My new BGP book: 'Internet Routing with BGP' by Iljitsch van Beijnum BGPexpert My BGP book from 2002: 'BGP' by Iljitsch van Beijnum

Home · BGP Expert Test · What is BGP? · BGP Vendors · Links · Archives · Books · My New BGP Book

BGP (advertisement)
Internet exchange renumbering: everything old is new again (posted 2014-10-15)

This week, the Amsterdam Internet Exchange is renumbering its peering LAN.

An internet exchange (IX) is simply a very big Ethernet. Members connect a router port to that Ethernet, and can then exchange packets with each other. When you want to exchange traffic with many other networks, obviously this is more efficient than setting up dedicated connections with all these other networks.

Until this week, AMS-IX used a /22 prefix, allowing for about a thousand connected routers. That was no longer enough, so they got a new /21 prefix, which can accommodate two thousand connected routers. This means that all the currently connected routers must get a new address. No big deal. This is why search-and-replace was invented.

However, sometimes someone makes a mistake. Like configuring <new address>/22 instead of <new address>/21. And then letting that /22 propagate to other networks over BGP. Suppose:

  • is the prefix used on the IX peering LAN
  • peers with
  • advertises
  • wants to send a BPG keepalive packet to Normally this packet would go to the port where is configured. But the prefix is "more specific", so the packet is sent on its way to the source of the prefix: router
  • forwards the packet to router
  • All's well that ends well? Not so fast. In BGP, there are not supposed to be any intermediate routers between two BGP routers. sees the packet traversed and extra hop, rejects it and resets the BGP session.
  • can no longer send traffic to

(A more specific prefix is a smaller range of IP addresses. is BGP talk for the address range - is the range - Because the latter identifies a smaller range of IP addresses, the packets are sent in that direction, just like you'd follow a sign "Paris" rather than a sign "France" if you were going to Paris, even though Paris is part of France so presumably following the sign "France" would also get you to Paris.)

The sad thing is that the exact same thing happened in 2003, when the AMS-IX renumbered from a /24 to a /23. I always warn against this issue during my training courses, and tell students to filter the IX prefixes of internet exchanges they're connected to, as well as all possible subprefixes (more specifics) that fall within that IX prefix. For instance:

ip prefix-list import deny le 32
ip prefix-list import deny le 32
ip prefix-list import permit le 24

This prefix list will reject incoming updates with your own prefix and all possible more specifics (assuming your prefix is as well as the AMS-IX prefix and all possible subprefixes. It then allows all prefixes with a prefix length of no more than /24, which is common practice for IPv4.

"le" means "less or equal" so " le 32" means:

Hopefully, by the time AMS-IX connects more than 2000 routers, the issue is moot because we no longer use IPv4. But for now: happy renumbering!