The BGP Clock and the BGP Observatory: Hunting Stuck Routes​#

Kemal Sanjta — Cisco ThousandEyes

• Why: BGP zombies — routes that persist in RIBs long after withdrawal because a router lost the UPDATE — happen hundreds of times a day on the public Internet and quietly direct traffic onto dead or congested links. Prior work showed withdrawn-and-RPKI-invalid prefixes persisting for months; this is the follow-up operational tool, and it's free.
• What: The BGP Clock: a continuously running beacon that advertises a fresh prefix every 10 minutes and withdraws it, encoding time in the prefix itself (IPv6 2a0d:3dc1:NNNN::/48, N = 10-minute index since Jan 1, recycled yearly; IPv4 147.189.(216+N).0/24, N = hour mod 8, recycled every 8 hours — details retrievable via whois). Anyone can check their own RIBs for stale entries. On top of it, the Stuck Route Observatory: a free, no-login web tool where you search by AS and see whether stuck routes are present in your paths, plus a heuristic guess at whether the failure to propagate a withdrawal is yours or an upstream's. RFC 9687 is the new standards attempt at reducing impact — the presenters explicitly ask operators to request vendor support for it.
• How: Beacon advertise/withdraw cycles correlated against RIPE RIS, RouteViews, and Cisco's near-real-time monitors. Honest limitations: direct visibility covers ~1,500 ASNs (~1% of all), extended to >50% via customer-cone inference; IXP route servers can misattribute blame; intra-AS inconsistency (only some routers in a large AS holding the stuck route — found cases with just 5% of a Tier-1's downstreams seeing it) makes root-causing genuinely hard, with BMP named as the partial future fix.
• Where applicable: Universal — any operator can check their AS in the Observatory today and grep their RIBs for the clock prefixes tonight. The measurement-visibility limits mean absence of evidence isn't evidence of absence, but it's the best available Internet-scale stuck-route diagnostic.