nanog mailing list archives

Re: Larger and larger invalid BGP updates starting at 4:25 AM ET

From: Christopher Morrow via NANOG <nanog () lists nanog org>
Date: Mon, 14 Sep 2026 18:49:34 -0400

Sorry I should have included an example of the bad announcement:

On Mon, Sep 14, 2026 at 6:35 PM Christopher Morrow
<morrowc.lists () gmail com> wrote:


On Mon, Sep 14, 2026 at 11:57 AM Bryton Herdes via NANOG
<nanog () lists nanog org> wrote:


Could you elaborate a little more on what the "invalid" updates are that
you're seeing?


Adding more data from Drew would be handy, but... RV's archive says:

 Bytes   Date         filename
 1090608 Sep 14 03:30 updates.20260914.0715.bz2
 1158653 Sep 14 03:45 updates.20260914.0730.bz2
 1418127 Sep 14 04:00 updates.20260914.0745.bz2
 1364405 Sep 14 04:15 updates.20260914.0800.bz2
 1253632 Sep 14 04:30 updates.20260914.0815.bz2
 1643384 Sep 14 04:45 updates.20260914.0830.bz2
 1230451 Sep 14 05:00 updates.20260914.0845.bz2
 2864012 Sep 14 05:15 updates.20260914.0900.bz2
 2946458 Sep 14 05:30 updates.20260914.0915.bz2
 1134150 Sep 14 05:44 updates.20260914.0930.bz2
 1062511 Sep 14 06:00 updates.20260914.0945.bz2
 1171551 Sep 14 06:15 updates.20260914.1000.bz2
 3794313 Sep 14 06:30 updates.20260914.1015.bz2
 1476709 Sep 14 06:45 updates.20260914.1030.bz2
 2026845 Sep 14 07:00 updates.20260914.1045.bz2
 1225161 Sep 14 07:15 updates.20260914.1100.bz2
 1705264 Sep 14 07:29 updates.20260914.1115.bz2
 3248787 Sep 14 07:45 updates.20260914.1130.bz2
 2267389 Sep 14 08:00 updates.20260914.1145.bz2
 3948724 Sep 14 08:15 updates.20260914.1200.bz2
 1221499 Sep 14 08:30 updates.20260914.1215.bz2
 4237352 Sep 14 08:45 updates.20260914.1230.bz2
 4292869 Sep 14 09:00 updates.20260914.1245.bz2
 1234557 Sep 14 09:15 updates.20260914.1300.bz2
 1394623 Sep 14 09:30 updates.20260914.1315.bz2
 1239241 Sep 14 09:45 updates.20260914.1330.bz2
 1198730 Sep 14 10:00 updates.20260914.1345.bz2
 1352655 Sep 14 10:15 updates.20260914.1400.bz2
 1365174 Sep 14 10:30 updates.20260914.1415.bz2
 3617869 Sep 14 10:45 updates.20260914.1430.bz2
 3219326 Sep 14 11:00 updates.20260914.1445.bz2
 4269638 Sep 14 11:15 updates.20260914.1500.bz2
 1485468 Sep 14 11:30 updates.20260914.1515.bz2
 4276591 Sep 14 11:45 updates.20260914.1530.bz2
 3682236 Sep 14 12:00 updates.20260914.1545.bz2

(err, 0425ET ~0825UTC? timzones and I do not agree about much)
it LOOKS like prior to the 0425 ET timeperiod mostly we caught 1mb of
update data in each 15 min window.
After 0845 there's a ~doubling in content, with sometimes 4x content.

Using a nifty tool (https://github.com/morrowc/mrtparser in c++ and
rust! <shameless plug>) to look at that mrt data a bit...
you probably want to look at: 202.171.8.0/24

analysis says that this has an ever-growing AS_PATH attribute :( it
looks like the prefix is being passed
between 2 ASN in a loop, neither is loop-preventing the announcement ;(

There's also POSSIBLY an AWS de-aggregation event at about 2026-09-14
08:31:27 UTC....
but the 202 prefix seems like your most likely candidate for the problem child.


Record 78775: Timestamp: 2026-09-14 08:42:37 Type: BGP4MP_ET Subtype:
BGP4MP_MESSAGE_AS4 Length: 1797
  Microsec: 726259 BGPType: UPDATE NLRI: 202.171.8.0/24 ORIGIN=IGP
AS_PATH=(22652 174 10217 38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777)(10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217
 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217
 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217
 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217
 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217
 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217
 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777
10217 38777 10217 38777 10217 38777 10217 38777 10217 38777 10217
38777 10217 38777 10217 38777 10217
 38777 147168) NEXT_HOP=45.61.0.85 COMMUNITIES=174:21201 174:22038

Effectively: AS10217(NTT-NET-ID-AS) && AS38777(NTT-NET-ID-BB-AS)
appear to have a great game of ping-pong going on.

I look forward to someone else's bgp analysis :)

-chris

_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/6DC5EX5WIKSKDXJQYC5V6F4QW4F5QZ6B/

Current thread:

Larger and larger invalid BGP updates starting at 4:25 AM ET Drew Weaver via NANOG (Sep 14)
- Re: Larger and larger invalid BGP updates starting at 4:25 AM ET Bryton Herdes via NANOG (Sep 14)
  - Re: Larger and larger invalid BGP updates starting at 4:25 AM ET Christopher Morrow via NANOG (Sep 14)
    - Re: Larger and larger invalid BGP updates starting at 4:25 AM ET Christopher Morrow via NANOG (Sep 14)
    - Re: Larger and larger invalid BGP updates starting at 4:25 AM ET Bryton Herdes via NANOG (Sep 14)