1

I am parsing out the ASNs from several AS_PATHS. A majority of the attributes I encounter look like this one:

[64, 1, 1, 0, 64, 2, 10, 2, 2, 0, 0, 23, 169, 0, 0, 50, 156, 64, 3, 4, 200, 40, 162, 202] 

where:

64, 1, 1, 0, -> Type Code 1, ORIGIN: IGP

64, 2, 10, 2, 2, 0, 0, 23, 169, 0, 0, 50, 156, ->
    64 - Length of attribute length: 1 byte (5th bit is NOT flipped)
     2 - Type Code 2: AS_PATH
    10 - Attribute length: 10 bytes
     2 - AS_SEQUENCE (ASNs in this attribute are ordered)
     2 - Number of ASNs in the AS_PATH (2)
     0, 0, 23, 169 - ASN 1: 6057
     0, 0, 50, 156 - ASN 2: 12956

64, 3, 4, 200, 40, 162, 202 -> Type Code 3: NEXT HOP, 200.40.162.202

This all makes sense. However I have encountered this AS_PATH attribute byte stream, and I cannot make sense of the AS_PATH:

[64, 2, 48, 2, 6, 0, 0, 18, 169, 0, 0, 27, 27, 0, 0, 81, 28, 0, 0, 34, 201, 0, 0, 34, 201, 0, 0, 34, 201, 2, 5, 0, 0, 164, 148, 0, 0, 221, 203, 0, 0, 221, 203, 0, 0, 221, 203, 0, 0, 221, 203]

Skipping strait to the AS_PATH attribute...

 64 - Length of attribute length: 1 byte (5th bit is NOT flipped)
  2 - Type Code 2: AS_PATH    
 48 - Attribute length: 48 bytes
  2 - AS_SEQUENCE (ASNs in this attribute are ordered)
  6 - Number of ASNs in the AS_PATH (6)
  0, 0, 18, 169 - ASN 1: 4777
  0, 0, 27, 27  - ASN 2: 6939
  0, 0, 81, 28  - ASN 3: 20764
  0, 0, 34, 201 - ASN 4: 8905
  0, 0, 34, 201 - ASN 4: 8905
  0, 0, 34, 201 - ASN 4: 8905
  2, 5,         - What is this??????
  0, 0, 164, 148 - ASN 5: 42132
  0, 0, 221, 203 - ASN 6: 56779
  0, 0, 221, 203 - ASN 6: 56779
  0, 0, 221, 203 - ASN 6: 56779
  0, 0, 221, 203 - ASN 6: 56779

My questions are:

  1. What are the 2,5 bytes in the AS_PATH attribute?
  2. Why are ASNs 4 and 6 repeated?

Thanks in advanced.

2

Answering #2: Why are ASN 56779 and ASN 8905 repeated.

The number of AS hops is a key factor in determining which path traffic takes. Lets say you are running a dual-homed enterprise with a 10-gig ISP connection and a 1-gig ISP connection. You want most ingress traffic to come in via the 10-gig connection. An easy way to achieve that is to "AS path prepend" (add your own AS# to your BGP advertisement) on the 1-gig connection. That way, the Internet sees a shorter AS path via your 10-gig connection and traffic flows that way. But if the 10-gig connection goes down that route will be deleted and traffic will reroute via the backup 1-gig connection.

When AS-path prepending, it is common/recommended practice to prepend your own AS#. So AS 56779 looks like it has 3 extra prepends and AS 8905 has 2 extra prepends.

A comment (not an answer) on question #1:

Here's another look at your route from a BGP looking glass in hurricane electric (AS6939, #2 on your list):

route-server> show ip bgp 31.40.96.0/21 
BGP routing table entry for 31.40.96.0/21
Paths: (23 available, best #5, table Default-IP-Routing-Table)
  Not advertised to any peer
  20764 8905 8905 8905 42132 56779 56779 56779 56779
    216.218.252.174 from 216.218.252.174 (216.218.252.174)
      Origin IGP, metric 1, localpref 140, valid, internal
      Last update: Sun Mar  1 19:59:03 2020

The (2,5) is not displayed here. My comment is that AS numbers used to be 16-bits, but changed to 32 bits about a decade ago. I wonder if (2,5) is AS 517 "KPN Eurorings B.V." running old software? Just a guess.

Update: Looking at BGP paths, I don't think AS 517 is between AS8905 and AS42132. The looking glass at lg.rascom.ru has a nice graphical representation of this path:

enter image description here

Router: msk-3v-cr1 
Command: show bgp ipv4 unicast 77.247.136.0/21
Wed Mar  4 10:19:11.256 MSK
BGP routing table entry for 77.247.136.0/21
Last Modified: Jan 10 12:01:16.515 for 7w4d
Paths: (1 available, best #1)
  8905 8905 8905 42132
    80.64.96.147 (metric 8) from 80.64.96.147 (80.64.96.147)
      Origin IGP, metric 0, localpref 100, valid, internal, best, group-best
      Received Path ID 0, Local Path ID 1, version 291944684
      Community: 8905:2001 20764:1201 20764:1502 20764:3002(Customer) 20764:3011(Moscow PoP) 20764:3021(Russian source)

Your (2,5) "anomaly" is between AS8905 and AS42132, which are both owned by "Digit One LLC, RU".

| improve this answer | |
  • Apologies for the late reply. Thank you so much for answering my question so thoroughly. The example you gave for question #2 was a very clear and interesting one. Thank you for spending time on question #1. lg.rascom.ru looks like a great resource, will be using that moving forward. Good to have a sanity check regarding 2,5 being anomalies. Is it a fair guess to say there is something wrong with the "Digit One LLC, RU" software? Where else could an unexpected entry like this be coming from? Your response is tremendously helpful and greatly appreciated. – RJ Rybarczyk Apr 1 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.