Blog

Routing diff report, Rancid for BGP

Posted by Andree Toonk - January 12, 2010 - BGPmon.net, IPv6
3

Just like many you, I use rancid to track changes in configurations of our routers and switches. This week BGPmon.net released a new feature called ‘routing report’, you can think of this as a Rancid for your BGP routing table. Every day BGPmon compares the announcements by your ASN with those of the day before. […]

Read More

Programming with the BGPmon.net Web Services API

Posted by Andree Toonk - December 15, 2009 - BGPmon.net
4

Lately I have received quite some questions with regard to connecting BGPmon.net with existing monitoring software. As well as requests for making more data available for developers. I’m happy to announce that these things should now be possible trough the BGPmon.net Web Services API. This  API  allows you to access your BGPmon.net alert as well […]

Read More

New hardware for BGPmon.net server

Posted by Andree Toonk - November 26, 2009 - BGPmon.net
0

Last week I finally received a new CPU for the BGPmon.net server. This new quad core 2.66GHz CPU replaces a 1.8GHz single core CPU. This upgrades follows the memory upgrade from a few weeks ago when memory was upgraded from 2GB to 8GB. Over the course of this week I saw significant improvement in execution […]

Read More

The Vatican taking the lead in IPv6 rollout?

Posted by Andree Toonk - October 26, 2009 - IPv6
6

IPv6 deployment statistics. Which country is leading in the deployment of IPv6. We tried to answer that question by looking at the BGP tables.

Read More

BGP leak in Italy

Posted by Andree Toonk - October 10, 2009 - Hijack
0

Friday morning around 07:22:08 UTC AS9035 (Wind Telecomunicazioni) started to announce approximately 85.000 prefixes with an invalid origin AS. The origin AS was set to AS9035 while these prefixes did not belong to AS9035. The impact was local to a number of Italian providers, all Telecom Italia customers. The incident was resolved in about ~2 […]

Read More

Does the United States Department of Defense (DoD) Monitor their prefixes?

Posted by Andree Toonk - September 9, 2009 - Uncategorized
1

Ok, ok… It happens all the time, people leaking private ASN’s. But this one caught my attention. It seems that the US Department of defense (DoD) is leaking a private ASN  65401 for their prefixes 140.21.18.0/23 and 140.21.15.0/24. These prefixes are normally announced by AS5802 but now appear to be originating from the private AS […]

Read More

New summer release of BGPmon.net

Posted by Andree Toonk - August 30, 2009 - BGPmon.net
1

I’m happy to announce that this week a I released the new version of BGPmon.net into production. There are several new features that many of you have asked for. In addition there are some significant changes in the database backend. This is largely to improve the performance of the webinterface and some soon to be […]

Read More

New notification features

Posted by Andree Toonk - May 26, 2009 - BGPmon.net
2

The last few weeks I have been working on implementing some more notification options. A number of users have asked for sending out notification email to more than just one email address, as well as being able to send notifications to pagers. The latest release of BGPmon.net supports these features.  You can find the configuration […]

Read More

Did AS13214 really hijack the Internet?

Posted by Andree Toonk - May 11, 2009 - Hijack
1

This morning there was a discussion about a possible prefix hijack by AS13214 on the Nanog list. Cyclops users received a notification email notifying them that AS13214 was announcing their prefix.  I just went trough some of the raw data and this is what I found. It seems it was picked up by the route-views4 […]

Read More

New IPv6 deployment statistics

Posted by Andree Toonk - April 23, 2009 - IPv6
7

Did you ever wonder what the current status of IPv6 deployment is and which country is taking the lead?  A number of sites provide information about IPv6 deployment; each one uses a different way of measuring the usage. From traffics measurements, to the reach ability of popular websites over IPv6, to the growth of the […]

Read More

New version BGPmon.net

Posted by Andree Toonk - March 31, 2009 - BGPmon.net
0

Since NANOG45  I was filled with inspiration for new features in BGPmon.net. Many of you have sent me your feedback and whenever possible I implemented the smaller feature request and bug fixes. Today the newest version went live; this version contains some of bigger changes and improvements. In this Blog post I will go over […]

Read More

How accurate are the Internet Route Registries (IRR)

Posted by Andree Toonk - March 28, 2009 - BGPmon.net, IRR
12

Many service providers use an IRR to register their routes and to create BGP filters. These filters define what they will accept from customers or peers.  This is considered a good practice, as it will prevent accidental leaks. However, using an IRR to build your filters is only useful if the registries are complete. You […]

Read More

Long AS paths causing commotion

Posted by Andree Toonk - February 19, 2009 - BGP instability, BGPmon.net
3

Last Monday long AS paths caused quite some commotion. A good technical explanation can be found at the Renesys and arbornetworks blog

