-----Original Message----- From: Christopher Morrow [mailto:morrowc.lists@gmail.com] Sent: Friday, September 04, 2009 5:07 PM To: Paul Ferguson Cc: nanog@nanog.org Subject: Re: Route table prefix monitoring
On Fri, Sep 4, 2009 at 4:59 PM, Paul Ferguson<fergdawgster@gmail.com> wrote:
On Fri, Sep 4, 2009 at 1:48 PM, Matthew Walster<matthew@walster.org> wrote:
2009/9/4 Olsen, Jason <jolsen@devry.com>:
Are there any tools that people are using to track when/what prefixes are added/withdrawn from their routing tables,
Could you use something like BGPMon?
There's also:
I think the OP wanted something for 'internal route monitoring' ... since he's from DeVry I suspect it's to monitor things on DeVry's internal WAN which probably don't show in the global table.
That said, you COULD have rancid (or abuse rancid) pull rib-dumps each 'period' and index those into something that alerted on large diff's (or alerted if some critical bits were missing). Or have a quagga box peer with some number of internal devices, log update messages, alert on withdrawal of critical bits.
-chris (I don't know of any COTS tools that do this, sorry)
Tools such as Arbor Peakflow SP have a lot of cool traffic and routing analysis bits for internal monitoring of this sort, but it might be a bit out of your price range. Having said that, I second Chris's approach above utilizing some quagga box/low-end router (make sure you have enough memory!) and simply reflect routes from your production routers in conjunction with update message logging. If you're looking for tools that perform analysis from an exterior point-of-view, there is also BGPlay which has some cool widgetry to see particular prefixes within a user-specific time interval. Again it's using the operators route-servers so might not be of much value to you http://bgplay.routeviews.org/bgplay/ Stefan Fouant Neustar, Inc. / Principal Engineer 46000 Center Oak Plaza Sterling, VA 20166 Office: +1.571.434.5656 ▫ Mobile: +1.202.210.2075 ▫ GPG ID: 0xB5E3803D ▫ stefan.fouant@neustar.biz