<html><head></head><body>Hi!<br><br>Did you try using BGP path mask? Like<br>if (bgp.path ~ [= ? bogon bogon * =]) …<br><br>Writing this from my phone. Please consult documentation or filter/test.conf file in source tree for exact syntax and examples. <br><br>Maria<br><br><div class="gmail_quote">On March 26, 2019 10:34:39 AM GMT+01:00, Alexander Zubkov <green@qrator.net> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Hi,<br><br>You can try to delete AS-TRANSIT from the path and get first.<br>Something like (this is just a sketch):<br><br>delete(bgp_path, AS-TRANSIT).first ~ BOGON_ASNS<br><br>On Mon, Mar 25, 2019 at 9:50 PM Robert Scheck <bird@robert-scheck.de> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"><br> Hello folks,<br><br> can I somehow import filter only on the 2nd AS number in the AS path? I<br> know with the snippet below (heavily inspired by bgpfilterguide.nlnog.net),<br> I can filter on AS numbers that appear somewhere in the AS path, however<br> this import filter catches by nature also some pseudo-legitimate networks.<br><br> define BOGON_ASNS = [ 0, 23456, 64496..64511, 64512..65534, 65535, 65536..65551, 65552..131071, 4200000000..4294967294, 4294967295 ];<br><br> if (bgp_path ~ BOGON_ASNS) then {<br> print "Detected bogon AS path: ", net, " ", bgp_path, ", (neighbour ", from, ")";<br> }<br><br> There are unfortunately some transits with broken export filters which e.g.<br> export their DSL/FTTC and FTTH networks using private ASNs and I would like<br> to explicitly filter these (example path: AS-TRANSIT AS-BOGON1 AS-BOGON2).<br><br> The documentation has hints for first and last ASN in path, but this would<br> catch in above example only AS-TRANSIT or AS-BOGON2, but not AS-BOGON1. Any<br> pointers?<br><br> Thank you.<br><br><br> Regards,<br> Robert<br></blockquote></pre></blockquote></div><br>-- <br>Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>