search

nttgin / BGPalerter

BGP and RPKI monitoring tool. Pre-configured for real-time detection of visibility loss, RPKI invalid announcements, hijacks, ROA misconfiguration, and more.
BSD 3-Clause "New" or "Revised" License
811 stars 144 forks source link

Include RRC identifiers when detecting withdrawals #59

Closed appliedprivacy closed 2 years ago

appliedprivacy commented 4 years ago

Currently a withdrawn log entry look like this:

The prefix 2a03:e600:100::/48 (ipv6) has been withdrawn. It is no longer visible from 12 peers.

It does not include any information about where the withdrawals have been observed.

It would be useful for diagnostics to include that information. It could look something like that:

The prefix 2a03:e600:100::/48 (ipv6) has been withdrawn. It is no longer visible from 12 peers: RRCXX (9), RRCYY (3)

massimocandela commented 4 years ago

Are you interested in the RRCs or more in the location of the peers? Such us NL (3) IT (2)

appliedprivacy commented 4 years ago

I find RRC IDs more useful since there are multiple RRCs in a country and so the RRC ID is more granular.

massimocandela commented 4 years ago

The correlation between location of the RRC and the location of the peer is weak. Some RRCs (for sure RRC0, the one producing more data) are multihop. Additionally, not everybody is familiar with the RRC concept, which is RIS specific (and not valid for other data sources).

I'll think what to do. Maybe we can add more information in the email reporting.

In the meanwhile, such information is anyway available in the data object of the alert (e.g. you can connect it to Kafka and get all the single BGP updates).

stale[bot] commented 4 years ago

This issue has been automatically closed as stale. This mechanism helps to prioritize feature requests which received more support from the community. If you want to open again this issue you have to provide a Pull Request.

massimocandela commented 4 years ago

I re-open this. I am working on a "similar" solution.

stale[bot] commented 2 years ago

This issue has been automatically closed as stale. This mechanism helps to prioritize feature requests which received more support from the community. If you want to open again this issue you have to provide a Pull Request.