From wilhelm at ripe.net Wed Jun 7 19:00:54 2006 From: wilhelm at ripe.net (Rene Wilhelm) Date: Wed, 07 Jun 2006 19:00:54 +0200 Subject: [ris-int] RRC12: no DB insertion since mid April? Message-ID: <20060607170054.D16702F595@herring.ripe.net> Hi, Asking RIS DB for more detailed info regarding 2001:440:1880::/48 I was surprised to see only two entries returned vs. the three peers reported by RISwhois. Comparing the results I saw rrc12/DE-CIX was the one missing out; a further check of http://www.ris.ripe.net/cgi-bin/rrcstatus.cgi showed there's not been any data inserted from rrc12 for almost two months now! Are you aware of this? is there some specific, hard to fix, problem with the box? -- Rene From ris-request at ripe.net Thu Jun 8 15:05:12 2006 From: ris-request at ripe.net (RIPE NCC RIS) Date: Thu, 08 Jun 2006 15:05:12 +0200 Subject: [ris-int] Re: NCC#2006060688 RRC12: no DB insertion since mid April? In-Reply-To: <20060607170054.D16702F595@herring.ripe.net>; from Rene Wilhelm on Wed, 07 Jun 2006 19:00:54 +0200 References: <20060607170054.D16702F595@herring.ripe.net> Message-ID: <200606081305.k58D5CP2026564@cat.ripe.net> Hi Rene, I have noticed that it was not inserted for a while. The reason is the data we collect over there getting quite data, and DBinsert can not handle it anymore. I do not know what the quick solution would be. I will leave this ticket open and we will see how we can improve it. -- Arife Vural SED, RIPE NCC On Wed, 07 Jun 2006 19:00:54 +0200, Rene Wilhelm wrote: * Hi, * * Asking RIS DB for more detailed info regarding 2001:440:1880::/48 * I was surprised to see only two entries returned vs. the three * peers reported by RISwhois. * * Comparing the results I saw rrc12/DE-CIX was the one missing out; * a further check of http://www.ris.ripe.net/cgi-bin/rrcstatus.cgi * showed there's not been any data inserted from rrc12 for almost * two months now! * * Are you aware of this? is there some specific, hard to fix, * problem with the box? * * -- Rene From wilhelm at ripe.net Thu Jun 8 15:42:41 2006 From: wilhelm at ripe.net (Rene Wilhelm) Date: Thu, 08 Jun 2006 15:42:41 +0200 Subject: [ris-int] Re: NCC#2006060688 RRC12: no DB insertion since mid April? In-Reply-To: <200606081305.k58D5CP2026564@cat.ripe.net> References: <20060607170054.D16702F595@herring.ripe.net> <200606081305.k58D5CP2026564@cat.ripe.net> Message-ID: <20060608134241.76A326006B@x27.ripe.net> Hi Arife, > I have noticed that it was not inserted for a while. The reason > is the data we collect over there getting quite data, and DBinsert > can not handle it anymore. Ah, I see. > I do not know what the quick solution would be. > I will leave this ticket open and we will see how we can improve > it. The raw data on lama suggests the activity on rrc12 has come down again to more "normal" levels, at least disk usage is of the same order, even a bit lower, than that of rrc03 at ams-ix: rrc00 rrc03 rrc12 Jan 430240 4312288 2009136 Feb 1174536 3503580 1822364 Mar 460220 3702528 2219576 Apr 730940 3544852 5987960 May 1997620 3488828 8392800 Jun 526332 851528 783260 Perhaps it is possible to switch DBinsert back on again while continuing investigation on how to deal with future hurricane size update storms? Cheers, -- Rene From james at ripe.net Thu Jun 8 16:07:06 2006 From: james at ripe.net (James Aldridge) Date: Thu, 08 Jun 2006 16:07:06 +0200 Subject: [ris-int] Re: NCC#2006060688 RRC12: no DB insertion since mid April? In-Reply-To: <20060608134241.76A326006B@x27.ripe.net> References: <20060607170054.D16702F595@herring.ripe.net> <200606081305.k58D5CP2026564@cat.ripe.net> <20060608134241.76A326006B@x27.ripe.net> Message-ID: <20060608140706.479096007D@x34.ripe.net> Rene Wilhelm wrote: > Hi Arife, > > > I have noticed that it