North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: Clue's for Clue-less
Sharif Torpis wrote: > > this must be an 11.2 thing? > Unknown... Have you ever met an 11.1.xx technician *not* wearing synthetics to test it ? :) > Richard Irving wrote: > > > > It is built into IOS.... As you approach the ceiling, it sends out an > > SNMP log alert. > > > > Now, how I select the number is confidential.... > > > > Ok. I will give you a hint.... I bring up the original sessions, > > and confirm integrity... > > > > Then I look at the routes, size and count. > > > > Then in the dark of the moon, wearing *no* synthetics, > > facing *magnetic* north... I devine the target number. > > > > In other words... It is a judgement call... > > > > Downstreams are easier. They must file routes with me, before I route > > them. I filter to the prefix. > > > > Consider this merely another fall back mechanism to the general IOPS > > model. > > > > Sharif Torpis wrote: > > > > > > can u elaborate on the detection mechanism for setting off such > > > alarms? do u look at % change in total routes in core of internet? > > > e.g. sunday saw a change of 55k -> 60k which is ~10% change ... or do > > > u look at specific blocks that should not be deaggregated and catch > > > them if they are deaggregated ... thanks > > > > > > Richard Irving wrote: > > > > > > > > The only neighbors I lost on this one, dumped something > > > > they shouldn't..... If someone de-aggregates a /16, > > > > it fires off alarms.... Although these may be valid advertisements, > > > > We have opted for the "safe, rather than sorry" perspective. > > > > (Besides, the alarms *assure* prompt attention) > > > > > > > > PS: 11.2.xx and higher have this command...
|