Just for making sure which asn we should track in both hegemony and Network Delay Alarms ?

[mohamedawnallah]

This is part of Hegemony Alarms Response which one to track here asn or originasn so that it would be counted correctly on the data visualizations?

This is part of Network Dealy Alarms Response which one to track here startpoint_name or endpoint_name so that it would be counted correctly on the data visualizations?

[romain-fontugne]

let's use originasn and startpoint_name

[mohamedawnallah]

Resolved in this PR:
InternetHealthReport/ihr-website#554

[romain-fontugne]

Actually after playing a bit with the dashboard, it would be nice to have an option in the user interface to choose if the aggregation is the source or origin of the alarms. If it is too much work, we can just open an issue for it, so we remember about that

[mohamedawnallah]

I'm a little bit confused by the distinction between "origin" and "source" here. In English, "source" typically refers to the point of origin or the source of the event. However, I've come across instances in internet-related contexts where "origin" seems to be a destination as seen in the following image by CAIDA ?

[mohamedawnallah]

Yeah little bit twist sorry for the dump question 😁 I forgot it was based on the request-response model that initiated the request:
https://stackoverflow.com/questions/34316146/for-network-traffic-what-does-the-word-origin-mean-to-you#:~:text=An%20origin%20is%20where%20something,response%20of%20many%20network%20protocols.

[romain-fontugne]

no problem, that's always confusing. In BGP the origin AS announces an IP prefix (e.g. 102.12.12.0/24) so that anyone on the Internet can reach these IPs. When other computers do send traffic to these IPs then they are the destination of the traffic

[mohamedawnallah]

So related to adding options in UI to filter source/origins, In the context of different alarm types:

Hegemony and Network Delay Alarms:

The ideas of origin and source are only present here.

Grip Alarms:

Here, there are attackers (similar to a source, though many values are empty) and victims (akin to origin/destination, consistently populated).

Ioda Alarms:

In these alarms, there's only the concept of an "entity" from which the request originates (akin to origin).

Considering these distinctions, it appears that creating filters based on whether the alarm source refers to origin or source might not be consistent across all data sources. On the other hand, if we consider all alarms to refer to the origin/destination (the current state), it would maintain consistency as it is currently.

What are your thoughts on this perspective?

[romain-fontugne]

ok, we can leave it as it is now 👍