was not inserted for a while. The reason > > is the data we collect over there getting quite data, and DBinsert > > can not handle it anymore. > > Ah, I see. > > > I do not know what the quick solution would be. > > > I will leave this ticket open and we will see how we can improve > > it. > > The raw data on lama suggests the activity on rrc12 has come down > again to more "normal" levels, at least disk usage is of the same > order, even a bit lower, than that of rrc03 at ams-ix: > > rrc00 rrc03 rrc12 > Jan 430240 4312288 2009136 > Feb 1174536 3503580 1822364 > Mar 460220 3702528 2219576 > Apr 730940 3544852 5987960 > May 1997620 3488828 8392800 > Jun 526332 851528 783260 > > Perhaps it is possible to switch DBinsert back on again while > continuing investigation on how to deal with future hurricane > size update storms? It's not that dbinsert is not running, just that it's still processing data from April. To avoid this problem (and have current data inserted at the expense of delaying insertion of old data) dbinsert used to insert from the most recent file first ... but that then caused problems if an application assumed that database entries were in time-order. It might be worth flagging some of these old files as 'AI' or 'RI' in the updtlist table so that dbinsert will skip them and then gradually move them back to 'A'/'R' as processing time permits. James From hattiea at bntt.com Mon Jun 12 13:37:24 2006 From: hattiea at bntt.com (Hattie Quintanilla) Date: Mon, 12 Jun 2006 04:37:24 -0700 Subject: [ris-int] test aazy Message-ID: <000001c68e14$9311b860$4604a8c0@bcr5> Hi, Som nn a Pr td ozac Vl nb AGRA from o zv nly $ nx 3,3 ta 3 V zh ALlUM from on yn ly $ qp 1,2 qo 1 C wf lALlS from o wz nly $ ga 3,7 ck 5 Merid sg ia Levi ny tra Ambi zs en Xa rc nax all 5 ct 0% o di ff http://www.hagraisone.com _____ Bilbo had escaped the goblins, but he did not know where he was. He had lost hood, cloak, food, pony, his buttons and his friends. He wandered on and on, till the sun began to sink westwards-behind the mountains. Their shadows fell across Bilbos path, and he looked back. Then he looked forward and could see before him only ridges and slopes falling towards lowlands and plains glimpsed occasionally between the trees. -------------- next part -------------- An HTML attachment was scrubbed... URL: From henk at ripe.net Mon Jun 12 14:54:31 2006 From: henk at ripe.net (Henk Uijterwaal) Date: Mon, 12 Jun 2006 14:54:31 +0200 Subject: [ris-int] Re: NCC#2006060688 RRC12: no DB insertion since mid April? In-Reply-To: <20060608140706.479096007D@x34.ripe.net> References: <20060607170054.D16702F595@herring.ripe.net> <200606081305.k58D5CP2026564@cat.ripe.net> <20060608134241.76A326006B@x27.ripe.net> <20060608140706.479096007D@x34.ripe.net> Message-ID: <7.0.1.0.2.20060612145338.0345ec88@ripe.net> Hi, >It might be worth flagging some of these old files as 'AI' or 'RI' in the >updtlist table so that dbinsert will skip them and then gradually move them >back to 'A'/'R' as processing time permits. I think this is a good idea. Recent data with a hole in April/May is probably more useful than no data from June. Henk >James ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ 1160438400. Watch this space... From arife at ripe.net Mon Jun 12 16:48:09 2006 From: arife at ripe.net (Arife Vural) Date: Mon, 12 Jun 2006 16:48:09 +0200 Subject: [ris-int] Re: NCC#2006060688 RRC12: no DB insertion since mid April? In-Reply-To: <7.0.1.0.2.20060612145338.0345ec88@ripe.net> References: <20060607170054.D16702F595@herring.ripe.net> <200606081305.k58D5CP2026564@cat.ripe.net> <20060608134241.76A326006B@x27.ripe.net> <20060608140706.479096007D@x34.ripe.net> <7.0.1.0.2.20060612145338.0345ec88@ripe.net> Message-ID: <20060612144809.GJ24392@ripe.net> I