All things related to multicast

[Jeff Ambern <>]

Indiana GigaPOP also has a 20K limit and saw the outage at the same time.

Jan  4 08:19:02  rtr.ictc-re1 rpd[38256]: 149.165.254.1 (External AS
19401): Shutting down peer due to exceeding configured maximum
prefix-limit(20000) for inet-unicast nlri: 20001
Jan  4 08:19:02  rtr.ictc-re1 rpd[38256]:
bgp_rt_maxprefixes_check_common:7364: NOTIFICATION sent to 149.165.254.1
(External AS 19401): code 6 (Cease) subcode 1 (Maximum Number of Prefixes
Reached) AFI: 1 SAFI: 1 prefix limit 20000



-- 
Jeff Ambern
Global Research NOC Engineering
Indiana University







On 1/4/13 10:24 AM, "Jeff Bartig" 
<>
 wrote:

>
>WiscNet has a 20K prefix-limit peering with NLR with a 10 minute
>restart delay.  My logs show that the peering was shutdown due to
>prefix-limit violations starting at 2:19am CST (08:19 UTC).  Every
>10 minutes until 4:43 (10:43 UTC), the session attempted to come
>up and was shutdown again.  For a few minutes after the session was
>restored at 4:43 we were receiving about 16k routes, rather than the
>usual ~12k routes.  Since then the routes have been lower than 12k.
>
>I'm curious what type of maintenance on the NLR Atlanta node could
>have caused a full table leak.  Do the NLR routers carry a full table?
>Is one of their peers in Atlanta accidentally sending a full table
>that is normally filtered and the maintenance broke the filtering?
>
>Jeff
>
>On Fri, Jan 04, 2013 at 10:00:20AM -0500, Michael H Lambert wrote:
>> On 4 Jan 2013, at 09:56, Bill Owens wrote:
>> 
>> > On Fri, Jan 04, 2013 at 08:32:50AM -0600, David Farmer wrote:
>> >> NLR's leak hit us bad, we have R&E in our global route table and the
>> >> Commodity Internet in a VRF.  NLR leaking 300K+ routes to us and
>>into 
>> >> our R&E table blew our TCAMs out.  Weren't set of for 700K+ IPv4
>>routes, 
>> >> we are not though.  Implemented a plan reallocation of TCAM this
>>morning 
>> >> in the heat of battle.
>> > 
>> > We still haven't had a confirmation of where the leak originated, but
>>I2 seems to be blaming NLR as well. . .
>> 
>> NLR is acknowledging that they leaked routes during 6509 maintenance.
>> 
>> Michael
>
>-- 
>Jeff Bartig                  |  University of Wisconsin - Madison
>
>          |  Division of Information Technology
>(608) 262-8336               |  Network Services/WAN Engineering/AS59
>GTalk/AIM/Yahoo: jbartig     |  WiscNet Backbone Engineering/AS2381