Internet2 Network Security SIG

[David Farmer <>]

On Tue, Feb 5, 2019 at 2:50 PM Dale W. Carder <> wrote:

Thus spake Adair Thaxton () on Tue, Feb 05, 2019 at 06:41:08PM +0000:
> Happy February!  You have nine days to make dinner reservations and get your person a gift, if you're into that sort of thing.
>
> BGPMon has announced an End-of-Life date of March 20, 2020.  Many of our members have reported using this service.  It is supposed to be being replaced by Cisco Crosswork.  More information is here: https://bgpmon.net/wp-content/uploads/2019/01/BGPMon.net-EOL-EOS-faq.pdf

Has anyone played with Ciada's bgpstream?  I got bored during lunch
and made an example.  I'd be curious if anyone else wants to give it a
shot with their data.

Dale

Thanks for the code snippet.  

In looking at alternatives I also found ARTEMIS which uses BGP-stream, RIPE-RIS, and local exaBGP, I'm not sure its status. 

https://labs.ripe.net/Members/vasileios_kotronis/artemis-neutralising-bgp-hijacking-within-a-minute

As a paying BGPmon customer we are entitled to a free demo of Crosswork Network Insight, but the list price we got is more than 10X what we are currently paying for BGPmon.  So without a good discount of 75 to 90%, let's say, and several new valuable features I doubt the value proposition will work.  

 

#!/usr/bin/env python

import time
import pytricia
from _pybgpstream import BGPStream, BGPRecord, BGPElem

esnet_v6 = pytricia.PyTricia(128)
# format {'prefix' = 'orgin_asn'}
esnet_v6['2001:400::/32'] = '293'

stream = BGPStream()
rec = BGPRecord()

stream.add_filter('record-type', 'updates')
stream.add_interval_filter(int(time.time()),0)
stream.set_live_mode()
stream.start()

while(stream.get_next_record(rec)):
    if rec.status == 'valid':
        elem = rec.get_next_elem()
        while(elem):
            if 'as-path' in elem.fields:
                path = elem.fields['as-path'].split()
                prefix = elem.fields['prefix']
                if prefix in esnet_v6 and esnet_v6[prefix] != path[-1]:
                    print('prefix:', elem.fields['prefix'], 'AS-PATH:', elem.fields['as-path'], 'Project:', rec.project, 'collector:', rec.collector, 'type:', rec.type, 'time:', rec.time, 'status:', rec.status, 'Type:', elem.type, 'Peer:', elem.peer_address, 'AS', elem.peer_asn)

            elem = rec.get_next_elem()

--

===============================================
David Farmer              
Networking & Telecommunication Services
Office of Information Technology
University of Minnesota  
2218 University Ave SE        Phone: 612-626-0815
Minneapolis, MN 55414-3029   Cell: 612-812-9952
===============================================