skipped the data for April and May, and restarted Dbinsert from the begining of this month. Also run few optimize/reapir on mostly used SQL tables. It looks SQL queries are running in reasonable speed. Will keep an eye on it. On Mon, Jun 12, 2006 at 02:54:31PM +0200, Henk Uijterwaal wrote: > Hi, > > >It might be worth flagging some of these old files as 'AI' or 'RI' in the > >updtlist table so that dbinsert will skip them and then gradually move them > >back to 'A'/'R' as processing time permits. > > I think this is a good idea. Recent data with a hole in April/May is > probably more useful than no data from June. > > > > Henk > > > > > >James > > ------------------------------------------------------------------------------ > Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net > RIPE Network Coordination Centre http://www.amsterdamned.org/~henk > P.O.Box 10096 Singel 258 Phone: +31.20.5354414 > 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 > The Netherlands The Netherlands Mobile: +31.6.55861746 > ------------------------------------------------------------------------------ > > 1160438400. Watch this space... > -- Arife Vural SED, RIPE NCC From giach at idahoproperties.com Tue Jun 13 15:07:15 2006 From: giach at idahoproperties.com (Giachetta Klass) Date: Tue, 13 Jun 2006 06:07:15 -0700 Subject: [ris-int] Re: bejes 495 Message-ID: <000001c68eea$4a9d1da0$a42fa8c0@jdf12> Hi VlAGR az A f se rom on sw ly $ go 3,3 qq 3 P bb rozac Levi tj tra A ah mbien Merid xg ia ClALl qj S f pg rom o va nly $ yf 3,7 tg 5 VALlU zn M fro ei m onl dd y $ oy 1,2 ya 1 Xana ql x Som qc a Sav nk e ove tx r 50 cn % wi qr th u cc s http://www.leoperteas.com _____ As he went forward it grew and grew, till there was no doubt about it. It was a red light steadily getting redder and redder. Also it was now undoubtedly hot in the tunnel. Wisps of vapour floated up and past him and he began to sweat. A sound, too, began to throb in his ears, a sort of bubbling like the noise of a large pot galloping on the fire, mixed with a rumble as of a gigantic tom-cat purring. This grew to the -------------- next part -------------- An HTML attachment was scrubbed... URL: From wilhelm at ripe.net Wed Jun 14 11:44:51 2006 From: wilhelm at ripe.net (Rene Wilhelm) Date: Wed, 14 Jun 2006 11:44:51 +0200 (CEST) Subject: [ris-int] Re: NCC#2006060688 RRC12: no DB insertion since mid April? In-Reply-To: <20060612144809.GJ24392@ripe.net> References: <20060607170054.D16702F595@herring.ripe.net> <200606081305.k58D5CP2026564@cat.ripe.net> <20060608134241.76A326006B@x27.ripe.net> <20060608140706.479096007D@x34.ripe.net> <7.0.1.0.2.20060612145338.0345ec88@ripe.net> <20060612144809.GJ24392@ripe.net> Message-ID: Hi Arife, DB status page shows RRC12 insertion reached middle of June 3d, so it's finally processing the old data faster than they originally came in (i.e. less than 24 hours work for 24 hours worth of updates). This gives hopes the rrc12 DBinsert will one day catch up with real time again :) Cheers, -- Rene On Mon, 12 Jun 2006, Arife Vural wrote: > > I skipped the data for April and May, and restarted Dbinsert > from the begining of this month. > > Also run few optimize/reapir on mostly used SQL tables. It looks > SQL queries are running in reasonable speed. > > Will keep an eye on it. > > On Mon, Jun 12, 2006 at 02:54:31PM +0200, Henk Uijterwaal wrote: > > Hi, > > > > >It might be worth flagging some of these old files as 'AI' or 'RI' in the > > >updtlist table so that dbinsert will skip them and then gradually move them > > >back to 'A'/'R' as processing time permits. > > > > I think this is a good idea. Recent data with a hole in April/May is > > probably more useful than no data from June. > > > > > > > > Henk From Parkerasteroidal