Thanks for the inputs. I now went with packetvis. Does anybody know who is behind packetvis? The home page is pretty quiet. Basically it works, but I would have expected that packetivs also shows ROAs. It show all my prefixes, but it does not show which of them have ROAs and which not. I guess I will give BGPalerter also a try.
regards Klaus > -----Ursprüngliche Nachricht----- > Von: Massimo Candela <[email protected]> > Gesendet: Montag, 12. Dezember 2022 12:38 > An: Klaus Darilion <[email protected]> > Cc: [email protected] > Betreff: Re: [routing-wg] RPKI ROAs and Monitoring > > Hello Klaus, > > An open-source monitoring application that does exactly what you are > asking for is BGPalerter [1]. Alternatively, if you are not keen on > running the app yourself, there is https://packetvis.com which is a > BGPalerter as a service. > > Ciao, > Massimo > > [1] https://github.com/nttgin/BGPalerter > > > > On Dec 12, 2022 12:12, Klaus Darilion via routing-wg <routing- > [email protected]> wrote: > > > Hello all! > > > > Until now we have not used RPKI. For us at nic.at and RcodeZero DNS > we are not on the validating side of RPKI, but we would only create > ROAs, using the RIPE service. I could just login to the RIPE portal and > in 5 minutes it is done. But I am a bit concerned about activating the > service and do not care anymore. Hence I think we should have some > monitoring too. > > > > We have a defined target state, eg. prefix 83.136.32.0/21 should be > announced from AS30971. So I think our monitoring should check: > > - is there a ROA for 83.136.32.0/21 from AS30971 > > - is the ROA valid, ie. not expired > > - Will validating ISPs accept these prefixes? Will > validating ISPs reject this prefix if the orign AS is wrong (maybe > having a local Routinator or queriying a public service via API). > > > > Do you think this makes sense? Is such monitoring already available > and I only have to subcribe somewhere (free or comemrcial)? Do I miss > something? Any hints what I should do before and after creating the > ROAs? > > > > Thanks > > Klaus > > > > PS: What happens if my ROAs expire. Will then my BGP announcements > be ignored by validating ISPs or will it just be as if there are no ROAs > at all? > > > No roa at all. However, if a less specific roa exists, or a roa for > another AS, it could result in invalid. You would get notified by the > monitoring if roas are expiring. > > > > -- > > Klaus Darilion, Head of Operations > > nic.at GmbH, Jakob-Haringer-Straße 8/V > > 5020 Salzburg, Austria > > > -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/routing-wg
