Friday Distraction: Who’s Leaking >/24 to Global BGP?
[It occurred to me after finishing this that I should have done everything based on ASN, but play time is over for the day...]An interesting conversation with my friend @denise_donohue led to this question: what providers are leaking prefixes longer than /24 to the global Internet?
Following my continuing theme of "fun stuff you can do by combining IOS and Bash", I ran a two step process via one of my BGP routers to get the answer:
$ ssh routername 'show ip bgp prefix-list GT24' > /tmp/gt24.txt
$ grep "^*" /tmp/gt24.txt | awk '{print $1}' | sed 's/*>i//g' | awk -F. '{OFS=".";print $1,$2 ".0.0"}' | sort -u | xargs -i whois {} | grep netname | sort -u
Here's the breakdown:
Extract just valid BGP prefixes from the router output:
grep "^*" /tmp/gt24.txt | awk '{print $1}'
Extract just the prefix itself and substitute ".0.0" for the last two octets, normalizing to the parent /16, then remove duplicates:
| awk '{print $1}' | sed 's/*>i//g' | awk -F. '{OFS=".";print $1,$2 ".0.0"}' | sort -u
Send those prefixes one-by-one to the "whois" command, extract the "netname" field, Continue reading
