1. 512K: Primeros impactos Doug Madory Director of Internet Analysis, Dyn Research LACNOG 14, Santiago, Chile 28 October 2014

2. Pg. 2 Hace nueve años…

3. Pg. 3 Up And To The Right: IPv4 Routing Table Sizes 2009 2010 2011 2012 2013 2014… 512K

4. Pg. 4 Up And To The Right: IPv4 Routing Table Sizes 2009 2010 2011 2012 2013 2014… 512K 269K +30K 302K +33K 334K +32K 382K +48K 431K +48K 471K +40K

5. Pg. 5 Up And To The Right: IPv4 Routing Table Sizes 2009 2010 2011 2012 2013 2014… 512K 269K +30K 302K +33K 334K +32K 382K +48K 431K +48K 471K +40K 519K? +48K? 2015?

6. Pg. 6 “512K day” …. November 2014 (predicted) Let’s Take a Closer Look Up And To The Right: IPv4 Routing Table Sizes 2009 2010 2011 2012 2013 2014…

7. Pg. 7 “Consensus” is Broadening 2013 2014 Consensus estimate: 507K (Oct 6 th 2014) 61% of our peers believe it’s higher than consensus 23% believe it’s higher than 512K already 512K Today: 507K

8. Pg. 8 2013 2014 512K Today: 507K Invisible at 1hr resolution. This was a “normal intraday fluctuation” …Except that we’re so close to 512K. Global table pushed across the line…. “512K Day” Panic: 12 August 2014 (7:49:30 UTC)

9. Pg. 9 One-second BGP announce/withdraw rates (logscale) 06h00-09h00 UTC 12 August 2014 Advertisement rate peaks first Withdrawal rate briefly rivals advertisement rate

10. Pg. 10 Affected prefixes may represent equipment suffering from TCAM exhaustion Consensus routing table size was roughly 500,000 that morning VZ (AS701) deaggregated almost 30,000 /24s at 7:48:38 UTC Consensus routing table size hits 528,000 for 10 minutes 528K > 512K; All hell breaks loose De-aggregates withdrawn, table reverts to safely less than 512K

11. Pg. 11 One-second BGP withdrawal rates, logscale Most of the withdrawals in the hour are AS701 deaggregates… But 24,280 other prefixes are affected as well. Rate climbs 60x in 10m

12. Pg. 12 Affected Prefixes, By Country It’s not your circulatory system 2479 4494 1014 571 492 389 1084 860 727 398 595 Relatively significant impacts in Iran, Thailand, Indonesia, Argentina, Russia

13. Pg. 13 512k/Leak Impacts as seen in traceroutes

14. Pg. 14 Affected routers in critical places Russian provider Vimpelcom’s AS21332 suffers some significant impairment during the event, as seen through the lens of traceroute completion failure.

15. Pg. 15 Affected routers in China IP: 101.4.116.198 IP: 219.158.96.225

16. Pg. 16 Affected routers in Pacnet IP: 61.14.157.206 IP: 61.14.158.5

17. Pg. 17 How routing table bloat is there in LATAM? Combined Internet of LATAM approximately 70k prefixes (14% of GRT) If an AS announces more-specifics of a prefix in an identical fashion (same upstreams, peers, etc), then we’ll call those more-specific routes “bloat” Top five countries with bloated routes by percentage of total: BR: 9.5%, AR: 9.1%, PE: 6.3%, EC: 5.0%, CL: 3.9% MX and CO at 0.7% and 1.2% bloat

18. Pg. 18 Chile – Route Growth (3,294 prefixes, 3.9% bloat) Worst CL offender: VTR Banda Ancha AS22047 (81 unnecessary prefixes – not that bad really) Example route: 201.241.22.0/24 is only announced to AS12956 As is covering prefix: 201.241.16.0/20

19. Pg. 19 Brazil – Route Growth (25,373 prefixes, 9.5% bloat) Worst BR offender: Tim Celular S.A., AS26615 (808 unnecessary prefixes) Example route: 191.48.64.0/19 is only announced to AS6762 As is covering prefix: 191.48.0.0/14

20. Pg. 20 Argentina – Route Growth (9,377 pfxs, 9.1% bloat) Worst BR offender: Cablevision S.A., AS10481 (532 unnecessary prefixes) Example route: 181.164.0.0/19 is announced to ASNs 3549, 3356, 2914 As is covering prefix: 181.164.0.0/14

21. Pg. 21 Peru (2,332 prefixes, 6.3% bloat) Ecuador– (4,090 prefixes, 5.0% bloat) Worst PE offender: Movistar Peru, AS6147 (146 unnecessary prefixes, example route: 201.240.96.0/19) Worst EC offender: TVCable, AS14522 (179 unnecessary prefixes, example route: 200.63.200.0/24)

22. Pg. 22 Conclusions Affected countries/networks are likely to suffer again as consensus table reaches 512K organically, “for real” We project that this will begin occurring broadly later this month, with consensus 512K emerging by mid-November Hopefully this brief event in August was enough to encourage people to upgrade and/or reallocate TCAM appropriately…..

23. 512K: Primeros impactos Doug Madory Director of Internet Analysis, Dyn Research LACNOG 14, Santiago, Chile 28 October 2014