receiving prefixes advertised by a network device;

receiving traffic flow data for network traffic that was transmitted through the network device;

for the received traffic flow data, filtering the traffic flow data to remove all traffic transmitted from a compute service provider network to outside of the compute service provider network so that the filtered traffic flow data includes network traffic transmitted to the compute service provider network;

comparing the advertised prefixes to the filtered traffic flow data;

based upon the comparison, identifying traffic that is following a static route being transmitted towards the compute service provider network through the network device; and

transmitting an alarm condition associated with the static routes.