11.1-20CC also has this feature. -Chris

-----Original Message----- From: Richard Irving [mailto:rirving@onecall.net] Sent: Tuesday, October 27, 1998 11:02 PM To: Sharif Torpis; nanog@merit.edu Subject: Re: Clue's for Clue-less

Sharif Torpis wrote:

...

this must be an 11.2 thing?

Unknown... Have you ever met an 11.1.xx technician *not* wearing synthetics to test it ?

:)

...

Richard Irving wrote:

...

It is built into IOS.... As you approach the ceiling, it

sends out an

...

SNMP log alert.

Now, how I select the number is confidential....

Ok. I will give you a hint.... I bring up the original sessions, and confirm integrity...

Then I look at the routes, size and count.

Then in the dark of the moon, wearing *no* synthetics, facing *magnetic* north... I devine the target number.

In other words... It is a judgement call...

Downstreams are easier. They must file routes with me, before I route them. I filter to the prefix.

Consider this merely another fall back mechanism to the general IOPS model.

Sharif Torpis wrote:

...

can u elaborate on the detection mechanism for setting off such alarms? do u look at % change in total routes in core

of internet?

...

e.g. sunday saw a change of 55k -> 60k which is ~10% change ... or do u look at specific blocks that should not be deaggregated and catch them if they are deaggregated ... thanks

Richard Irving wrote:

...

The only neighbors I lost on this one, dumped something they shouldn't..... If someone de-aggregates a /16, it fires off alarms.... Although these may be valid

advertisements,

...

We have opted for the "safe, rather than sorry" perspective. (Besides, the alarms *assure* prompt attention)

PS: 11.2.xx and higher have this command...