BGPalerter

Search the Marketplace for BGPalerter on Ubuntu 24.04 and choose your VM size. Attach an NSG that allows TCP 22 (SSH) from your management network and TCP 80 / 443 (the status API) from the networks that need to query it.

Front port 80 with TLS in production (see the HTTPS step below). BGPalerter needs no inbound port to monitor, because it makes an outbound connection to the BGP data stream.

RG="bgpalerter-prod"; LOCATION="eastus"; VM_NAME="bgpalerter-01" IMAGE_URN="sac1647283583153:bgpalerter-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name bgp-vnet --address-prefix 10.90.0.0/16 --subnet-name bgp-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name bgp-nsg az network nsg rule create -g "$RG" --nsg-name bgp-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name bgp-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:bgpalerter-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name bgp-vnet --subnet bgp-subnet --nsg bgp-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

BGPalerter's status API listens on loopback 127.0.0.1:8011 and nginx fronts it on port 80. The health endpoint is public, and the status API requires your password.

sudo systemctl start bgpalerter nginx 2>/dev/null || true
sudo systemctl is-active bgpalerter nginx ss -tln | grep -E ':80 |127.0.0.1:8011' curl -s http://127.0.0.1/health

You should see both services active, the two listening sockets (the status API bound to loopback, nginx on port 80), and ok from the public health endpoint.

The VM generated this password on first boot and stored it in a root-only file. Read it and keep it secret, because it authenticates every status API request. Then confirm that unauthenticated requests are rejected.

sudo cat /root/bgpalerter-info.txt echo "unauthenticated /status -> HTTP $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/status)"

The info note holds STATUS_API_PASSWORD and the instance URLs. It is owned by root:root with mode 0600. An unauthenticated call to /status returns 401 because nginx enforces authentication.

Load the password into a shell variable, then query the status API through nginx with HTTP Basic Auth. BGPalerter returns a JSON document describing the health of its components, the RIS connectors and the RPKI data. A healthy daemon returns HTTP 200.

export
BGP_PW=$(sudo grep '^STATUS_API_PASSWORD=' /root/bgpalerter-info.txt | cut -d= -f2-)
echo "authenticated /status -> HTTP $(curl -s -o /dev/null -w '%{http_code}' -u sac:$BGP_PW http://127.0.0.1/status)" curl -s -u sac:$BGP_PW http://127.0.0.1/status | jq .

The authenticated call returns 200 and a JSON object reporting each connector and the RPKI status. Point an external monitor or dashboard at this endpoint, over HTTPS and with the password.

Out of the box, the appliance ships a starter prefixes.yml that monitors a documented example autonomous system, so the daemon runs immediately. Replace it with your own prefixes and ASNs.

BGPalerter can generate the watch list for you from an ASN. It discovers the prefixes that the AS originates and writes them into prefixes.yml.

cd /var/lib/bgpalerter
sudo systemctl stop bgpalerter
sudo -u bgpalerter /usr/local/bin/bgpalerter generate -a <YOUR_ASN> -o prefixes.yml -i -m sudo systemctl start bgpalerter

The -i flag includes RPKI/ROA monitoring for the generated prefixes and -m includes monitoring the ASN itself. Review the generated prefixes.yml, then restart the service.

You can also edit prefixes.yml by hand to add or remove prefixes. Each entry has a description, an asn and monitoring options.

By default, BGPalerter writes alerts to a rotating log file under /var/lib/bgpalerter/logs/. Watch the file to see alerts as they are raised.

ls -1 /var/lib/bgpalerter/logs/
sudo tail -n 20 /var/lib/bgpalerter/logs/reports-$(date -u +%Y-%m-%d).log 2>/dev/null || echo "no alerts logged yet (this is normal on a quiet network)"

To deliver alerts to email, Slack, syslog, an HTTP webhook, Kafka and more, edit the reports: section of /var/lib/bgpalerter/config.yml and restart the service. Each report type has a template in the file.

For example, to add email alerts, uncomment and complete the reportEmail block with your SMTP server and recipients, then restart:

sudo systemctl restart bgpalerter

nginx fronts the status API on port 80 and is ready for TLS. Point a DNS record at the VM. Then obtain a certificate with certbot and let it configure nginx for port 443.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

After issuance, restrict the NSG so only 443 (and 22 from your management network) is reachable. Then query the status API over https://your-domain.example.com/status with the password.

Find BGPalerter on AWS Marketplace, subscribe, and launch an instance from the Ubuntu 24.04 delivery option. Choose your instance type and attach a security group that allows TCP 22 (SSH) from your management network and TCP 80 (the status API) from the networks that need to query it.

