nanog mailing list archives
Re: Clue's for Clue-less
From: Richard Irving <rirving () onecall net>
Date: Tue, 27 Oct 1998 23:02:20 -0500
Sharif Torpis wrote:
this must be an 11.2 thing?
Unknown... Have you ever met an 11.1.xx technician *not* wearing synthetics to test it ? :)
Richard Irving wrote:It is built into IOS.... As you approach the ceiling, it sends out an SNMP log alert. Now, how I select the number is confidential.... Ok. I will give you a hint.... I bring up the original sessions, and confirm integrity... Then I look at the routes, size and count. Then in the dark of the moon, wearing *no* synthetics, facing *magnetic* north... I devine the target number. In other words... It is a judgement call... Downstreams are easier. They must file routes with me, before I route them. I filter to the prefix. Consider this merely another fall back mechanism to the general IOPS model. Sharif Torpis wrote:can u elaborate on the detection mechanism for setting off such alarms? do u look at % change in total routes in core of internet? e.g. sunday saw a change of 55k -> 60k which is ~10% change ... or do u look at specific blocks that should not be deaggregated and catch them if they are deaggregated ... thanks Richard Irving wrote:The only neighbors I lost on this one, dumped something they shouldn't..... If someone de-aggregates a /16, it fires off alarms.... Although these may be valid advertisements, We have opted for the "safe, rather than sorry" perspective. (Besides, the alarms *assure* prompt attention) PS: 11.2.xx and higher have this command...
Current thread:
- Clue's for Clue-less Richard Irving (Oct 26)
- <Possible follow-ups>
- RE: Clue's for Clue-less Martin, Christian (Oct 26)
- Re: Clue's for Clue-less Richard Irving (Oct 26)
- Message not available
- Message not available
- Message not available
- Re: Clue's for Clue-less Richard Irving (Oct 27)
- Re: Clue's for Clue-less Richard Irving (Oct 26)
- Re: Clue's for Clue-less Richard Irving (Oct 26)
- Re: Clue's for Clue-less Jim Jagielski (Oct 27)