Subject: [GROW] MRT

From: Robert Raszuk <[email-masked]>
Date: Tue, 27 Nov 2012 17:17:49 +0100

Hello,

Does anyone (in particular cc-ed authors) recall what is the status,
planned update, planned progress to RFC of this document:

http://tools.ietf.org/id/draft-ietf-grow-mrt-04.txt

Thx,
R.

---

From: PFRC - jhaas <[email-masked]>
Date: Tue, 27 Nov 2012 11:26:20 -0500

http://tools.ietf.org/html/rfc6396

On Nov 27, 2012, at 11:17 AM, Robert Raszuk <[email-masked]> wrote:

> _______________________________________________
> GROW mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/grow

---

From: Larry Blunk <[email-masked]>
Date: Tue, 27 Nov 2012 11:28:52 -0500

> http://tools.ietf.org/id/draft-ietf-grow-mrt-04.txt

  It's an RFC now --

  Unfortunately, section 4.3.4 does not match the
current Quagga/libbgpdump implementations.  The RFC
says to omit the AFI/SAFI/NLRI fields in the MP_REACH_NLRI
attribute (since that info is already in the MRT
RIB Entry Header), but the current implementations
simply copy the attribute as-is in the RIB Entry
field.

  Regards,
   Larry Blunk

---

From: Robert Raszuk <[email-masked]>
Date: Tue, 27 Nov 2012 17:29:11 +0100

Thx ! Just found that it went up to version -17 then became RFC.

Many thx,
R.

---

From: Robert Raszuk <[email-masked]>
Date: Tue, 27 Nov 2012 17:33:44 +0100

Thx Larry !

Any pointer to best MRT opensource tools repository for parsing the
messages and maybe even performing some analysis on them (in
particular related to BGP) ?

Rgs,
R.

---

From: Mattia Rossi <[email-masked]>
Date: Tue, 27 Nov 2012 17:43:28 +0100

There are tools in here: http://caia.swin.edu.au/urp/bgp/tools.html 
which you might find useful, and work (or at least worked) with Quagga 
dump files. In particular the MDFMT and the Path Exploration Analyzer. 
The PEA might give you some ideas on how to use libbgpdump for analysis, 
while the MDFMT is based on pybgpdump 
(http://jon.oberheide.org/projects/pybgpdump/) which is very nice for a 
quick analysis of MRT dumps.

Hope you haven't already discarded them :-)

Mat

---

From: Larry Blunk <[email-masked]>
Date: Tue, 27 Nov 2012 11:45:00 -0500

libbgpdump is available at http://www.ris.ripe.net/source/ and
contains the bgpdump tool which will read and process the table dump
and update files in the Routeviews and RIPE RIS archives.

  -Larry

---

From: Robert Raszuk <[email-masked]>
Date: Tue, 27 Nov 2012 17:52:09 +0100

Thx again both Larry and Mattia,

Actually I am more looking for parsing MRT BGP4MP_MESSAGE containing
bunch of raw UPDATE messages from peers rather then table dumps.

However libbgpdump seems like a good starting point ... if for nothing
else then for parsing common message headers.

Many thx,
R.

---

From: Larry Blunk <[email-masked]>
Date: Tue, 27 Nov 2012 12:32:00 -0500

libbgpdump supports both the BGP4MP_MESSAGE UPDATE message MRT type
  and the TABLE_DUMP/TABLE_DUMP_V2 table dump types.

  -Larry

---

From: Christopher Morrow <[email-masked]>
Date: Tue, 27 Nov 2012 12:58:29 -0500

> quick analysis of MRT dumps.

sadly jon's tool is ... not very well updated :( or gives me lots and
LOTS of error messages on reading current routeviews/ris update
streams :(

(noting i know this from attempting to parse those update files around
the time of the moratel leak of google ip space ~2 wks ago).

---

From: Jared Mauch <[email-masked]>
Date: Tue, 27 Nov 2012 13:20:58 -0500

On Nov 27, 2012, at 12:58 PM, Christopher Morrow wrote:

> the time of the moratel leak of google ip space ~2 wks ago).'

The MRT file parser I sent you should work.

- Jared

---

From: Christopher Morrow <[email-masked]>
Date: Tue, 27 Nov 2012 13:41:16 -0500

> The MRT file parser I sent you should work.

yes, no :( or it didn't work at the time, perhaps I was being
ham-fisted... in the end there was an internal tool that worked well
enough for my purposes.

