search

pavel-odintsov / fastnetmon

FastNetMon - very fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
https://fastnetmon.com
GNU General Public License v2.0
3.38k stars 560 forks source link

Read networks list from BGP #430

Open pavel-odintsov opened 8 years ago

pavel-odintsov commented 8 years ago

We could learn announced routes with GoBGP:

gobgp global rib add 10.33.0.0/24 -a ipv4

/opt/gobgp_1_0_0/gobgp global rib 
    Network             Next Hop             AS_PATH              Age        Attrs
*>  10.33.0.0/24        0.0.0.0                                   00:00:00   [{Origin: i}]
N*> xxx/24    10.0.6.1                                  00:05:17   [{Origin: i} {LocalPref: 100}]
N*> xxx/24    10.0.6.1                                  00:05:17   [{Origin: i} {LocalPref: 100}]
N*> xxx/24    10.0.6.1                                  00:05:17   [{Origin: i} {LocalPref: 100}]
N*> ccccc/24    10.0.6.1                                  00:05:17   [{Origin: i} {LocalPref: 100}]
pavel-odintsov commented 7 years ago

With ExaBGP it's very-very complicated task. GoBGP could do it.

pavel-odintsov commented 4 months ago

This logic is available in FastNetMon Advanced: https://fastnetmon.com/docs-fnm-advanced/subnet-collection-from-bgp-peering-session/