BGPAlerter

Something that kept me up at night was the idea that one of my organizations prefixes could be abused, after a few restless night, I decided to look for a tool comparable to what BGPmon was before it was acquired.
I came across BGPAlerter. BGPAlerter is open source software for BGP Monitoring. The program monitors BGP Streams from public repositories from RIPE , CloudFlare , and NTT. The software checks for BGP Hijacks , Path Changes and RPKI based upon the ASN and Prefixes the user elects to monitor.

The platform is useful since it was a lightweight open source program I could use to detect BGP streams from Public Repositories to ensure path security and stability. The software can be run from source code , docker , or as a linux service. I elected to install and run the source code version on a linux box.

#Add the system Modify IPS
netplan apply 
#Check firewall for ssh allowed
ufw app list
ufw allow ****
ufw enable 
#Change the system Host name
sudo hostnamectl set-hostname newNameHere
sudo reboot

#Check if SSH is enabled 
sudo systemctl list-unit-files | grep enabled | grep ssh

#Switch to user account 
sudo su bgpalerter
cd /home/bgpalerter/

#Install whois 
sudo apt update
sudo apt install whois

#Initialize Git
git init
git pull url = https://github.com/nttgin/BGPalerter.git

#Install BGP Alerter 
wget https://github.com/nttgin/BGPalerter/releases/download/v1.24.0/bgpalerter-linux-x64

#Mark the File as exectutable
chmod +x bgpalerter-linux-x64

#Check the installation and version 
./bgpalerter-linux-x64 --version

#Add prefixes to be monitored 
nano ~/prefixes.yml

#Install Node.js
sudo apt install npm

#Use Script to Auto-generate Prefix List

npm run generate-prefixes -- --a ASN,ASN  --o prefixes.yml

Getting started was easy enough, using the organizations BGP ASNs , BGPAlerter quickly built a list of prefixes that were seen on the RIPE RIS Server and configured a prefixes.yaml file to store a list of monitored prefixes.
BGPAlerter uses the concept of “monitors” . Monitors analyze the data flow and produce alerts.
Different monitors try to detect different issues the administrator is interested in.

 monitorHijack
 monitorNewPrefix
 monitorPath
 monitorVisibility
 monitorAS
 monitorRPKI
 monitorROAS
 monitorPathNeighbors

The use of these monitors allows me to monitor for specific path issues a be alerted to them. The code snippet below is the example from the github but works well for my implementation.

Example: The prefixes list of BGPalerter has an entry such as:

165.254.255.0/24:
   asn: 15562
   description: an example on path matching
   ignoreMorespecifics: false
 path:
   - match: ".*2194,1234$"
     notMatch: ".*5054.*"
     matchDescription: detected scrubbing center
   - match: ".*123$"
     notMatch: ".*5056.*"
     matchDescription: other match


These events can be fired into multiple alert channels such as slack , email , kafka , syslog of course. A visual of the Slack integration is seen below. This was used to detect a prefix that needed to be removed from announcement.

Been using the program for a few months and it serves it purposes. Verion 1.28 has introduced some new features such a restful API where active alerts can be pulled from.

#Helpful Commands 
#Start BGPAlerter
npm run serve&
#Confirm the Version in Use
npm run serve -- --v

Resources:
https://github.com/nttgin/BGPalerter
https://ris-live.ripe.net/

Leave a comment