bgpuma -- A program to search BGP Update files for CIDR blocks or Autonomous Systems
bgpuma --file=path --cidrfile=path bgpuma --file=path --asnfile=path
The BGP update files are stored in the MRT format and are not easily searchable. This program seeks to fix that issue by allowing you to search the files for not only the CIDR block in question but for any CIDR blocks which contain the CIDR block in question and also any CIDR blocks which are contained in the that block. In other words, it will not only find exact matches for 127.0.0.0/9 but will also find any announcements or withdrawals for 127.0.0.0/8 and 127.1.0.0/16. This allows you to find any announcements or withdrawals that could potentially affect a netblock. In addition, the ability to search for Autonomous Systems by number is included.
--cidrfile=file The file containing a list of the CIDR blocks to look for.
--asnfile=file The file that contains a list of Autonomous System numbers to search for.
--or If you use both of the --asnfile and the --cidrfile options, by default bgpuma mlooks for lines that satisfy both lists. Using this flag turns that 'and' into an 'or'.
--update=file A single BGP update file to search.
--file=file A file containing a list of BGP update files to search.
--startdate=YYYYMMDD --enddate=YYYYMMDD These two flags must be used together. bgpuma understands the directory structure used by both the RIPE Routing Information Service and the Route Views Archive Project. If you have access to these files via a file system, then bgpuma mcan search across a date range.
--dir=dir This flag should be used in conjunction with the --startdate and --enddate flags. It tells bgpuma that the files for either RIPE or Route Views are contained in that directory. It can be used more than once, in which case it will search first one directory for a date and then the other.
--outfile=outfile The output file for bgpuma results. By default, bgpuma prints the results to standard out.
--help Lists the flags available in bgpuma.
bgpuma finds both the additions and the withdrawals in the routing table. For additions, the output is in pipe delimited format and includes: Time Seen IP address announcing the route Autonomous System announcing the route IP address receiving the announcement Autonomous System receiving the announcement The CIDR announced The path in question For withdrawals, the output contains the same as the additions except it does not include the path.
L<SiLK> and L<BGPdump>