Summary

  • Tom Strickx told RIPE 93 that internal more-specific routes helped spread Anycast traffic across compute nodes but made route tables expensive to carry. A later load-balancing design let his team remove many of those routes.
  • Removing the aggregation step also lost an AGGREGATOR identifier used to locate leaked routes. He said his team patched BIRD to set the identifier and ASN, then asked collectors and route servers to keep exposing them.

The route table ate the clever trick

Strickx's RIPE 93 talk was billed as an Anycast lesson. The session transcript shows the argument beneath it: traffic distribution across points of presence and ECMP distribution inside each site are separate jobs. Earlier, when a router had too few ECMP buckets for the available compute, his team split internal prefixes into more-specific routes. More routes gave the router more places to send work.

The trick scaled badly with the number of prefixes. Strickx described a large customer onboarding that pushed a routing daemon out of memory and left a router rebooting for hours. His team later built a Layer 4 load-balancing system that could move packets to available compute without splitting every route so aggressively. He said the total received-prefix count across their compute-facing BGP sessions fell substantially. These are his operational numbers, not a RIPE-wide measurement.

Fewer routes solved one problem and opened another. With route aggregation, the BGP AGGREGATOR attribute carried an identifier that Strickx could look up internally to find the point of presence that produced a route. When a leak appeared in a public route collector, that breadcrumb helped the team locate and shut the offending path. Once the extra internal routes and the associated aggregation step were gone, the breadcrumb disappeared too.

A small patch for an expensive clue

Strickx said his team added about 190 lines to BIRD so a configuration could set the AGGREGATOR identifier and ASN even without the former aggregation workflow. He urged route collectors and route servers to retain and expose the attribute. The value of this fix is operational: a shorter route table and a way to trace where a leaked announcement originated. The session records his account of the patch; it is not a published audit of its behaviour across every collector.

The missing proof is a public patch and comparable collector output before and after a leak, including the time needed to isolate it. Those artifacts would show whether the diagnostic survives beyond his team's setup. The broader point is already plain: simplifying a network can erase the very metadata an operator uses when it breaks.

Sources: RIPE 93 talk record; RIPE 93 Routing Working Group transcript.