Re: Unusually High traffic from Akamai/Oracle - public-yum.oracle.com

[Jonathan Roach]

Hi James,

I've forwarded your email to the yum.oracle.com team internally; they've
acknowledged receipt and asked me to let the list know. Apologies for
the delay - I only noticed this thread today.

Kind regards,
Jon


On 09/05/18 20:48, James Stahr wrote:
> 
> 
> Hi,
> 
> Since I'm not a customer of either organization, I'm reaching out to
> NANOG for a contact and perhaps others may also be experiencing similar
> symptoms over the past 3-4 weeks.  The situation appears to be that
> customers of ours have Oracle Linux and when they attempt to download
> updates, their traffic goes through the roof for hours on end.  While
> researching this phenomenon, I found this discussion which coincides
> with the traffic I've seen, however there is no mention of excessive
> traffic resulting from this "corruption" nor have their been any
> additional reports:
> 
> https://community.oracle.com/thread/4138810
> 
> 
> Currently, I have two customer environments which are hitting about
> ~2Gb/s when normally their traffic levels are nearly zero.   At first I
> thought it was an isolated incident but then we observed the same issue
> with another customer.  All of this traffic is coming from
> 23.35.204.188:80, which belongs to Akamai.  Since that's somewhat of a
> dead end, we examined the hosts which are requesting the data from
> Akamai and found that they are all Oracle Linux boxes and it's a yum
> process on Oracle Linux which appears to be repeatedly downloading the
> same content for hours on end:
> 
> 
> [root@xyzzy noc]# netstat -plutan | grep :80
> tcp    0  0 172.16.122.112:14272    23.35.204.188:80
>    ESTABLISHED 58880/python
> [root@xyzzy noc]# ps auxww | grep python
> root 41015  0.0  0.3 401940 52044 ?    S    Apr30   0:02
> /usr/bin/python2 /usr/share/system-config-lvm/system-config-lvm.py
> root 58880 59.7  1.0 479680 164140 ?   R    18:24  27:18
> /usr/bin/python /usr/share/PackageKit/helpers/yum/yumBackend.py
> get-updates none
> 
> I can only assume that the data being downloaded is corrupt as this
> multiple hour download does not consume any disk space and because the
> file(s) are repeatedly downloaded, the logic behind the yum routines are
> also at fault for 1TB of
> 
> I don't expect anyone at Akamai to reach out to me since they are simply
> the middle man here, but I'm hoping that someone at Oracle will because
> the cost to Oracle for Akamai to deliver this junk traffic is not zero
> and I have a hard time seeing how this issue is isolated to our network.
>  I'd also be interested to hear from anyone else who has been seeing
> traffic spikes from public-yum.oracle.com.
> 
> 
> -James Stahr

-- 

Weekly Routing Table Report

[Routing Analysis Role Account]

This is an automated weekly mailing describing the state of the Internet
Routing Table as seen from APNIC's router in Japan.

The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG
TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG, IRNOG and the RIPE Routing WG.

Daily listings are sent to bgp-st...@lists.apnic.net

For historical data, please see http://thyme.rand.apnic.net.

If you have any comments please contact Philip Smith .

Routing Table Report   04:00 +10GMT Sat 12 May, 2018

Report Website: http://thyme.rand.apnic.net
Detailed Analysis:  http://thyme.rand.apnic.net/current/

Analysis Summary


BGP routing table entries examined:  699099
Prefixes after maximum aggregation (per Origin AS):  269055
Deaggregation factor:  2.60
Unique aggregates announced (without unneeded subnets):  336810
Total ASes present in the Internet Routing Table: 60733
Prefixes per ASN: 11.51
Origin-only ASes present in the Internet Routing Table:   52477
Origin ASes announcing only one prefix:   22967
Transit ASes present in the Internet Routing Table:8256
Transit-only ASes present in the Internet Routing Table:269
Average AS path length visible in the Internet Routing Table:   4.0
Max AS path length visible:  34
Max AS path prepend of ASN ( 30873)  28
Prefixes from unregistered ASNs in the Routing Table:51
Number of instances of unregistered ASNs:51
Number of 32-bit ASNs allocated by the RIRs:  22508
Number of 32-bit ASNs visible in the Routing Table:   18184
Prefixes from 32-bit ASNs in the Routing Table:   75633
Number of bogon 32-bit ASNs visible in the Routing Table:14
Special use prefixes present in the Routing Table:1
Prefixes being announced from unallocated address space:309
Number of addresses announced to Internet:   2859146114
Equivalent to 170 /8s, 107 /16s and 27 /24s
Percentage of available address space announced:   77.2
Percentage of allocated address space announced:   77.2
Percentage of available address space allocated:  100.0
Percentage of address space in use by end-sites:   98.9
Total number of prefixes smaller than registry allocations:  233007

APNIC Region Analysis Summary
-

Prefixes being announced by APNIC Region ASes:   191299
Total APNIC prefixes after maximum aggregation:   54176
APNIC Deaggregation factor:3.53
Prefixes being announced from the APNIC address blocks:  190152
Unique aggregates announced from the APNIC address blocks:77850
APNIC Region origin ASes present in the Internet Routing Table:8802
APNIC Prefixes per ASN:   21.60
APNIC Region origin ASes announcing only one prefix:   2465
APNIC Region transit ASes present in the Internet Routing Table:   1312
Average APNIC Region AS path length visible:4.0
Max APNIC Region AS path length visible: 29
Number of APNIC region 32-bit ASNs visible in the Routing Table:   3762
Number of APNIC addresses announced to Internet:  766828290
Equivalent to 45 /8s, 180 /16s and 223 /24s
APNIC AS Blocks4608-4864, 7467-7722, 9216-10239, 17408-18431
(pre-ERX allocations)  23552-24575, 37888-38911, 45056-46079, 55296-56319,
   58368-59391, 63488-64098, 64297-64395, 131072-137529
APNIC Address Blocks 1/8,  14/8,  27/8,  36/8,  39/8,  42/8,  43/8,
49/8,  58/8,  59/8,  60/8,  61/8, 101/8, 103/8,
   106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8,
   116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8,
   123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8,
   163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8,
   203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8,
   222/8, 223/8,

ARIN Region Analysis Summary


Prefixes being announced by ARIN Region ASes:208203
Total ARIN prefixes after maximum aggregation:99080
ARIN Deaggregation factor: 2.10
Prefixes being announced from the ARIN address blocks:   209083
Unique aggregates announced from the ARIN address blocks: 98841
ARIN Region origin ASes present in the Internet Routing Table:18167
ARIN Prefixes per ASN:11.51
AR

Level 3 Looking Glass Broken

[Gary T . Giesen via NANOG]

I'm seeing issues with Level 3's looking glass 
(https://lookingglass.level3.net) since they rolled out the new one with the 
CenturyLink branding. Any query results in "Invalid usage. POST variable not 
set.". Also, the radio buttons under the "Information Category" selection allow 
more than one selection (and no way of deselecting anything). I tried opening a 
ticket L3 under one of my transit circuits and was told that the NOC doesn't 
deal with it, and I should talk to our account team (as fun as that sounds, I'd 
rather stick my head in a blender).

Anyone on this list have any clout inside L3 to get this fixed?

Cheers,

GTG