Executive-ready report for Service Provider BGP event analysis
IPv4 and IPv6 findings are analyzed and reported separately to avoid mixing address families and to align with standard NOC review workflows.
The analyzed BGP dataset shows moderate operational activity. The system reduced raw BGP update noise into 46 candidate operational cases and 10 Origin-AS change cases, with results separated by address family to avoid mixing operational contexts.
The highest-priority IPv4 finding is prefix 146.66.28.0/22, marked High severity due to 7,731 total updates. AS43016 accounts for 7,729 of those updates, indicating concentrated origin-specific activity that warrants routing-team review.
The highest overall update volume is an IPv6 prefix and is detailed in the IPv6 section below. IPv4 findings are presented first in accordance with standard NOC review practice.
Recommended next step: review origin stability, peer propagation behavior, and whether observed activity corresponds to a planned operational event, migration, or traffic-engineering action before escalating to incident.
| Prefix | Case type | Severity | Updates | Announces | Withdraws | W. Ratio | Main Origin AS |
|---|---|---|---|---|---|---|---|
| 146.66.28.0/22 | Operational Reorigin | HIGH | 7,731 | 7,722 | 9 | 0.0012 | AS43016 |
| 206.168.162.0/23 | High Activity Prefix | HIGH | 3,113 | 2,911 | 202 | 0.0649 | AS399240 |
| 206.168.163.0/24 | High Activity Prefix | HIGH | 3,095 | 2,896 | 199 | 0.0643 | AS399240 |
| 206.168.160.0/24 | High Activity Prefix | HIGH | 3,078 | 2,876 | 202 | 0.0656 | AS399240 |
| 206.168.161.0/24 | High Activity Prefix | MED | 2,970 | 2,789 | 181 | 0.0609 | AS399240 |
| 187.249.2.0/24 | High Activity Prefix | MED | 2,728 | 2,657 | 71 | 0.0260 | AS32098 |
| 206.168.160.0/22 | High Activity Prefix | MED | 2,631 | 2,470 | 161 | 0.0612 | AS399240 |
| 205.164.242.0/24 | High Activity Prefix | MED | 2,547 | 2,380 | 167 | 0.0656 | AS399240 |
| 38.17.44.0/23 | High Activity Prefix | MED | 2,482 | 2,321 | 161 | 0.0649 | AS399240 |
| 194.143.156.0/23 | High Activity Prefix | MED | 1,881 | 1,810 | 71 | 0.0377 | AS34701 |
| Prefix | Severity | Distinct Origins | Origin AS list | Updates |
|---|---|---|---|---|
| 189.76.77.0/24 | MED | 6 | AS2, AS52752 + 4 more | 102 |
| 38.148.247.0/24 | MED | 2 | AS213840, AS8796 | 103 |
| 200.9.22.0/24 | LOW | 6 | AS266190, AS274651 + 4 more | 71 |
| 103.28.81.0/24 | LOW | 6 | AS45723, AS4800 + 4 more | 68 |
| 103.28.82.0/24 | LOW | 6 | AS45723, AS4800 + 4 more | 68 |
| 187.62.192.0/24 | LOW | 5 | AS262617, AS266532 + 3 more | 71 |
| 197.214.55.0/24 | LOW | 2 | AS327708, AS37531 | 32 |
| 197.214.8.0/24 | LOW | 2 | AS327708, AS37531 | 31 |
| 197.214.60.0/22 | LOW | 2 | AS327708, AS37531 | 31 |
Top 10 shown. Full dataset of 36 IPv6 candidate cases is available in the evidence package.
| Prefix | Severity | Updates | Announces | Withdraws | W. Ratio | Main Origin AS |
|---|---|---|---|---|---|---|
| 2602:feda:b8d::/48 | HIGH | 9,525 | 6,010 | 3,515 | 0.369 | AS200334 |
| 2806:202::/32 | HIGH | 3,089 | 3,075 | 14 | 0.0045 | AS28458 |
| 2a10:9902:732::/48 | HIGH | 1,361 | 1,068 | 293 | 0.2153 | AS211972 |
| 2804:4bec::/32 | MED | 2,239 | 1,891 | 348 | 0.1554 | AS28669 |
| 2804:1070::/32 | MED | 2,032 | 1,991 | 41 | 0.0202 | AS28209 |
| 2a05:3e04::/32 | MED | 1,773 | 1,608 | 165 | 0.0931 | AS29484 |
| 2a14:3f87:9800::/38 | MED | 1,715 | 1,575 | 140 | 0.0816 | AS64289 |
| 2a02:ac80:60::/48 | MED | 1,264 | 1,251 | 13 | 0.0103 | AS25145 |
| 2a02:ac80:300::/48 | MED | 1,259 | 1,236 | 23 | 0.0183 | AS25145 |
| 2a02:ac80:4000::/48 | MED | 1,259 | 1,236 | 23 | 0.0183 | AS25145 |
| Prefix | Severity | Distinct Origins | Origin AS list | Updates |
|---|---|---|---|---|
| 2606:6e00:8000::/35 | MED | 6 | AS200334, AS7296 + 4 more | 491 |
Each analysis run produces a structured, auditable output folder. All stages are preserved independently.
Interested in running this analysis on your own BGP data?
Request a free demo