[20803] in North American Network Operators' Group
Re: Clue's for Clue-less
daemon@ATHENA.MIT.EDU (Richard Irving)
Tue Oct 27 23:20:22 1998
Date: Tue, 27 Oct 1998 23:02:20 -0500
From: Richard Irving <rirving@onecall.net>
Reply-To: rirving@onecall.net
To: Sharif Torpis <faust@grift.com>, nanog@merit.edu
Sharif Torpis wrote:
>
> this must be an 11.2 thing?
>
Unknown...
Have you ever met an 11.1.xx technician *not*
wearing synthetics to test it ?
:)
> Richard Irving wrote:
> >
> > It is built into IOS.... As you approach the ceiling, it sends out an
> > SNMP log alert.
> >
> > Now, how I select the number is confidential....
> >
> > Ok. I will give you a hint.... I bring up the original sessions,
> > and confirm integrity...
> >
> > Then I look at the routes, size and count.
> >
> > Then in the dark of the moon, wearing *no* synthetics,
> > facing *magnetic* north... I devine the target number.
> >
> > In other words... It is a judgement call...
> >
> > Downstreams are easier. They must file routes with me, before I route
> > them. I filter to the prefix.
> >
> > Consider this merely another fall back mechanism to the general IOPS
> > model.
> >
> > Sharif Torpis wrote:
> > >
> > > can u elaborate on the detection mechanism for setting off such
> > > alarms? do u look at % change in total routes in core of internet?
> > > e.g. sunday saw a change of 55k -> 60k which is ~10% change ... or do
> > > u look at specific blocks that should not be deaggregated and catch
> > > them if they are deaggregated ... thanks
> > >
> > > Richard Irving wrote:
> > > >
> > > > The only neighbors I lost on this one, dumped something
> > > > they shouldn't..... If someone de-aggregates a /16,
> > > > it fires off alarms.... Although these may be valid advertisements,
> > > > We have opted for the "safe, rather than sorry" perspective.
> > > > (Besides, the alarms *assure* prompt attention)
> > > >
> > > > PS: 11.2.xx and higher have this command...