---

From: Arturo Servin <[email-masked]>
Date: Wed, 28 Nov 2012 10:01:10 -0200

Chris,

	The problem that I had is that it pybgpdum requires dpkt and it did not
support 4 byte ASN and you need a hack.

	Not sure if that is was problem as well. If it were, let me know and I
will try to remember what I did to make it work but I think this is the
place with the answer:

http://caia.swin.edu.au/urp/bgp/tools.html

regards,
as

---

From: Pedro Torres <[email-masked]>
Date: Wed, 28 Nov 2012 10:39:52 -0200

Hello,

Yes, libbgpdump is a really great tool. We are using it with success.
The lib is fast and simple.
Unfortunately the source code still use some defines that not follow
RFC-6396, example: BGPDUMP_TYPE_ZEBRA_BGP instead BGP4MP.

https://bitbucket.org/ripencc/bgpdump/wiki/Home
They say: "This format is described in the Internet Draft grow-mrt-13."

According to what they says the lib follow a draft. I don't think it's
a big problem because no big changes was done since MRT draft 13 until
RFC-6396 but could be a good idea to update the documentation and
nomenclatures. The same should be done with Quagga bgpd daemon.

--
Pedro

---

From: Pedro Andres Aranda Gutierrez <[email-masked]>
Date: Wed, 28 Nov 2012 18:47:02 +0100

I had to write my own MRT parser library for my PhD. After my defense
next January, I plan to release it. (one step at a time, I'm quite
busy right now preparing the defense ;-) ) It's written in Java. Re:
pybgpdump, I have to agree it's a very nice tool once you patch dpkt
:-) re libbgpdump, it compiles, it helped me kick-start my research,
but that's it.

My .02 cents,

/Pedro A. Aranda

---

From: Christopher Morrow <[email-masked]>
Date: Wed, 28 Nov 2012 13:41:37 -0500

> pybgpdump, I have to agree it's a very nice tool once you patch dpkt

how about we send the diff to dug and have him patch dpkt? :)

---

From: Claudio Jeker <[email-masked]>
Date: Thu, 29 Nov 2012 07:42:00 +0100

> :-) re libbgpdump, it compiles, it helped me kick-start my research,

OpenBGPD has a mrt parser in bgpctl. It is mainly for table dumps but
the basic framework for dumping bgp messages there. I have a diff that 
uses the tcpdump BGP protocol parser to dump those messages. If interested
just drop me a mail.

-- 
:wq Claudio

---

From: Mattia Rossi <[email-masked]>
Date: Thu, 29 Nov 2012 09:00:45 +0100

> http://caia.swin.edu.au/urp/bgp/tools.html
Yes, the 4 Byte AS patch is part of the MDFMT. I would have hoped that 
by now somebody would have included it in dpkt, but it seems it didn't 
happen. The patch includes support for TABLE_DUMP_V2 as well, which is 
also not in dpkt by default.
Dpkt still has an issue with certain RIPE MRT dumps, as some of the 
BGP4MP messages in there contain more entries than a Python String can 
handle, and thus dpkt will crash. (Dpkt will try to read the whole 
BGP4MP message in one go into a Python String).

Cheers,

Mat

---

From: Mattia Rossi <[email-masked]>
Date: Thu, 29 Nov 2012 09:09:05 +0100

> how about we send the diff to dug and have him patch dpkt? :)

I've sent the patch to Jon a few years ago, he asked me to create the 
Unit tests as well, to sanity check it, I didn't find the time then. 
Before I could get back on that, I've been approached by someone in NZ 
about a year ago, who offered to do all the necessary cleanup and unit 
tests, contact Jon or Dug, and get the patch committed, but I wasn't 
able to follow up on that any more for personal reasons. Given that 
there's a great interest in that again, I'll try to find some time to 
see what's happening there.

Cheers,

Mat

---

From: Christopher Morrow <[email-masked]>
Date: Thu, 29 Nov 2012 09:55:33 -0500

On Thu, Nov 29, 2012 at 3:09 AM, Mattia Rossi
<[email-masked]> wrote:
> I've sent the patch to Jon a few years ago, he asked me to create the Unit
> tests as well, to sanity check it, I didn't find the time then. Before I
> could get back on that, I've been approached by someone in NZ about a year
> ago, who offered to do all the necessary cleanup and unit tests, contact Jon
> or Dug, and get the patch committed, but I wasn't able to follow up on that
> any more for personal reasons. Given that there's a great interest in that
> again, I'll try to find some time to see what's happening there.

happy to attempt helping you with this... if you'd like.
(no guarantees to quality or time available, but I can take a shot as
well if that'd help)

-chris