How do I find number of BGP route announcements from RIS Raw data (RIPE Network Coordination Centre) if, for example, I want to look at a particular date? If I choose random route collector, download traffic traces for particular time I am interested in, and since those messages are in MRT format, after converting them to text I get information I do not know how to handle. If I select all BGP messages that have "announce" type I am not getting the volume of the data some research papers are referring to. It must be that I am wrong since I found few references stating similar results..and mine are not even close! Please help.
5
-
What do you mean by: "number of BGP route announcements from RIS Raw data [...] on a particular date"? - do you want to count all update messages collected over the day or are you just interested in a summary of the data? What do you mean by "traffic traces", RIS does not supply traffic traces but dumps BGP data collected from different peers. What is the "announce type"? It is not listed in the corresponding RFC.– SimCommented Oct 21, 2014 at 19:00
-
Lets say I am trying to graph number of BGP prefix updates received by one monitoring point (RRC) at RIPE NCC during one day. My guess would be to consider entire BGP routing table (bview) since for this task I would need an entire routing table, right?– jannine shulzCommented Oct 21, 2014 at 21:04
-
no, the the .bview contains the whole dump summary up to the point of the dump (therefore the connection details). It does not contain individual update messages. For that you'll need the quarter-hourly provided update dumps.– SimCommented Oct 22, 2014 at 9:15
-
the .bview I worked with contain TABLE_DUMP_V2 Data, which are "used to encode the contents of a BGP Routing Information Base (RIB)." source. You probably want to understand BGP4MP_MESSAGE which contain a BGP_UPDATE sub-type. But I've not worked with those yet and it is therefore a guess based on the corresponding RFC.– SimCommented Oct 22, 2014 at 9:23
-
Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.– Ron Maupin ♦Commented Aug 10, 2017 at 15:38
Add a comment
|
1 Answer
The easiest way is to use pybgpdump
The package includes a tool in the samples directory called simple.py which will summarise the announce/withdrawal count for a given MRT file:
./simple.py -i updates.20070131.2330.gz
2630 total messages with 12028 announced and 5666 withdrawn routes
If you're after an entire day's worth of data, you'll need to download all the 288 files of 5-minute intervals, and then hack simple.py to iterate through the list.
-
Could you tell me which route collector updates.20070131.2330 file came from? I am using Bgpdump library and parsing tool of my own so it would be great to compare it to pybgpdump output. Commented Oct 24, 2014 at 2:04
-
-
These are results I am getting with my tool for updates.20070131.2330. No. of BGP update messages: 2636(similar to pybgpdump), No. of announce:2496, No. of withdrawal:169. No. of IP addresses below announce: 7452, No. of IP addresses below withdrawal: 5808.The last two I get by counting all the IP addresses below either announcement/withdrawal. Example of BGP update message: TIME: 01/23/03 00:00:23 TYPE: BGP4MP/MESSAGE/Update FROM: 192.65.184.3 AS513 TO: 192.65.185.40 AS12654 ORIGIN: IGP ASPATH: 513 3320 1 1239 4648 9896 NEXT_HOP: 192.65.185.4 ANNOUNCE 202.49.252.0/24 202.49.253.0/24 Commented Oct 28, 2014 at 9:30