For the geeks that may be interested:
I have a honeypot that sends malicious IPs to a exabgp server that in turn customers and company Mikrotik routers connect to and blackhole route the offending IPs.
I wanted to visualize the number of IP address that were blocked. I scripted the Mikrotik to send any changes to the count to my OLED display connected to a Particle Photon. Could use a Raspberry Pi or anything that has Internet capability. I threw this together in like 15 minutes late at night so I am sure it could be done better but it does work good.
:local bgpPrefixCount [/routing bgp peer get [find] prefix-count];
:global lastbgpPrefixCount;
# Check to see if lastbgpPrefixCount variable is null and if so set to 1
:if ($lastbgpPrefixCount~"^\$") do={
:set lastbgpPrefixCount 1;
} else {
:log info "BGP Prefix is not NULL"
}
:if ($bgpPrefixCount != $lastbgpPrefixCount) do={
:log info message="$bgpPrefixCount";
/tool fetch mode=https keep-result=no http-method=post url=https://api.particle.io/v1/devices/YourDeviceID/YourFunctionName http-data="access_token=YourAccessToken¶ms=$bgpPrefixCount"
:set lastbgpPrefixCount $bgpPrefixCount;
:log info message="BGP Prefix Count Updated"
} else={
:log info message="BGP Prefix Count Unchanged";
}
