Skip to content

Real time Monitoring

Jump to bottom
Herve Hildenbrand edited this page Jan 20, 2026 · 1 revision

Real-time Monitoring

BGP Explorer can monitor for BGP anomalies in real-time using bgp-radar.

Prerequisites

Real-time monitoring requires bgp-radar to be installed:

# If you used install-deps, it's already installed
uv run bgp-explorer install-deps

# Or install manually (requires Go)
go install github.com/hervehildenbrand/bgp-radar/cmd/bgp-radar@latest

Starting Monitoring

Via Chat Command

> /monitor start
BGP Monitoring Started
Now watching for anomalies from collectors: rrc00
Events (hijacks, route leaks, blackholes) will be displayed in real-time.

Via Natural Language

> Start monitoring for BGP anomalies
> Watch for hijacks in real-time

With Specific Collectors

> /monitor start rrc00,rrc01,rrc10

Or via CLI:

uv run bgp-explorer --collectors rrc00,rrc01,rrc10 chat

Checking Status

> /monitor status
Monitoring: Active
Collectors: rrc00, rrc01
Events detected: 7

Stopping Monitoring

> /monitor stop
BGP Monitoring Stopped

Event Types

bgp-radar detects three types of anomalies:

Hijack

An unauthorized AS is announcing a prefix it doesn't own.

Indicators:

  • RPKI status is INVALID
  • Origin ASN differs from expected
  • Multiple Origin AS (MOAS) detected

Example output:

🔴 HIJACK - 203.0.113.0/24
   Affected ASN: AS64496
   Detected: 2024-01-15T10:30:00Z
   expected_origin: 64496
   observed_origin: 65001
   collector: rrc00

Route Leak

A prefix is being announced to places it shouldn't be (e.g., customer routes leaked to peers).

Indicators:

  • Unusual AS path
  • Prefix seen from unexpected vantage points
  • Path length anomalies

Example output:

🟡 LEAK - 198.51.100.0/24
   Affected ASN: AS64497
   Detected: 2024-01-15T10:31:00Z
   leaker_asn: 65002
   path_anomaly: true
   collector: rrc01

Blackhole

A prefix has been withdrawn or announced to a blackhole.

Indicators:

  • Sudden visibility drop
  • Withdrawal messages
  • Blackhole community attached

Example output:

🟢 BLACKHOLE - 192.0.2.0/24
   Affected ASN: AS64498
   Detected: 2024-01-15T10:32:00Z
   visibility_drop: 85%
   collector: rrc00

Severity Levels

Level Indicator Description
High 🔴 Immediate attention needed (confirmed hijack, RPKI invalid)
Medium 🟡 Potential issue requiring investigation
Low 🟢 Minor anomaly or informational

Filtering Events

By Event Type

> Show me only hijacks detected
> Are there any route leaks right now?

Claude will call get_anomalies(event_type="hijack") or similar.

By Prefix

> Are there any anomalies affecting 8.8.8.0/24?

By ASN

> Show anomalies affecting AS15169

On-Demand Hijack Detection

Even without bgp-radar running, you can check for hijack indicators:

> Check if 203.0.113.0/24 is being hijacked

This uses check_prefix_anomalies() which checks:

  • MOAS (Multiple Origin AS)
  • RPKI validation
  • Recent origin changes
  • Visibility analysis

Understanding the Output

Risk Assessment

The anomaly check provides a risk level:

Risk Meaning
🟢 LOW No significant indicators found
🟡 MEDIUM One indicator present, investigate
🔴 HIGH Multiple indicators or RPKI invalid

Risk Factors

Common risk factors reported:

  • "MOAS: Multiple origins (N ASes)"
  • "RPKI Invalid: ASN not authorized"
  • "New origin(s) in last 7 days: ASXXXX"
  • "Low visibility: Only N collectors"

Collectors

RIPE RIS collectors provide different vantage points:

Collector Location Good for
rrc00 Amsterdam European events
rrc01 London UK/European events
rrc10 Milan Southern Europe
rrc14 Palo Alto US West Coast
rrc15 Sao Paulo South America
rrc19 Johannesburg Africa
rrc20 Zurich Central Europe
rrc21 Tokyo Asia Pacific

Using multiple collectors improves detection coverage.

Best Practices

  1. Start with one or two collectors - More collectors = more data to process
  2. Filter by your prefixes - Focus on what matters to your network
  3. Correlate with on-demand checks - Use check_prefix_anomalies to verify
  4. Have contacts ready - Use get_network_contacts if you need to coordinate

Limitations

  • Not comprehensive - bgp-radar monitors RIS Live, not all BGP data
  • Detection delay - Events are detected as they're announced, not predicted
  • False positives - Legitimate MOAS, route changes can trigger alerts
  • Requires verification - Always verify with multiple tools

Next Steps

Clone this wiki locally