at earthlink.net Sat Jun 24 18:15:07 2006 From: Parkerasteroidal at earthlink.net (Parker) Date: Sat, 24 Jun 2006 18:15:07 +0200 Subject: [ris-int] RE Hottest new offer You gape for shooting like you had seen in those films… Message-ID: <29990612755608.3EC241FF0A@9QIV> Good afternoon Look, now it?s possible with this stuff And the results will impress your girl Now you could grant your wish Just take a look: http://ihlmail/gal/ms Worried it won't work? Do you wish to increase your volume by up to 500%? From arife at ripe.net Tue Jun 27 10:59:37 2006 From: arife at ripe.net (Arife Vural) Date: Tue, 27 Jun 2006 10:59:37 +0200 Subject: [ris-int] RISToDo Message-ID: <20060627085937.GD23678@ripe.net> Hi Guys, I'm compiling RIS ToDo here, http://iii/twiki/bin/view/SED/RISToDo Please have a look at it and let me know if some stuff needs to be added. BTW, I will be on vacation and unpaid leave for July and August. Please contact with other SED staff about RIS related issues. -- Arife Vural SED, RIPE NCC From canteroekelce at dvart.com Thu Jun 29 14:07:42 2006 From: canteroekelce at dvart.com (Kelcey Cantero) Date: Thu, 29 Jun 2006 05:07:42 -0700 Subject: [ris-int] Re: at guqia Message-ID: <000001c69b74$9fbb1f30$306da8c0@ksy18> SAV x E UP TO 5 c 0 % on your PH h AR k MACY http://shesanoud.com c V e I f A v G h R i A from x 3 f , u 3 a 3 $ y V x A w L r I v U n M from w 1 k , a 2 u 1 $ b C b I r A g L y I s S from u 3 s , q 7 o 5 $ j X p A s N l A a X from i 1 m , c 4 t 2 $ p A h M h B s I e E v N from g 2 j , s 8 r 9 $ And man q y oth w er . , , , the night he had to pass wet as he was and far from a fire, but the bottle helped him to do that, and he actually dozed a little on some dry leaves, even though the year was getting late and the air was chilly. He woke again with a specially loud sneeze. It was already grey morning, and there was a merry racket down by the river. They were making up a raft of barrels, and the raft-elves would soon be steering -------------- next part -------------- An HTML attachment was scrubbed... URL: From arife at ripe.net Thu Jun 29 16:16:52 2006 From: arife at ripe.net (Arife Vural) Date: Thu, 29 Jun 2006 16:16:52 +0200 Subject: [ris-int] [simon@limmat.switch.ch: Re: NCC#2005011655 Suggestion for improvement of myASN alarms] Message-ID: <20060629141652.GI21411@ripe.net> Hi all, I have put the code on RIS page. Arife ----- Forwarded message from Simon Leinen ----- From: Simon Leinen To: Travel Subject: Re: NCC#2005011655 Suggestion for improvement of myASN alarms Date: Wed, 28 Jun 2006 14:09:54 +0200 Cc: Arife Vural Content-Description: message body and .signature Hello Arife (Travel?), > I have fixed this bug, please let me know if you see other > problems. Wonderful, thanks! It was more an "RFE" (request for enhancement) than a bug. I just received my first message with the new AS path column, and found it very useful indeed. Actually, I have a script that I pipe the MyASN alerts through, and that generates a URL for BGPlay, so that I can "replay" what the alert was about. For the last alert, the script generates this URL: http://www.ris.ripe.net/cgi-bin/bgplay.cgi?prefix=130.59.0.0/16&start=2006-06-28+03:52&end=2006-06-28+04:50 Our (AS559's) peering with Cogent (AS174) flapped twice between 04:25:23 and 04:43:05 UTC. The other flaps before and after this may point to more general problems with Cogents backbone. (I'm attaching the original MyASN alert, and my little Perl script that transforms this into the BGPlay URL.) Thanks again for the change! With kind regards, -- Simon. Content-Description: forwarded message From: myASn Notifications To: simon at limmat.switch.ch Subject: New alarms for 559 Date: Wed, 28 Jun 2006 07:18:52 GMT Dear myASn contact, New alarms were detected for 559. Please find the details below. Depending on your detail level settings you might not see all the events. Please use the web interface for further details. http://www.ris.ripe.net/myasn/ -- myASn system Advanced alarm 1253 (Default), 130.59.0.0/16 (exceptions not shown), \b(3549|3356|286|1299|3320)\s(559)\b, MinED: 1, MinEC: 1, ADW: 3600 .