----- Original Message -----
From: "ML" <ml@kenweb.org>
Has anyone put in place a method to identify if one their BGP peers suddenly withdraws X% of their prefixes?
e.g I should expect ~420k prefixes in a "complete"[1] routing table from a transit peer today. If suddenly I'm only getting 390k prefixes I'd guess a major network was depeered or similiar.
If so how are people doing this? SNMP MIB, screen scrape?
Well, if I had to do it, I think I'd just point munin at the router, yes, using SNMP, and put the prefix count graph up on the Big Wall, as a filled curve. That thing jumps around, someone will likely notice. This assumes a staffed NOC, of course, but it still gives you something to look at historically if you note a problem in an unstaffed situation as well. Cheers, -- jra -- Jay R. Ashworth Baylink jra@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274