...They seem to come & go as they please!
Inspired by RAS's prior posts regarding /16's that were hastly de-agged, I took some time this weekend to answer a few questions which came up; how many updates do I hear about a specific prefix, and does the length have any relationship? Well, several hours later, I knew pretty straight away how many updates I heard about various prefixes in the STS Telecom looking glass, at least. Consider this v0.0.1-alpa of the "Most-Heard Prefix" list, a sort of web-based and rule-less implementation of 'sh ip bgp flap-statistics.' The sorted list, updated every 60 minutes, is available here in gzip format due to excessive size (indeed, 10 peers act as a amplifier): http://eng.ststelecom.com/bgp-data/top-prefixes.txt.gz Incidently, many of the most-updated prefixes are included in the list of RAS's /16 de-aggs. Todo: ignore the effects of a peer session resets (i.e. don't consider a reload as part of the per-prefix flap count) and look at path changes with each update (is it a normal flap, or mid-day traffic-engineering session gone wrong?). Any comments or suggestions for changes are very welcome; please reply off-list. Thanks, --Tk