=------+---------------+--------------+----------------+--------------------------+--------------------------+------=. | RRC | Prefix | AS Path | Peer | First seen | Last seen | Count | |=------+---------------+--------------+----------------+--------------------------+--------------------------+------=| | rrc15 | 130.59.0.0/16 | 6140 174 559 | 200.219.130.18 | Wed Jun 28 03:54:23 2006 | Wed Jun 28 03:54:23 2006 | 1 | | rrc15 | 130.59.0.0/16 | 6140 174 559 | 200.219.130.18 | Wed Jun 28 04:01:51 2006 | Wed Jun 28 04:05:58 2006 | 2 | | rrc15 | 130.59.0.0/16 | 6140 174 559 | 200.219.130.18 | Wed Jun 28 04:10:43 2006 | Wed Jun 28 04:15:05 2006 | 2 | | rrc15 | 130.59.0.0/16 | 6140 174 559 | 200.219.130.18 | Wed Jun 28 04:20:12 2006 | Wed Jun 28 04:22:59 2006 | 2 | | rrc15 | 130.59.0.0/16 | 6140 174 559 | 200.219.130.18 | Wed Jun 28 04:30:37 2006 | Wed Jun 28 04:30:37 2006 | 1 | | rrc15 | 130.59.0.0/16 | 6140 174 559 | 200.219.130.18 | Wed Jun 28 04:45:11 2006 | Wed Jun 28 04:45:11 2006 | 1 | '=------+---------------+--------------+----------------+--------------------------+--------------------------+------=' #!/usr/bin/perl -w ### ### Parse MyASN report and generate a BGPlay URL of the form ### http://www.ris.ripe.net/cgi-bin/bgplay.cgi?prefix=195.135.220.0/22&start=2005-05-30+05:00&end=2005-05-30+09:09 use strict; use Time::Local; sub parse_message (); sub gmt_to_unix ($ ); sub init_months (); sub unixtime_to_bgplay ($ ); sub make_bgplay_url ($$$$); ## BGPlay this many seconds before the earliest "first seen" ## value in the MyASN alert. ## my $seconds_before_first_seen = 120; ## BGPlay this many seconds after the last "last seen" value in the ## MyASN alert. ## my $seconds_after_last_seen = 300; my $echo = 0; init_months (); my ($prefix, $rrcs, $first, $last) = parse_message (); print make_bgplay_url ($prefix, $rrcs, $first, $last),"\n"; sub parse_message () { my ($very_first, $very_last, @rrcs, %rrcs); my (@colnames, @columns, $columns, $line, $k, $rrc, $prefix, $first, $last); while (<>) { print if $echo; next if /^[.|\']=--+/; warn "Cannot parse $_", next unless ($columns) = m@^\| (.*) \|$@; @columns = map { /^(.*\S+)\s*$/ } split (/ \| /, $columns); if (! $colnames[0]) { @colnames = @columns; } else { $line = {}; for ($k = 0; $#columns >= 0; ++$k) { $line->{$colnames[$k]} = shift @columns; } $prefix = $line->{'Prefix'} or die "missing Prefix column"; $rrc = $line->{'RRC'} or die "missing RRC column"; $first = $line->{'First seen'} or die "missing First seen column"; $last = $line->{'Last seen'} or die "missing Last seen column"; ++$rrcs{$rrc}; $first = gmt_to_unix ($first); $last = gmt_to_unix ($last); $very_first = $first if !defined $very_first or $first < $very_first; $very_last = $last if !defined $very_last or $last > $very_last; } } @rrcs = sort keys %rrcs; return ($prefix, \@rrcs, $very_first-$seconds_before_first_seen, $very_last+$seconds_after_last_seen); } my %ugly_months = (); sub init_months () { my $k = 0; my @pretty_months = qw(Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec); foreach my $month (@pretty_months) { $ugly_months{$month} = $k++; } } sub gmt_to_unix ($ ) { my ($gmt_string) = @_; my ($wday, $mname, $mon, $mday, $hour, $min, $sec, $year); die "malformed GMT string $gmt_string" unless (($wday, $mname, $mday, $hour, $min, $sec, $year) = $gmt_string =~ m@(Mon|Tue|Wed|Thu|Fri|Sat|Sun) \ (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \ \s*(\d+) \ (\d\d):(\d\d):(\d\d)\ (\d\d\d\d)$@ix); die "unknown month $mname" unless $mon = $ugly_months{$mname}; return timegm ($sec, $min, $hour, $mday, $mon, $year); } sub unixtime_to_bgplay ($ ) { my ($time) = @_; my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday) = gmtime($time); return sprintf ("%04d-%02d-%02d+%02d:%02d", $year+1900, $mon+1, $mday, $hour, $min); } sub make_bgplay_url ($$$$) { my ($prefix, $rrcs, $first, $last) = @_; my $base_url = "http://www.ris.ripe.net/cgi-bin/bgplay.cgi"; return sprintf ("%s?prefix=%s&start=%s&end=%s", $base_url, $prefix, unixtime_to_bgplay ($first), unixtime_to_bgplay ($last)); } ----- End forwarded message ----- -- Arife Vural SED, RIPE NCC From arife at ripe.net Thu Jun 29 17:04:15 2006 From: arife at ripe.net (Arife Vural) Date: Thu, 29 Jun 2006 17:04:15 +0200 Subject: [ris-int] [simon@limmat.switch.ch: Re: NCC#2005011655 Suggestion for improvement of myASN alarms] In-Reply-To: <20060629141652.GI21411@ripe.net> References: <20060629141652.GI21411@ripe.net> Message-ID: <20060629150415.GN21411@ripe.net> Here, http://www.ripe.net/projects/ris/misc.html a. On Thu, Jun 29, 2006 at 04:16:52PM +0200, Arife Vural wrote: > > Hi all, > > I have put the code on RIS page. > > Arife > > ----- Forwarded message from Simon Leinen ----- > > From: Simon Leinen > To: Travel > Subject: Re: NCC#2005011655 Suggestion for improvement of myASN alarms > Date: Wed, 28 Jun 2006 14:09:54 +0200 > Cc: Arife Vural > > Content-Description: message body and .signature > Hello Arife (Travel?), > > I have fixed this bug, please let me know if you see other > > problems. > > Wonderful, thanks! It was more an "RFE" (request for enhancement) than > a bug. I just received my first message with the new AS path column, > and found it very useful indeed. > > Actually, I have a script that I pipe the MyASN alerts through, and > that generates a URL for BGPlay, so that I can "replay" what the alert > was about. For the last alert, the script generates this URL: > > http://www.ris.ripe.net/cgi-bin/bgplay.cgi?prefix=130.59.0.0/16&start=2006-06-28+03:52&end=2006-06-28+04:50 > > Our (AS559's) peering with Cogent (AS174) flapped twice between > 04:25:23 and 04:43:05 UTC. The other flaps before and after this may > point to more general problems with Cogents backbone. > > (I'm attaching the original MyASN alert, and my little Perl script > that transforms this into the BGPlay URL.) > > Thanks again for the change! > > With kind regards, > -- > Simon. > > Content-Description: forwarded message > From: myASn Notifications > To: simon at limmat.switch.ch > Subject: New alarms for 559 > Date: Wed, 28 Jun 2006 07:18:52 GMT > > > Dear myASn contact, > > New alarms were detected for 559. Please find the details below. > Depending on your detail level settings you might not see all the events. > > Please use the web interface for further details. > > http://www.ris.ripe.net/myasn/ > > -- myASn system > > > Advanced alarm 1253 (Default), 130.59.0.0/16 (exceptions not shown), \b(3549|3356|286|1299|3320)\s(559)\b, MinED: 1, MinEC: 1, ADW: 3600 > .=------+---------------+--------------+----------------+--------------------------+--------------------------+------=. > | RRC | Prefix | AS Path | Peer | First seen | Last seen | Count | > |=------+---------------+--------------+----------------+--------------------------+--------------------------+------=| > | rrc15 | 130.59.0.0/16 | 6140 174 559 | 200.219.130.18 | Wed Jun 28 03:54:23 2006 | Wed Jun 28 03:54:23 2006 | 1 | > | rrc15 | 130.59.0.0/16 | 6140 174 559 | 200.219.130.18 | Wed Jun 28 04:01:51 2006 | Wed Jun 28 04:05:58 2006 | 2 | > | rrc15 | 130.59.0.0/16 | 6140 174 559 | 200.219.130.18 | Wed Jun 28 04:10:43 2006 | Wed Jun 28 04:15:05 2006 | 2 | > | rrc15 | 130.59.0.0/16 | 6140 174 559 | 200.219.130.18 | Wed Jun 28 04:20:12 2006 | Wed Jun 28 04:22:59 2006 | 2 | > | rrc15 | 130.59.0.0/16 | 6140 174 559 | 200.219.130.18 | Wed Jun 28 04:30:37 2006 | Wed Jun 28 04:30:37 2006 | 1 | > | rrc15 | 130.59.0.0/16 | 6140 174 559 | 200.219.130.18 | Wed Jun 28 04:45:11 2006 | Wed Jun 28 04:45:11 2006 | 1 | > '=------+---------------+--------------+----------------+--------------------------+--------------------------+------=' > > #!