Read More

Back from Nanog45

Posted by Andree Toonk - February 9, 2009 - BGPmon.net, presentation
4

last week I came back from the Dominican republic where I visited the Nanog45 conference. It was quite an interesting conference with lots of interesting people. I enjoyed many of the presentations and I’m happy to see that the subject of BGP security and especially hijacks are receiving more and more attention from the operators […]

Read More

BGPmon at Nanog45

Posted by Andree Toonk - January 23, 2009 - BGPmon.net
0

Tomorrow I’ll be leaving for Nanog45 in Santo Domingo! It’s my first Nanog conference and I’m looking forward to it! I will also be presenting about BGPmon and Prefix Hijacking during the Hijacking and Tools BOF on Sunday. I look forward to meet others from the Nanog community and some of the BGPmon users!  See […]

Read More

Who is operating IPv6 tunnel services?

Posted by Andree Toonk - January 18, 2009 - BGPmon.net, IPv6
5

In order to migrate to IPv6 different methods are available, one of them is using IPv6 in IPv4 tunnels. These tunnels come in different flavors, static tunnel or dynamic tunnels. Dynamic tunneling protocols such as 6to4 and teredo use anycast technology. A number of organizations have employed 6to4 or teredo relays and it’s not always […]

Read More

BGPmon.net is looking for your feedback

Posted by Andree Toonk - January 7, 2009 - BGPmon.net
17

A few months ago BGPmon.net became available for all network operators looking for a tool to monitor there BGP announcements and prefixes. Now 3 month later I’m looking for feedback from you so that I can get a better understanding of how people are using this, what works and what doesn’t. Particularly I’m interested in: […]

Read More

BGPmon now has full IPv6 support!

Posted by Andree Toonk - November 25, 2008 - BGPmon.net, bogons, Hijack, IPv6
2

I am happy to announce that BGPmon now has full IPv6 support! This means that you can now monitor your IPv6 prefixes just as you are monitoring your IPv4 prefixes. All the codes, alarm messages etc are they same as for IPv4. It took a while because I had to write a few new libraries […]

Read More

Minimum peer threshold support

Posted by Andree Toonk - November 17, 2008 - BGPmon.net
2

Last week’s incident triggered a small thread about the different prefix hijack detection tools available  on the Nanog mailing list. The incident was also discussed on a number of blogs [1], [2], [3]. In general the reviews for BGPmon were very good! One suggestion for improvement though was support for a threshold before sending out […]

Read More

Prefix hijack by AS16735

Posted by Andree Toonk - November 11, 2008 - Hijack
9

Many BGPmon.net users received a notification email regarding a possible prefix hijack.   I just went over the data files manually and verified the leak. For those interested, let me share with you what I saw in the raw data. Between 01:55  UTC  and 02:15  267947 distinct prefixes were originated from AS16735 (Companhia de Telecomunicacoes […]

Read More

IPv6 bogons

Posted by Andree Toonk - November 2, 2008 - bogons, IPv6
2

BGPmon is gradually being extended with IPv6 support, the newest IPv6 feature is IPv6 bogon detection comparable to the already existing IPv4 bogon detection page. IPv6 bogons are defined as IPv6 prefixes which are not allocated by the RIRs.  All IPv6 bgp updates are compared to a list of known valid prefixes. If the update […]

Read More

How to monitor for the “non existence” of an AS in the ASpath

Posted by Andree Toonk - October 25, 2008 - BGPmon.net, regular expressions
0

How do I monitor the “non existence” of an AS in the ASpath Sometimes you have a prefix which is being announced from different AS’s and each of these have different upstream AS’s. Some of these are propagated all over the Internet and some of them are supposed to stay in a certain region or […]

Read More

monitoring for multiple origin AS’s

Posted by Andree Toonk - October 20, 2008 - BGPmon.net, regular expressions
0

The majority of the emails I receive with feedback and questions are things which can be solved with a regex. Today I would like to go over 1 common example: How do I monitor prefixes that originate from multiple origin AS’s Some people mailed me with a feature request for the ability to specify multiple […]

Read More

New version of BGP update analyzer active

Posted by Andree Toonk - October 19, 2008 - BGPmon.net
0

This is just a heads up, I just deployed a new version of the BGP update analyzer (back-end parser). It has some new functionality (mainly IPv6) related and some bug fixes. The bug fixes have are mainly regarding prefixes which are monitored by multiple users.  It will require some more time to make new IPv6 […]

Read More

Thanks for your feedback

Posted by Andree Toonk - October 17, 2008 - BGPmon.net
0

The last week I received a lot of feedback from many of you by email. This was very useful! I hope to implement your feature requests and solve those bugs as soon as possible. Many of them have been solved right away.  Many features requests were regarding the webinterface, especially the “my prefixes” page where […]

Read More