[117204] in North American Network Operators' Group

home help back first fref pref prev next nref lref last post

Re: Route table prefix monitoring

daemon@ATHENA.MIT.EDU (Andree Toonk)
Fri Sep 4 17:27:53 2009

Date: Fri, 4 Sep 2009 23:26:42 +0200
From: Andree Toonk <andree+nanog@toonk.nl>
To: "Olsen, Jason" <jolsen@devry.com>
In-Reply-To: <19A6566FA5D52A44B7F7027F7E88BEE7DF65FD@OBT-W-EVS3P.dvuadmin.net>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org

Hi Jason, 

.-- My secret spy satellite informs me that at Fri, 04 Sep 2009, Olsen, Jason wrote:

> What I'm left thinking is that it would have been great if we'd had a
> snapshot of our core routing table as it stood hours or even days prior
> to this event occurring, so that I could compare it with our current
> "broken" state, so the team could have seen that subnet in the core
> table and what the next hop was for the prefix.  Are there any tools
> that people are using to track when/what prefixes are added/withdrawn
> from their routing tables, or to pull the routing table as a whole at
> regular intervals for storage/comparison purposes?  

As already mentioned BGPmon.net can probably do what you're looking for. 
It will sent you a notification in cases of interesting path changes, possible hijacks, 
new adjacencies and new prefixes.  It will also notify you when 'many' peers see a
withdrawal of your prefix. This last feature might be useful for you.

I'm currently also testing a new feature that basically compares yesterday's routing 
table with todays table. If there are any 'interesting' changes they will be emailed to you.
You can think of this as a rancid for routing tables changes. 
I can include you in testing if you want to.

All of this does assume that your prefixes are globally visible though.

Cheers,
 Andree


home help back first fref pref prev next nref lref last post