September 4, 2026

BGP Monitoring Is a Heartbeat. Logs Are an Autopsy.

Syslog tells you what already died. The control plane tells you what is about to. A prefix that changes origin at 02:11 is still a sentence you can finish. A prefix you discover at 09:40 in a customer war room is a eulogy. You do not need a collector farm to get a pulse. You need a short list and a habit.

Four signals worth a pulse

• Presence. Is the prefix in the table at all?
• Origin. Is the ASN the one on your inventory card?
• Length. Did a more-specific appear that can steal traffic?
• ROA. Valid, invalid, or unknown?

Check them on BGP Lookup and the RPKI Validator. Add a looking-glass sample from two regions so you do not page the world because one collector blinked.

What to put on the list

Your own prefixes. Your DNS. Your IdP. Your model API. Your payment processor. That is five to eight objects, not five thousand. AI observability suites love to watch every container. The internet does not break by container. It breaks by prefix.

Human-readable beats machine-cosmic

An alert that says “possible anomaly in path vector entropy” will be muted. An alert that says “203.0.113.0/24 origin moved AS64500 → AS64496, RPKI invalid, EU glass empty” will be read. If you add a model to summarize BGP, constrain it to those four fields. Poetry is for postmortems.

Pair the pulse with a probe

When origin jumps, ping and traceroute from two cities. Control plane and data plane should argue in the same ticket. One of them lying is a clue. Both of them lying is a day off you will not get.

Write today’s origin for one critical prefix. Tomorrow, look it up again. If you cannot say whether it changed, you are doing autopsies.

FAQ

Is polling a public lookup tool “monitoring”?

It is a heartbeat, not a NOC. Use it for the short list. Buy a feed when you outgrow screenshots.

How fast should I poll?

Slow enough to be polite, fast enough to beat your users. Minutes, not milliseconds.