Summary

  • Md.Kamruzzaman Khan says AS63526 began withdrawing 47 prefixes at about 14:45 UTC on 18 July 2024, manually, router by router and session by session: 46 IPv4 /24s and one IPv6 /48.
  • RIPE NCC's bounded routing-history response lists all 47 under one origin and reports an eight-hour granularity. The next sampled interval shows one full-table RIS peer for each IPv4 /24 and four for the IPv6 /48, down from 358 and 363 respectively.

The command line had a sequence. The public history screen had a bucket. In his first-hand RIPE Labs account, Khan describes starting AS63526's withdrawals at roughly 20:45 in Dhaka, 14:45 UTC, on 18 July 2024. There was no shutdown script. Operators moved through routers and BGP sessions, checking each change. The commands, he says, were the same ones used for ordinary maintenance. The consequence was anything but ordinary.

Khan names 47 prefixes: 46 IPv4 /24s and one IPv6 /48. A RIPE NCC routing-history query for AS63526 returns exactly that mix for the bounded 18–20 July window we captured. Its time_granularity is 28,800 seconds. All 46 IPv4 entries are shown with 358 full-table peers through the interval ending 15:59:59 UTC on 18 July; the IPv6 entry has 363. The next interval starts at 16:00 and shows one peer for each IPv4 /24 and four for the IPv6 /48. A collector's residual view is visible even after the operator says the withdrawals were completed. The record gives no reason for that residue.

Eight hours is a large drawer for a sequence of human actions. The shared boundary does not show whether the 47 commands were issued in seconds or stretched across routers and checks. It cannot say who instructed Khan's team, why other networks changed, or when an individual subscriber lost service. Khan's account is the direct record of his own network's procedure; the RIS output is the measured view from its peers. Joining the two as if they were the same clock would manufacture precision.

RIPE NCC's MRT archive documentation explains the way out. RIB dumps record state every eight hours; update files preserve received BGP changes in five-minute intervals. Khan says his study did not query those raw updates. The next useful evidence is the AS63526 update stream at relevant collectors, matched with the operator's change log. That would put order and collector delay around the 47 withdrawals instead of assigning every command the same convenient time.