Re: BGPMON Alert Questions

[Mingwei Zhang <danielzhang0212 () gmail com>]

route-views4 /64.25.208.71 has seen updates that contains large amount of
prefixes at time 1396464452 (04 / 02 / 14 @ 6:47:32pm UTC) with path
[20225, 6939, 4761]

full prefixes list: http://pastebin.com/Eu4ePgp4

is it normal for single update to contain such large amount NLRI info?


On Wed, Apr 2, 2014 at 12:08 PM, Octavio Alvarez
<alvarezp () alvarezp ods org>wrote:

> On 02/04/14 11:51, Joseph Jenkins wrote:
> > So I setup BGPMON for my prefixes and got an alert about someone in
> > Thailand announcing my prefix.  Everything looks fine to me and I've
> > checked a bunch of different Looking Glasses and everything announcing
> > correctly.
> >
> > I am assuming I should be contacting the provider about their
> > misconfiguration and announcing my prefixes and get them to fix it.  Any
> > other recommendations?
> >
> > Is there a way I can verify what they are announcing just to make sure
> they
> > are still doing it?
> >
> > Here is the alert for reference:
> >
> > Your prefix:          8.37.93.0/24:
> >
> > Update time:          2014-04-02 18:26 (UTC)
> >
> > Detected by #peers:   2
> >
> > Detected prefix:      8.37.93.0/24
> >
> > Announced by:         AS4761 (INDOSAT-INP-AP INDOSAT Internet Network
> > Provider,ID)
> >
> > Upstream AS:          AS4651 (THAI-GATEWAY The Communications Authority
> of
> > Thailand(CAT),TH)
> >
> > ASpath:               18356 9931 4651 4761
>
> Same here. I got an alert for two prefixes. Same origin AS, same AS path
> for one of them: 18356 9931 4651 4761, but a different one for the
> other: 18356 38794 4651 4761.