Internet2 Network Security SIG

[David Farmer <>]

On Tue, Feb 5, 2019 at 3:05 PM Adair Thaxton <> wrote:

There have been a few messages on the netgurus list (which I missed, sadly - hadn't subscribed with my Internet2 email), but everyone else seems similarly frustrated with seeking out options.  Haven't found any easy answers yet.

FYI, for the record here are the two threads that came from my original message on net-gurus;

Hope that helps.

On Tue, Feb 5, 2019 at 8:29 AM Andrew Gallo <> wrote:

I was disappointed to hear this.  There was Cyclops from UCLA that 
provided a similar service, but that's be shutdown for a while.  This is 
particularly disappointing as we see an uptick in interesting for 
routing security.
I'm guessing these services are hard to monetize.
There are a number of projects that collect route tables (RouteViews, 
Isolario), but the analysis and alerting is the missing piece.
Realistically, not sure about replacements.  What about Thousand Eyes?  
I haven't taken a look in detail at what they offer.
Idealistically, can this be done cooperatively, maybe on an existing 
platform like RIPE's Atlas?  Maybe a distributed model like NLNOGRing?  
Conceptually, this is an easy problem, but I wonder if its too 
complicated to be run as a distributed or cooperative service.


On 2/4/2019 5:48 PM, David Farmer wrote:
> Cisco is going to end of life (EOL) BGPmon
>
> FAQ;
> https://bgpmon.net/wp-content/uploads/2019/01/BGPMon.net-EOL-EOS-faq.pdf
>
> Datasheet for Cisco's replacement, Cisco Crosswork Network Insights;
> https://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/crosswork-network-automation/datasheet-c78-740228.html
>
> We asked our Cisco rep for a quote and the list price is more than 10X what
> we pay annually for BGPmon, it looks like it provides some more info, but
> not sure it worth 10X.  We are waiting to hear what kind of discount they
> will give us, but unless it is 80 or 90% I don't see us going
> with Crosswork Network Insights.
>
> Does anyone have another replacement for BGPmon?
>
> What are others thinking?
>
> Thanks
>
-- 
________________________________
Andrew Gallo
The George Washington University

------

On Mon, Feb 4, 2019 at 9:03 PM Josh Sakofsky <> wrote:

Ah, correct, I had expected a bit more work on this front:

https://www.snas.io/news/bgpalerts/

But it appears that's stalled.

Thanks for the info!

On Mon, Feb 4, 2019, 9:26 PM John Kristoff < wrote:

On Tue, 5 Feb 2019 00:42:50 +0000
Josh Sakofsky <> wrote:

> I know people are excited about this, myself included, but I haven't
> gotten a chance to investigate it yet. Feedback I've heard is very
> good though: https://urldefense.proofpoint.com/v2/url?u=https-3A__www.snas.io&d=DwICAg&c=slrrB7dE8n7gBJbeO0g-IQ&r=GU3ER7E3aqUnri7mGrdviw&m=6JWH5RgAljkCmxa60dk1d6L_WjyjYdVlwte4T5Prk2M&s=pjAeBU302zniXzMBRcMdp1aBy-5kZCETfPT_d14PoAs&e=

This is not a BGPmon replacement.  At least I don't believe they have a
service that will monitor your prefix announcements for you.  It is
software that will do all sorts of routing analysize given the data you
provide.  The main use is for injecting BMP and turning into insight
and data to explore in a nice GUI.  I tried playing around with it, but
it is pretty demanding (CPU, RAM and disk) for serious setups.  It is
also pretty heavy in terms of all the pieces to get it up and running.

It might be reasonable to build something reasonably suitable for the
community based on BGPstream.  I'm not sure there is a lot of money it,
but if I could find the time I'd do this myself.  That probably won't
happen until at least the summer and even then I'm not sure I can
commit to it.

John

--

===============================================
David Farmer              
Networking & Telecommunication Services
Office of Information Technology
University of Minnesota  
2218 University Ave SE        Phone: 612-626-0815
Minneapolis, MN 55414-3029   Cell: 612-812-9952
===============================================