Summary

  • RIPE NCC says a synthetic timer now in progress should prevent a specific type of route from getting stuck in RIB/bview files.
  • Its changelog says some routes from a de-peered RRC00 peer remained in bview dumps until the 9 May 2025 file; no public record ties that event to the planned timer.

Analysis

An analyst reconstructing route history from RIS snapshots may still see a route listed after its peer has been removed. That describes what the collector retained; it does not prove that routers continued to forward the route. The distinction matters because bview is evidence of the RIS archive’s contents, not a forwarding log. Treating one as the other would give researchers and operators a false account of the route’s operational history.

RIPE NCC’s dataset-description changelog records that after 2a00:1e68:112::1 (AS 42861) was de-peered on RRC00, “some routes” from that peer became stuck in the processing pipeline. The entry is dated 22 August 2023 and says missing consistency checks delayed detection. It then gives a concrete archive boundary: the routes appeared in table dumps, or bview files, until 9 May 2025; bview.20250509.1600.gz was the first file in which they were removed. The source gives no route count or prefix list and does not explain whether its date marks onset, discovery or another milestone.

The Q4 2026 RIS plan lists “Improve MRT file quality” as in progress. It separates RFC 6396 extended timestamps from a second change: a synthetic BGP hold timer in the processing pipeline, intended to prevent a specific type of stuck routes in RIB/bview files. The plan does not publish its value, trigger, tests, affected collectors or rollout date. It also does not say that this timer fixes the named 2023 case. The page’s date is 17 September 2026.

“BGP hold timer” has a protocol meaning, but the planned RIPE mechanism sits elsewhere. RFC 4271’s negotiated Hold Time is carried in OPEN; after message silence, a speaker sends Hold Timer Expired and closes the BGP connection. RIPE calls its timer synthetic and places it in RIS processing. The public description does not say it negotiates with peers or controls a live session. Nor is this a “BGP zombie” report: RIPE Labs uses that term for routes remaining active at peers after prefix withdrawal. The dataset changelog instead describes internal processing residue after peer removal.

A bview is a collector’s periodic snapshot; an update file records changes over an interval. Neither is a universal forwarding ledger. A pipeline defect can therefore misstate what the collector retained without proving what routers forwarded. Detection and correction are also separate properties: removing a route eventually does not reveal how long an inaccurate snapshot persisted, what neighboring files were affected or whether the repair is reproducible. The plan’s next proof should be file-level: the trigger, timer scope, affected collectors, convergence time after peer removal, correction record and before/after examples.

Sources

RIPE NCC: RIS quarterly planning · RIPE NCC: RIS MRT dataset description and changelog · RIPE RIS: MRT files · RFC 4271 · RFC 6396 · RIPE Labs: BGP Zombies