All things related to multicast

[Bill Owens <>]

On Fri, Jan 04, 2013 at 08:32:50AM -0600, David Farmer wrote:
> NLR's leak hit us bad, we have R&E in our global route table and the 
> Commodity Internet in a VRF.  NLR leaking 300K+ routes to us and into 
> our R&E table blew our TCAMs out.  Weren't set of for 700K+ IPv4 routes, 
> we are not though.  Implemented a plan reallocation of TCAM this morning 
> in the heat of battle.

We still haven't had a confirmation of where the leak originated, but I2 
seems to be blaming NLR as well. . .

> We've set a max prefix on NLR of 20K routes and will be doing the same 
> for I2 and all our other R&E peers in a future maintenance window

Us too; I hate to do that since max prefix is so heavy-handed. But losing the 
I2 connections beats the hell out of having the entire network fall over!

> Bill, the first leak was at 08:20UTC ish when were the other leak(s) you 
> saw, I'm trying to correlate stuff.

All of our backbone routers started complaining about TCAM at 08:21:46 or 
:47, but we saw other log messages 10-20 seconds earlier that might have been 
related: customer mBGP sessions dropping and PIM errors, which is what made 
me think that this was multicast at first.

We don't graph BGP prefixes (yet!) but one of our members does, and I've 
attached his graphs from this morning. That's the only evidence I have that 
the leak happened twice; by the time of the second leak our routers were 
already busy screaming at us about TCAM exhaustion and lost BGP sessions, so 
it's difficult to tell from the logs.

Bill.

Attachment: NLR_BGP_count.png
Description: PNG image

Attachment: NYSERNet_BGP_count.png
Description: PNG image