Front port 80 with TLS in production (see the HTTPS step below).

AMI_ID="<the-marketplace-ami-id>"
# from your Marketplace subscription KEY_NAME="my-keypair" SG_ID="sg-xxxxxxxx"
# allows 22 from your mgmt CIDR and 80 as needed SUBNET_ID="subnet-xxxxxxxx" aws ec2 run-instances \
  --image-id "$AMI_ID" --instance-type m5.large \
  --key-name "$KEY_NAME" --security-group-ids "$SG_ID" --subnet-id "$SUBNET_ID" \
  --metadata-options 'HttpTokens=required' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=bgpalerter-01}]'

ssh ubuntu@<public-ip>

BGPalerter's status API listens on loopback 127.0.0.1:8011 and nginx fronts it on port 80. The health endpoint is public, and the status API requires your password.

sudo systemctl is-active bgpalerter nginx ss -tln | grep -E ':80 |127.0.0.1:8011' curl -s http://127.0.0.1/health

You should see both services active, the two listening sockets (the status API bound to loopback, nginx on port 80), and ok from the public health endpoint.

The instance generated this password on first boot and stored it in a root-only file. Read it and keep it secret, because it authenticates every status API request. Then confirm that unauthenticated requests are rejected and that the info note and htpasswd are readable by root only.

sudo cat /root/bgpalerter-info.txt echo "unauthenticated /status -> HTTP $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/status)" ls -l /root/bgpalerter-info.txt /etc/nginx/.bgpalerter_htpasswd

The info note holds STATUS_API_PASSWORD and the instance URLs. It is owned by root:root with mode 0600. An unauthenticated call to /status returns 401 because nginx enforces authentication. The public /health endpoint stays 200 for load balancer probes.

Load the password into a shell variable, then query the status API through nginx with HTTP Basic Auth. BGPalerter returns a JSON document describing the health of its components, the RIS connectors and the RPKI data.

A healthy daemon returns HTTP 200 with connected: true for the RIS connector. This confirms that it is attached to the live BGP stream and processing updates.

export
BGP_PW=$(sudo grep '^STATUS_API_PASSWORD=' /root/bgpalerter-info.txt | cut -d= -f2-)
echo "authenticated /status -> HTTP $(curl -s -o /dev/null -w '%{http_code}' -u sac:$BGP_PW http://127.0.0.1/status)" curl -s -u sac:$BGP_PW http://127.0.0.1/status | jq .

The authenticated call returns 200 and a JSON object reporting each connector and the RPKI status. Point an external monitor or dashboard at this endpoint, over HTTPS and with the password.

Out of the box, the appliance ships a starter prefixes.yml that monitors a documented example autonomous system, so the daemon runs immediately. Replace it with your own prefixes and ASNs.

BGPalerter can generate the watch list for you from an ASN. It discovers the prefixes that the AS originates and writes them into prefixes.yml.

cd /var/lib/bgpalerter
sudo systemctl stop bgpalerter
sudo -u bgpalerter /usr/local/bin/bgpalerter generate -a <YOUR_ASN> -o prefixes.yml -i -m sudo systemctl start bgpalerter

The -i flag includes RPKI/ROA monitoring for the generated prefixes and -m includes monitoring the ASN itself. Review the generated prefixes.yml, then restart the service.

You can also edit prefixes.yml by hand to add or remove prefixes. Each entry has a description, an asn and monitoring options.

BGPalerter has a built-in self-test that injects fake BGP updates, so you can confirm the full monitor and report pipeline before you rely on it. By default, alerts are written to a rotating log file under /var/lib/bgpalerter/logs/. Watch the file to see detections as they are raised.

ls -1 /var/lib/bgpalerter/logs/
sudo tail -n 20 /var/lib/bgpalerter/logs/reports-$(date -u +%Y-%m-%d).log 2>/dev/null || echo "no alerts logged yet (this is normal on a quiet network)"

Each detection names the affected prefix, the peers that saw it and the AS path. A more-specific announcement of one of your prefixes from an unexpected origin AS stands out immediately.

To deliver alerts to email, Slack, syslog, an HTTP webhook, Kafka and more, edit the reports: section of /var/lib/bgpalerter/config.yml and restart the service. Each report type has a template in the file.

sudo systemctl restart bgpalerter

nginx fronts the status API on port 80 and is ready for TLS. Point a DNS record at the instance. Then obtain a certificate with certbot and let it configure nginx for port 443.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

After issuance, restrict the security group so only 443 (and 22 from your management network) is reachable. Then query the status API over https://your-domain.example.com/status with the password.