[AusNOG] What are people doing for monitoring BGP?

[Nathan Phelan]

Hi Paul,
You could use https://www.whatsmydns.net to check DNS is globally reachable.
Or maybe it's an anti-spam issue.
You could also try http://www.senderbase.org/ to check spam block lists for your prefixes.
http://mxtoolbox.com/ also has some handy tools.
Cheers,
Nathan

From: AusNOG [mailto:ausnog-bounces at lists.ausnog.net] On Behalf Of Paul Gear
Sent: Tuesday, 4 February 2014 11:30 PM
To: ausnog at lists.ausnog.net
Subject: Re: [AusNOG] What are people doing for monitoring BGP?

A quick update on this: I emailed BGPmon and got a bounce message saying that our domain does not exist.  Our DNS servers are hosted on addresses within our AS, so that makes perfect sense if there's a reachability issue.

I've double-checked that the correct routes are advertised to all our peers and confirmed this on several route-views servers.  (See the pastebin below.)

Any suggestions on how to troubleshoot this further?

Thanks in advance,
Paul

On 01/29/2014 01:09 PM, Nathan Phelan wrote:
Hi Paul,
I've noticed the same thing; alerts for prefixes being withdrawn but nothing when they come back. In our account the alerts do change status to "Cleared" once the prefix has been advertised again. Please let me know what BGPmon's response is (if you get one).
Cheers,
Nathan

From: AusNOG [mailto:ausnog-bounces at lists.ausnog.net] On Behalf Of Paul Gear
Sent: Wednesday, 29 January 2014 9:00 AM
To: ausnog at lists.ausnog.net<mailto:ausnog at lists.ausnog.net>
Subject: Re: [AusNOG] What are people doing for monitoring BGP?

Hi Ross/Nathan,

These aren't new prefixes advertised from an AS, they're existing prefixes being withdrawn and then returning later.  I get an alert email each time a prefix disappears, but no end of alert email when it comes back.

I also get alerts quite a lot about other parts of the world (esp. Brazil, North America, and Northern Europe) not being able to see our prefixes, even though they're advertised to our providers and visible domestically.  e.g. Here's our AS viewed from 3 route-views servers as of yesterday:

  *   http://paste.debian.net/hidden/524ca085/
http://bgp.he.net/AS132897 shows it fine as well.  Yet, there are presently 3 active alerts for prefix 103.27.153.0/24 in my BGPmon account, one going back to 20 December.

I probably should contact BGPmon about these rather than whining to you guys about it.  ;-)     Writing email now...

Regards,
Paul

On 01/29/2014 07:29 AM, Ross [Eve IT] wrote:
Nathan is correct, works that way for us too.

On Tue, Jan 28, 2014 at 11:55 AM, Nathan Brookfield <Nathan.Brookfield at simtronic.com.au<mailto:Nathan.Brookfield at simtronic.com.au>> wrote:
Paul that's strange as it absolutely can/does notify when a new prefix is advertised from your ASN or if you have it set to be monitored, it will also alert for more specific prefixes and other similar alerts.

From: AusNOG [mailto:ausnog-bounces at lists.ausnog.net<mailto:ausnog-bounces at lists.ausnog.net>] On Behalf Of Paul Gear
Sent: Tuesday, 28 January 2014 11:53 AM
To: ausnog at lists.ausnog.net<mailto:ausnog at lists.ausnog.net>
Subject: Re: [AusNOG] What are people doing for monitoring BGP?

On 01/28/2014 09:01 AM, Nathan Brookfield wrote:
+1 for BGPMon - There tools are very good for monitoring stability, spoofing, prefix hijacking etc.

We also operate an Australian monitoring station as do a few other providers I believe.

Very accurate and very reliable.

I've been trialling BGPmon over the last few months as well.  One of the things I don't like about it is that it emails you when a prefix is withdrawn, but doesn't alert you when it comes back.

Otherwise, it seems to do the job.

Paul

_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net<mailto:AusNOG at lists.ausnog.net>
http://lists.ausnog.net/mailman/listinfo/ausnog


--
Regards,
Ross Tsolakidis
IT Architect

Eve IT Pty Ltd
http://www.eve-it.net<http://www.eve-it.com.au/>
1300 65 77 75





_______________________________________________

AusNOG mailing list

AusNOG at lists.ausnog.net<mailto:AusNOG at lists.ausnog.net>

http://lists.ausnog.net/mailman/listinfo/ausnog





_______________________________________________

AusNOG mailing list

AusNOG at lists.ausnog.net<mailto:AusNOG at lists.ausnog.net>

http://lists.ausnog.net/mailman/listinfo/ausnog

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20140205/85b50f2f/attachment.html>