Frank-
I may have found the answer to your question.
Looking for tips on better ways to do this, but I did this. “show route community $ourCommunityForRoutesWeExport detail | match Age” and did a mix of lame exclusions and visual greps to find a few routes with an age of less than 60 minutes.
specifically
184.164.250.0/24 *[BGP/170] 00:44:15
184.164.251.0/24 *[BGP/170] 00:44:15
184.164.252.0/24 *[BGP/170] 00:44:15
These are part of an anycast R&E project. We receive this over an eBGP peering with the project. It looks like they are setting community 47065:184 if you want to filter.
Frank, how new is your detection software? This is an old project and I would call this normal behavior for them.
-Michael
From: MICE Discuss <[log in to unmask]>
On Behalf Of Michael Hare
Sent: Monday, December 30, 2019 3:59 PM
To: [log in to unmask]
Subject: Re: [MICE-DISCUSS] Route reflector check
Hi everyone-
Wanted to add a bit more detail to what we (AS 3128) checked on our side. Specifically,
1) our peering session(s) to the RS seems stable from an uptime perspective.
2) I don’t see a large delta in outbound bgp messages from us to MICE.
3) we don’t run BMP so I don’t actually track outbound changes at a level that would conclusive prove what’s going on.
Frank, is it possible you are being notified about a single route flapping? I did check AS2381’s looking glass, specifically a single route (143.235.0.0/16) and it looks stable. Admittedly I didn’t look for LG across all MICE members
but I’m not sure if any would allow me to run an as-path regexp to see if there is a specific flapping route that is flapping. If someone can help out on that front it could be useful.
[output from AS2381 looking glass]
[BGP/170] 1w6d 13:08:45, MED 10, localpref 200, from 206.108.255.1
AS path: 3128 3128 3128 3128 I, validation-state: unverified
> to 206.108.255.66 via xe-0/1/5.300
[BGP/170] 3w3d 14:51:19, MED 10, localpref 200, from 206.108.255.2
AS path: 3128 3128 3128 3128 I, validation-state: unverified
> to 206.108.255.66 via xe-0/1/5.300
Thanks-
-Michael
From: MICE Discuss <[log in to unmask]>
On Behalf Of Frank Bulk
Sent: Monday, December 30, 2019 3:37 PM
To: [log in to unmask]
Subject: [MICE-DISCUSS] Route reflector check
QRator has been alerting me that AS 3128 is coming and going. It just happened again and wondering if anyone else is seeing this behavior and also how things look on MICE’s route reflectors.
I already contacted the good folks at the University of Wisconsin and they’re not seeing anything on their side.
|
AS Number: |
AS3128 |
|
AS Name: |
|
# |
First seen |
Last seen |
|
1 |
2019-12-29 21:49:00 |
2019-12-29 21:50:00 |
|
2 |
2019-12-29 18:42:00 |
2019-12-29 18:43:00 |
|
3 |
2019-12-29 17:57:00 |
2019-12-29 17:58:00 |
|
4 |
2019-12-29 16:27:00 |
2019-12-29 16:28:00 |
|
5 |
2019-12-29 14:12:00 |
2019-12-29 14:13:00 |
|
6 |
2019-12-29 13:27:00 |
2019-12-29 13:28:00 |
|
7 |
2019-12-29 12:42:00 |
2019-12-29 12:43:00 |
|
8 |
2019-12-29 11:57:00 |
2019-12-29 11:58:00 |
|
9 |
2019-12-29 11:12:00 |
2019-12-29 11:13:00 |
|
10 |
2019-12-29 11:04:00 |
2019-12-29 11:05:00 |
|
11 |
2019-12-29 10:27:00 |
2019-12-29 10:28:00 |
|
12 |
2019-12-29 08:57:00 |
2019-12-29 08:58:00 |
|
13 |
2019-12-29 08:12:00 |
2019-12-29 08:13:00 |
|
14 |
2019-12-29 07:53:00 |
2019-12-29 07:54:00 |
|
15 |
2019-12-29 07:27:00 |
2019-12-29 07:28:00 |
|
16 |
2019-12-29 06:42:00 |
2019-12-29 06:43:00 |
|
17 |
2019-12-29 05:57:00 |
2019-12-29 05:58:00 |
|
18 |
2019-12-29 05:12:00 |
2019-12-29 05:13:00 |
|
19 |
2019-12-29 04:40:00 |
2019-12-29 04:41:00 |
|
20 |
2019-12-29 04:27:00 |
2019-12-29 04:28:00 |
|
21 |
2019-12-29 00:05:00 |
2019-12-29 00:06:00 |
|
22 |
2019-12-28 23:57:00 |
2019-12-28 23:58:00 |
|
23 |
2019-12-28 23:12:00 |
2019-12-28 23:13:00 |
|
24 |
2019-12-28 23:04:00 |
2019-12-28 23:05:00 |
|
25 |
2019-12-28 22:27:00 |
2019-12-28 22:28:00 |
|
26 |
2019-12-28 21:42:00 |
2019-12-28 21:43:00 |
|
27 |
2019-12-28 20:57:00 |
2019-12-28 20:58:00 |
|
28 |
2019-12-28 20:12:00 |
2019-12-28 20:13:00 |
|
29 |
2019-12-28 07:27:00 |
2019-12-28 07:28:00 |
|
30 |
2019-12-28 06:42:00 |
2019-12-28 06:43:00 |
|
31 |
2019-12-28 05:57:00 |
2019-12-28 05:58:00 |
|
32 |
2019-12-28 05:12:00 |
2019-12-28 05:13:00 |
|
33 |
2019-12-27 17:21:00 |
2019-12-27 17:22:00 |
|
34 |
2019-12-06 07:01:00 |
2019-12-27 06:10:00 |
Frank
To unsubscribe from the MICE-DISCUSS list, click the following link:
http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1
To unsubscribe from the MICE-DISCUSS list, click the following link:
http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1