different between "show ip bgp" command and traceroute

Question

base on following results from route-views

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------

route-views>sh ip bgp 2.22.0.1 bestpath
BGP routing table entry for 2.22.0.0/22, version 68416201
Paths: (39 available, best #35, table default)
Not advertised to any peer
Refresh Epoch 1
393406 1299
162.243.188.2 from 162.243.188.2 (162.243.188.2)
Origin IGP, localpref 100, valid, external, best
Community: 1299:1000 1299:30000 1299:30200
rx pathid: 0, tx pathid: 0x0


route-views>trace 2.22.0.1 
Type escape sequence to abort.
Tracing the route to 2.22.0.1
VRF info: (vrf in name/id, vrf out name/id)
1 vl-51.uonet1-gw.uoregon.edu (128.223.51.2) [AS 3582] 50 msec 1 msec 48 msec
2 2.bundle-ether10.uonet10-gw.uoregon.edu (128.223.2.10) [AS 3582] 51 msec 49 msec 50 msec
3 eugn-car1-gw.nero.net (207.98.68.177) [AS 3701] 1 msec 1 msec 1 msec
4 eugn-core1-gw.nero.net (207.98.64.161) [AS 3701] 1 msec 51 msec 68 msec
5 te-4-4.car1.Sacramento1.Level3.net (4.53.200.1) [AS 3356] 49 msec 51 msec 49 msec
6 sjo-b21-link.telia.net (213.248.98.29) [AS 1299] 49 msec 52 msec 49 msec
7 nyk-bb2-link.telia.net (213.155.133.238) [AS 1299] 167 msec
nyk-bb2-link.telia.net (80.91.245.97) [AS 1299] 99 msec
nyk-bb2-link.telia.net (80.91.254.176) [AS 1299] 102 msec
8 kbn-bb4-link.telia.net (213.155.134.53) [AS 1299] 199 msec
kbn-bb4-link.telia.net (62.115.118.199) [AS 1299] 195 msec
kbn-bb4-link.telia.net (213.248.82.102) [AS 1299] 249 msec
9 s-bb3-link.telia.net (62.115.139.61) [AS 1299] 201 msec
s-bb4-link.telia.net (62.115.120.59) [AS 1299] 206 msec 245 msec

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------

as you can see , the "show ip bgp " display that the AS number before destination AS is 393406 , but when we trace the same prefix ,the result dispaly AS=3356 before destination ASN.

why?

thanks in advance.

Answer 1

This is due to the fact that route-views servers use multi-hop BGP for peering eg: there may be a lot of ASs that are bypassed between the location of the route-views server you are connected to and the peer.

It also (in the case of Zebra) does not install routes into the forwarding table of the machine.

The traceroute command you are running would simply use the machine's IP stack and follow the entire AS-Path to the destination as you see in your trace.

Check the Implementation section on the front page of http://routeviews.org and the examples linked beneath it.

Answer 2

I'm not quite sure what you're asking, but I'll try anyway. I believe you got the output confused, and the commands shown in the question are inconsistent as it is apparently from two separate routers.

COMMANDS ON ROUTER #1 - appeared to be IP 162.243.188.2: The first output you show us shows two AS numbers: AS393406 which is the AS of the IP 162.243.188.2 (which is shown in the output), and AS1299 which is the network that is announcing 2.22.0.1 (also AS34164 announces it, but it's less specific as 34164 is announcing it within a /13 but 1299 is announcing it within a /22).

COMMANDS ON ROUTER #2 - appeared to be @ University of Oregon: The second output shows what appears to be a traceroute from a DIFFERENT router than the first. This time it's at the University of Oregon on AS3582. It then travels down the Internet, until it reaches AS1299.

The question you asked was why AS3356 shows up before AS1299 in the traceroute, because the first output showed AS393406 before AS1299. That is not true. The two numbers shown were the starting AS - servicing 162.243.188.2 on AS393406 - and the destination AS, AS1299 servicing 2.22.0.1. The AS3356 you see in the traceroute is the last AS your packet hops through before reaching the destination network's (Akamai) AS at AS1299.

SO, I THINK what happened is you confused the output. That first output of two AS numbers were showing the beginning and the end ASes in the route. Also, you apparently had two separate routers issuing the commands as one appeared to be on Digital Ocean and the other at University of Oregon.