3

Can someone walk me through some RIB data from RouteViews? I'm having trouble understanding how to make sense of it. The main thing I need to figure out is what part of the RIB entry can be used to find out where an advertisement originated (as in, which AS originated an advertisement), though I still want to understand what all the other fields mean (both for RIB and Update).

For instance, here is a RIB entry:

TIME: 06/30/17 18:00:09
TYPE: TABLE_DUMP_V2/IPV4_UNICAST
PREFIX: 198.45.50.0/24
SEQUENCE: 536126
FROM: 195.66.226.74 AS41695
ORIGINATED: 06/12/17 15:51:18
ORIGIN: IGP
ASPATH: 41695 174 174 3356 2906
NEXT_HOP: 195.66.226.74
AGGREGATOR: AS2906 198.45.50.1
COMMUNITY: 174:21000 174:22013 41695:1000 41695:1003 41695:1103

Here is an Update entry:

TIME: 01/27/11 21:05:54
TYPE: BGP4MP/MESSAGE/Update
FROM: 195.66.224.114 AS6667
TO: 195.66.225.222 AS6447
ORIGIN: IGP
ASPATH: 6667 3216 9198 29061 8511
NEXT_HOP: 195.66.224.205
MULTI_EXIT_DISC: 0
COMMUNITY: 6667:3001 6667:4004 6667:5209
ANNOUNCE
  195.38.180.0/24

I'm also curious why the fields in the RIB entry and the Update entry differ.

5

I bet you have already figured this out by now, but I saw it was still unanswered. (I'll answer what I can).

Q: "The main thing I need to figure out is what part of the RIB entry can be used to find out where an advertisement originated (as in, which AS originated an advertisement), though I still want to understand what all the other fields mean (both for RIB and Update)."

A: The format is a little confusing, but the originating AS is actually the right most AS number in the AS_PATH field. Thus, the originating AS is 2906. Although unlikely, it should be noted that there are no security mechanisms to verify BGP announcements and any AS along the path can modify the announcement.

(Adding numbers to different parts of the AS Path to explain better):

ASPATH: 41695{3} 174{2} 174 3356 2906{1}

1: This is the originating AS

2: Here you can see something called "AS Path Prepending". The BGP protocol is a path cost based protocol. Thus, here in this example some AS along the path chose to represent this prefix as having a cost of 5 instead of what we humans can see is a cost of 4 if you don't duplicate paths. There are many reasons AS operators might do this and I won't describe the reasons here.

3: This is the neighboring AS

A few other fields I'll explain:

"PREFIX: 198.45.50.0/24"

This is really the meat of BGP. This is the IP address(es) being advertised by the announcement. I would read this BGP announcement in its simplest form as "AS 2906 wants to advertise the prefix of 198.45.50.0/24. If you are next to AS 41695, then your traffic will have to traverse the AS path of (read left to right now) 41695 174 174 3356 2906 to get to this IP range".

"FROM: 195.66.226.74 AS41695"

This is the AS and the IP address (also known as 'peer') that sent the announcement to whatever vantage point you have. Thus the 'From' announcement can be read as "AS41695 is passing along this prefix announcement from it's IP of 195.66.226.74"

COMMUNITY: 174:21000 174:22013 41695:1000 41695:1003 41695:1103

The BGP communities field basically allows AS operators finer grained control in routing traffic and determining policy. It's a 32 bit field split by the ":" character. The values are agreed upon between two ASes so it's hard to know what each one means if the AS doesn't publicly disclose what it means. As a general rule the first 16 bits represent the AS that makes the announcement and the second 16 bits represent some signal or action. Thus we can read "174:21000" as "AS 174 request action '21000' to happen for this prefix" or "AS 174 tags this prefix with signal '21000'" (whatever action/signal it is). Some ASes do in fact publish this info. AT&T does.

In general I highly suggest you read the RFCs such as RFC 4271. Although they can be dense depending on your level of understanding, they have most of the information to understand everything. https://tools.ietf.org/html/rfc4271#section-5.1

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.