How do I find number of BGP route announcements from RIS Raw data (RIPE Network Coordination Centre) if, for example, I want to look at a particular date? If I choose random route collector, download traffic traces for particular time I am interested in, and since those messages are in MRT format, after converting them to text I get information I do not know how to handle. If I select all BGP messages that have "announce" type I am not getting the volume of the data some research papers are referring to. It must be that I am wrong since I found few references stating similar results..and mine are not even close! Please help.

  • What do you mean by: "number of BGP route announcements from RIS Raw data [...] on a particular date"? - do you want to count all update messages collected over the day or are you just interested in a summary of the data? What do you mean by "traffic traces", RIS does not supply traffic traces but dumps BGP data collected from different peers. What is the "announce type"? It is not listed in the corresponding RFC. – Sim Oct 21 '14 at 19:00
  • Lets say I am trying to graph number of BGP prefix updates received by one monitoring point (RRC) at RIPE NCC during one day. My guess would be to consider entire BGP routing table (bview) since for this task I would need an entire routing table, right? – jannine shulz Oct 21 '14 at 21:04
  • no, the the .bview contains the whole dump summary up to the point of the dump (therefore the connection details). It does not contain individual update messages. For that you'll need the quarter-hourly provided update dumps. – Sim Oct 22 '14 at 9:15
  • the .bview I worked with contain TABLE_DUMP_V2 Data, which are "used to encode the contents of a BGP Routing Information Base (RIB)." source. You probably want to understand BGP4MP_MESSAGE which contain a BGP_UPDATE sub-type. But I've not worked with those yet and it is therefore a guess based on the corresponding RFC. – Sim Oct 22 '14 at 9:23
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 15:38

The easiest way is to use pybgpdump

The package includes a tool in the samples directory called simple.py which will summarise the announce/withdrawal count for a given MRT file:

./simple.py -i updates.20070131.2330.gz 2630 total messages with 12028 announced and 5666 withdrawn routes

If you're after an entire day's worth of data, you'll need to download all the 288 files of 5-minute intervals, and then hack simple.py to iterate through the list.

  • Could you tell me which route collector updates.20070131.2330 file came from? I am using Bgpdump library and parsing tool of my own so it would be great to compare it to pybgpdump output. – jannine shulz Oct 24 '14 at 2:04
  • That was rrc00.ripe.net - the Amsterdam location – Benjamin Dale Oct 26 '14 at 23:23
  • These are results I am getting with my tool for updates.20070131.2330. No. of BGP update messages: 2636(similar to pybgpdump), No. of announce:2496, No. of withdrawal:169. No. of IP addresses below announce: 7452, No. of IP addresses below withdrawal: 5808.The last two I get by counting all the IP addresses below either announcement/withdrawal. Example of BGP update message: TIME: 01/23/03 00:00:23 TYPE: BGP4MP/MESSAGE/Update FROM: AS513 TO: AS12654 ORIGIN: IGP ASPATH: 513 3320 1 1239 4648 9896 NEXT_HOP: ANNOUNCE – jannine shulz Oct 28 '14 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.