Filtering what you announce
Most big routing incidents are not attacks. They are a network announcing routes it should not have, because a filter was missing. Good filtering is the fix.
The two directions
Filter what you announce, so only your own prefixes leave your network — a missing outbound filter is how a route leak takes down someone else's traffic. And filter what you accept, so a neighbour's mistake or a hijack does not get installed in your table. Both are mandatory, not optional hygiene.
Build filters from the registries
Generate your accept-lists from routing registry data and the customer's documented prefixes, and rebuild them regularly as those change. A static filter written once and forgotten slowly drifts from reality. This is the groundwork that makes running BGP with us safe.
RPKI on top
RPKI adds cryptographic proof of which AS may originate a prefix, so an invalid announcement is dropped even if it slips a prefix filter. Filters and RPKI together are belt and braces — we run both, and expect anyone we peer with to filter properly. See routing problems when something still looks wrong.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base