Archived Reports
ConEd - January 2006
On Jan 22 2006, ConEd announces large number of prefixes that belong to other people, More details and analysis on Todd's blog.
In order to examine the impact of this event we ran a raw data analysis query for 166.84.0.0/16 for the various routeview peers. This would tell us what the impact of this event was on reachability to this prefix from the 5 peers in our data. The query type was selected to be "Prefix-Exact", the time range for our query was slected to be from Jan 16th - Jan 23rd. The second report was generated by running a query for AS 27506 from Jan 16th - Jan 23rd. The resulting data can be found here:
ConEd Incident - 166.84/16 prefixConEd Incident - AS 27506 activity(large file)
Just glancing at the raw data in the above file we see that different networks seem to have been affected differently, for example, some networks see this anomaly as early as 8:30AM, whereas some(Level 3) did not see this till 4PM. For most it seems to have persisted till 6:14PM except for Level 3 where it only lasted till 4PM.
Level 3 - Cogent de-peering - October 2005
On Oct 5th 2005, Level 3 and Cogent stopped peering directly with each other.
In order to examine the impact of this event we ran a raw data analysis query for 38.0.0.0/8(cogent) for the various routeview peers. This would tell us what the impact of this event was on reachability to this prefix from the 5 peers in our data. The query type was selected to be "Prefix-Exact", The time range for our query was slected to be from Sept 10th - Oct 6th. The resulting data can be found here:
ATT-38/8LEVEL3-38/8
AOL-38/8
SPRINT-38/8
GLX-38/8
Based on this data we can see that from the perspective of these top 5 providers there was relatively little impact on the reachability of 38/8(cogent) from all of the providers other than Level 3 which shows 38/8 being withdrawn at 4:49AM on Oct 5thi 2005.
12.0.0.0/8 Prefix Anomaly - September 2005
On September 9th 2005, a problem was reported on the NANOG mailing list regarding the 12/8 prefix.
In order to extract relevant information for this event we ran a raw data analysis query for this prefix(12.0.0.0/8) from Aug 25 - September 14, 2005. The query type was selected to be "Prefix-Exact". The resulting data can be found here:
SPRINT-12/8GLX-12/8
Based on the above data we can see that for the perspective of these 2 routeviews peers(sprint,glx), it appears that AS26210 (AES Communications Bolivia S.A.) started announcing 12/8 on September 9th in addition to AS7018 (ATTW AT&T WorldNet Services). The data for the other 3 peers, ATT, LEVEL3, AOL shows that they did not receive this advertisement.
74/8, 75/8, and 76/8 New Announcements - August-September 2005
On September 20th 2005, ARIN announced that it would begin allocating addresses from the 74/8 and 75/8 and 76/8 prefix blocks.
In order to extract information for this event, we ran a raw data analysis query from Aug 23 till Sep 22. The query-type was selected to be the "Prefix-more-exact". This would return us all matches for the 74/8, 75/8, 76/8 or any prefixes more specific than those /8s. he results can be found here:
ATT-74/8Level3-74/8
AOL-74/8
Sprint-74/8
GLX-74/8
ATT-75/8
Level3-75/8
AOL-75/8
Sprint-75/8
GLX-75/8
Based on the above data, we can see that both these prefixes were being (probably incorrectly) announced by AS9802 (CHINA-21VIANET 21vianet(China) Inc.) prior to Aug 30, at which time they withdrawn and re-announced by AS36666 (Team Cymru testing?). Depending on the routeview peer we look at these prefixes show up around Aug 24-Aug 30 for the set of 5 viewpoints that are represented in bgpinspect(att,level3,aol,sprint,glx).