network-programmingroutesbgp

Understanding format of RIB dumps from Oregon Route-views


I am working on a project in which I need to analyse the rib-dumps from the Oregon Routeviews Project.

I download the .bz2 file from here for a specific time and date for a specific node. These files are generated every 2 hours. Then I unzipped and parsed using a zebra parser. In the end, I get a text file with almost a million entries in the following format

194.33.63.0/24 58511 8468 31493 31493

There are also a lot of entries with the same last number but different IP in the beginning. For example

194.28.28.0/22 58511 31500 50911

194.28.28.0/23 58511 31133 50911

My inference is that these numbers are Autonomous System numbers and they somehow denote BGP Hops, but I am not clear how they relate to the IP address in the starting. And what exactly is the source/destination AS?


Solution

  • I really think you should go and do some reading on how BGP works and what the routeing information carried by the BGP messages you are looking at is and means.

    To get you started...

    ...a route in BGP speak is a prefix and some attributes. Key among the attributes are the next-hop and the AS-Path. In announcing a route to a BGP peer (neighbour) the BGP router is saying that it can reach the prefix and if packets with destinations in the prefix are forwarded to the next-hop, they will be forwarded on towards their destination. The AS-PATH lists the ASes through which packets are (expected to) travel on their way to the destination.

    So what you are seeing is reachable prefixes and the AS-PATH attribute for each one. I'm guessing you left out the next-hop (for eBGP, that will generally be the/an address of the BGP router which is advertising the route -- but in any case all eBGP routes will generally have the same next-hop).

    The AS-PATH can be read from left to right: the first AS is the one from whom the route was learnt, the last AS is the one that contains the prefix. Packets forwarded to the next-hop are (currently) expected to travel through those ASes, in that order, on their way to their destination. So the first AS would be the source -- the immediate source of the route. The last AS can be called the destination, but is also known as the origin -- the origin of the route.

    [Technically, the AS-Path should be read from right to left, and lists the ASes which the route has traversed this far. Most of the time that's the same as reading left to right for packets traversing the network towards their destination.]