177.145 from 192.41.177.145 (205.137.59.254)
Origin incomplete, metric 1, localpref 90, valid, external
Dampinfo: penalty 10567, flapped 3175 times in 14:25:55, reuse in 0:57:10
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
don't have this amount of flap propagated throughout
the Internet (except those bits that run bgp dampening at
their edges).
While manual fixes are fine and dandy, it just doesn't
scale if the only practical tool is the occasional
Seanogram to people's NOCs whenever I manually eyeball
a really heavily flapping prefix. BGP dampening is
well tested and well understood, and will eliminate
this particular case of flap, which is to the good of everyone.
Sean.