/usr/bin/perl -w > ### > ### Parse MyASN report and generate a BGPlay URL of the form > ### http://www.ris.ripe.net/cgi-bin/bgplay.cgi?prefix=195.135.220.0/22&start=2005-05-30+05:00&end=2005-05-30+09:09 > > use strict; > use Time::Local; > > sub parse_message (); > sub gmt_to_unix ($ ); > sub init_months (); > sub unixtime_to_bgplay ($ ); > sub make_bgplay_url ($$$$); > > ## BGPlay this many seconds before the earliest "first seen" > ## value in the MyASN alert. > ## > my $seconds_before_first_seen = 120; > > ## BGPlay this many seconds after the last "last seen" value in the > ## MyASN alert. > ## > my $seconds_after_last_seen = 300; > > my $echo = 0; > init_months (); > my ($prefix, $rrcs, $first, $last) > = parse_message (); > print make_bgplay_url ($prefix, $rrcs, $first, $last),"\n"; > > sub parse_message () { > my ($very_first, $very_last, @rrcs, %rrcs); > my (@colnames, @columns, $columns, $line, $k, > $rrc, $prefix, $first, $last); > while (<>) { > print if $echo; > next if /^[.|\']=--+/; > warn "Cannot parse $_", next unless ($columns) = m@^\| (.*) \|$@; > @columns = map { /^(.*\S+)\s*$/ } split (/ \| /, $columns); > if (! $colnames[0]) { > @colnames = @columns; > } else { > $line = {}; > for ($k = 0; $#columns >= 0; ++$k) { > $line->{$colnames[$k]} = shift @columns; > } > $prefix = $line->{'Prefix'} or die "missing Prefix column"; > $rrc = $line->{'RRC'} or die "missing RRC column"; > $first = $line->{'First seen'} or die "missing First seen column"; > $last = $line->{'Last seen'} or die "missing Last seen column"; > ++$rrcs{$rrc}; > $first = gmt_to_unix ($first); > $last = gmt_to_unix ($last); > $very_first = $first > if !defined $very_first or $first < $very_first; > $very_last = $last > if !defined $very_last or $last > $very_last; > } > } > @rrcs = sort keys %rrcs; > return ($prefix, \@rrcs, > $very_first-$seconds_before_first_seen, > $very_last+$seconds_after_last_seen); > } > > my %ugly_months = (); > > sub init_months () { > my $k = 0; > my @pretty_months = qw(Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec); > foreach my $month (@pretty_months) { > $ugly_months{$month} = $k++; > } > } > > sub gmt_to_unix ($ ) { > my ($gmt_string) = @_; > my ($wday, $mname, $mon, $mday, $hour, $min, $sec, $year); > die "malformed GMT string $gmt_string" > unless (($wday, $mname, $mday, $hour, $min, $sec, $year) > = $gmt_string =~ > m@(Mon|Tue|Wed|Thu|Fri|Sat|Sun) > \ (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) > \ \s*(\d+) > \ (\d\d):(\d\d):(\d\d)\ (\d\d\d\d)$@ix); > die "unknown month $mname" unless $mon = $ugly_months{$mname}; > return timegm ($sec, $min, $hour, $mday, $mon, $year); > } > > sub unixtime_to_bgplay ($ ) { > my ($time) = @_; > my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday) = > gmtime($time); > return sprintf ("%04d-%02d-%02d+%02d:%02d", > $year+1900, $mon+1, $mday, $hour, $min); > } > > sub make_bgplay_url ($$$$) { > my ($prefix, $rrcs, $first, $last) = @_; > my $base_url = "http://www.ris.ripe.net/cgi-bin/bgplay.cgi"; > return sprintf ("%s?prefix=%s&start=%s&end=%s", > $base_url, > $prefix, > unixtime_to_bgplay ($first), > unixtime_to_bgplay ($last)); > } > > > ----- End forwarded message ----- > > -- > Arife Vural > SED, RIPE NCC > -- Arife Vural SED, RIPE NCC