BGP monitoring
SIG-PMV Dublin 2019
Thomas Schmid
[email protected]problem statement
▸no history of BGP routing information
▹what? when? who?
▸regular BGP session only annonces best routes
▹CLI, netconf?
▸ris.ripe.net and BGPplay only good for an outside perspective
▸iBGPplay dead
▸ other tools commercial or complex or too simple
▹BGPmon
▹BGPreader
▹BGPstream
SIG-PMV Dublin 2019
BMP
▸BGP monitoring protocol
▹„Telemetry for BGP“ over TCP
▹RFC 7854, IETF GROW WG
▹streams BGP information per BGP session, not per
router as a normal BGP session would
Cisco Config
▹supports multiple AFs, e.g. BGP Linkstate
▹gives ADJ-RIB-In pre-policy and post-policy
bmp server 1
host 2.3.4.5 port 5000
update-source Loopback0
▹unidirectional TCP session: nothing is sent to the initial-delay 60
router
stats-reporting-period 300
initial-refresh delay 60 spread 120
!
▹no best-path selection, i.e. no RIB router bgp 680
neighbor 1.2.3.4
▹ drafts for ADJ-RIB-Out and Loc-RIB bmp-activate server 1
▹more TLVs in the future
SIG-PMV Dublin 2019
snas.io
▸ originally a Cisco-development, open-source
▹ formerly known as openBMP using pnda.io
▸ https://github.com/SNAS/
▹ chain of docker containers
▹ python API for kafka
▹ logstash integration etc.
BMP
router openbpm kafka postgres grafana
collector message bus database GUI
SIG-PMV Dublin 2019
o u t - o f- t h e - b o x G U I f e a t u r e s
▸12 dashboards
▹routing history
▹ per AS, per Peer, per Prefix, per Router
▹top-lists
▹IRR/RPKI dashboards
▹ violations, per-AS view
▹inventory
▹looking-glass
▹live AS-view
▹...
SIG-PMV Dublin 2019
SIG-PMV Dublin 2019
SIG-PMV Dublin 2019
SIG-PMV Dublin 2019
SIG-PMV Dublin 2019
SIG-PMV Dublin 2019
psql database
▸+ timescale DB
▸accessible with standard management tools e.g. pgAdmin
▸well structured and useful to build your own dashboards
▹customer views, iBGP, etc.
SIG-PMV Dublin 2019
pros and cons
▸ + scales well
▹ currently monitoring almost 2000 BGP sessions
▹ Dell PowerEdge M640, 2 x Intel Xeon Silver 4110, 64GB, 500GB SSD
▹ lightweight on the routers
▹ no visible additional load when turning on BMP
▸ + easy to adapt to your specific needs
▹ database has all the information you want
▸ - no easy „full routing table view per router“
▹ focus on changes per neighbor
▹ BGP-table, not RIB
▹ better use quagga and dump BGP table with caida tools BGPstream BGPreader for this purpose
▹ stream mrt data to openbmp collector: mrt2bmp
▸ - development stopped?
▹ no updates since 6months, gitter chat quiet
▹ but already a mature and good product
SIG-PMV Dublin 2019
new monitoring DMON
▸early stage. The dream:
▹full integrated monitoring and subsitution of existing monitoring tools: cacti, mrtg,
log, ...
▹full view over all network layers
▹full root cause analysis of failures
▹full alarming features
▹great GUI
▸source of truth: GIS
▹central database, OSS/BSS for DFN
▹all dependencies and processes already modeled
SIG-PMV Dublin 2019
Net
flow GIS
SNMP DMON
Log/
Alarm
NEMO
NEA
BMP
SIG-PMV Dublin 2019
challenges
▸GIS architecture outdated
▹20 years
▹Adabas DB
▹single threaded
▹middleware CORBA
▹missing real-time APIs
▹ mainly XML exports
▸Telemetry later
SIG-PMV Dublin 2019
Questions?