Summary

  • Ebrima Jaw's RIPE 92 presentation examined 2.6 trillion RouteViews updates over thirteen years. The top 5% of collector peers in his daily rankings supplied more than 55%; the lower half supplied about 5%.
  • A separate one-month slice found 19 sessions, described as 2% of more than 2,000, generating 71% of that month's updates. Repeated, unchanged announcements consume shared collector storage and processing while adding little route information.

A route collector is the Internet's notebook. When a router sends the same BGP announcement again and again with unchanged attributes, the notebook gets thicker without learning a new route. The bill arrives as bigger MRT files, more work for analysis systems and time spent finding the offending stream. Ebrima Jaw, a University of Twente researcher, brought numbers to that bill at RIPE 92.

His team examined thirteen years of RouteViews data: 2.6 trillion updates. Of 36 collectors, the five largest accounted for 54% of the total. The distribution was narrower within them. Jaw ranked collector peers each day; the top 5% supplied more than 55% of all updates, while the bottom 50% supplied about 5%. A noisy peer on Tuesday need not be the noisy peer on Friday, which makes a static blacklist a poor substitute for monitoring.

The session-level cut is sharper and narrower. In one month of deeper analysis, 19 sessions—described as 2% of over 2,000—accounted for 71% of updates. Jaw described repeated announcements that carried essentially the same route. His earlier co-authored paper studied a different, smaller sample; its 80-billion-message result belongs to that paper, not this thirteen-year denominator.

The quarrel over who pays surfaced in the meeting room. A RouteViews representative said the project monitors noisy peers, contacts the worst contributors and sometimes depeers an unresponsive one when the platform suffers. Jaw suggested watching sessions and prefixes, auditing router behaviour after session resets, and isolating or retaining noisy streams selectively. A collector can identify where the flood entered its own feed; a path alone cannot name the router or AS that first caused it. A dated joint incident log connecting the repeated updates to router-side faults and fixes would settle that attribution.

The asymmetry is plain: one stream can fill a shared archive, while the collector, researchers and other users pay to store and sift it. Jaw made the excess visible at the peer and session level. The next useful measurement is not another global update total; it is how quickly a noisy source is located, contacted and repaired.

Sources: RIPE 92 primary transcript · official session record · University of Twente profile · original 2025 paper record.