August 4, 2026
A BGP monitoring habit that will not drown you
The worst BGP monitoring setup I ever inherited paged on every path change for every prefix we had ever touched. We turned it off in a week. Not because we hated visibility. Because a page that fires forty times a night is not a page. It is weather.
A habit you will keep is better than a platform you will mute. Here is the small version.
Watch the prefixes you would wake up for
Not the lab /24. Not the old acquisition space you keep “just in case.” The prefixes that take money or reputation with them if they vanish or change origin. Write them in a list. Review the list quarterly. I have never regretted a short list. I have regretted a long one.
For each prefix I want three alerts, and only three:
- Visibility dropped — collectors that used to see it stopped.
- Origin ASN changed.
- RPKI state left valid (or became invalid).
Path changes, prepend experiments, a peer disappearing in one region — those can be tickets, not pages. If you page on path cosmetics you will train people to ignore origin changes, and origin changes are the ones that hurt.
RPKI belongs in the same habit
A ROA that expires is a self-hijack with extra steps. Monitor expiry and monitor invalid. If you run RPKI checks only when a human remembers, you will remember during an outage. Pair it with the prefix list. Same document, same on-call.
IRR drift is a weekly look, not a page. Objects rot slowly. Origins flip fast.
Ping is the cheap liveness check
BGP can look perfect while the anycast node in a region is dead. A handful of IPv4 and IPv6 pings from outside your network will tell you if the prefix answers. I do not ping every address. I ping one well-known anycast VIP and one resolver per region we claim to be in. If ping dies and BGP is up, it is not a routing incident yet. Do not start with a looking glass when the machine is just down.
What I refuse to monitor
Every peer’s every session. Every community change. Twitter. A Slack channel of people pasting paths with no prefix. If the signal cannot name the prefix, the old origin, the new origin, and a timestamp, it is not a signal.
I also refuse dashboards nobody owns. If the panel does not have a human who will delete a noisy rule, it will become art. Art is fine. Art does not page me.
The Tuesday review
Fifteen minutes. Open the prefix list. Any origin surprises? Any ROA inside 30 days of expiry? Any collector that went quiet? That is the habit. BGP monitoring tools are how I keep it when I am not at the desk. They are not a substitute for knowing which prefixes matter.
Start smaller than you want. Add an alert only after an incident where you said “I wish something had told me.” That sentence is the only honest feature request in this entire industry.