GSoC idea: real-time BGP monitor

[romain-fontugne]

To help operators to monitor their prefixes we could design a tool that shows route in real-time using RIS live (https://ris-live.ripe.net/)
This would need:

• implement an interface to get a prefix and set of collectors from the user (or a way to select all prefixes originated by an AS)
• connect to RIS live websocket with filters corresponding to the user input
• display a graph that shows the routes
• implementing filters to cut the routes to a certain depth (e.g. only three hops from origin AS)
• could be improved by showing RPKI/IRR status or other information related to the prefix (preferably real-time information)

[psankhe28]

Hello @romain-fontugne, I'm interested in contributing to this project for GSoc 2024. I'd appreciate some guidance on getting acquainted with the codebase and the initial steps to begin. Additionally, I have a few questions:

It seems we are developing a dashboard-style website to display various graphs with customization options, fetching data from RIS. Will the data be updated at specific intervals, or is it a continuous process? Also, is there a plan for a separate backend, or is there a proposed approach for handling data retrieval and updates?

[romain-fontugne]

Hi,
I think there is two ways to implement this:

1. Directly in the IHR website, so you should get familiar with the code for IHR main website: https://github.com/InternetHealthReport/ihr-website.
2. This could be done in an observable notebook that can then be integrated in IHR website.

Either way is fine. For 1. you'll need to know vue.js.

The data is continuously updated. As explained in the RIS live documentation, the data is available via a websocket and it gives data in near-real time. The goal of this project is to also make the visualization in near-real time. If possible we'd like to read data directly from RIS, having a separate backend would add more complexity to the project.

[ArnabBCA]

@romain-fontugne I have few questions:

1. What kind of line chart do you want to show like how many times a same peer is advertised?
2. To show the RPKI status which API we have to fetch?
3. And what additional information about ASes using IYP we have to show?

[romain-fontugne]

1. There is a lot of different visualizations that we can provide. For example, a graph (node and links) showing the paths to the monitored prefix. A line chart showing the number of messages over time. A stacked line chart showing the share of upstreams over time.
2. Live RPKI data is available at: https://rpki.gin.ntt.net/api/export.json
3. At least name and registered country

[ArnabBCA]

Hello, Sir i saw that https://rpki.gin.ntt.net/api/export.json the json data is huge about 50mb :D loading this data in the website will take more time. Is there any way we can pass query param like https://stat.ripe.net/docs/02.data-api/rpki-validation.html

[romain-fontugne]

Then we should find a different way. I'm afraid the stat.ripe.net is not realtime data

[ArnabBCA]

Ok, I will do some research and inform you, if there is a different way.

[RickDeb2004]

@romain-fontugne I have gone through the idea and done some sort of analysis , have some queries about it?
1.How frequently should the tool update the data from RIS live to ensure real-time monitoring without overwhelming the system or users?
2.For handling the large amount of data efficiently, will there be any options like data aggregation and filtering to improve performance?
3.Should the tool have any other features for network operators like alerting or notifying about some special events, like changing in routing paths
I would like to know about these

[romain-fontugne]

Hi,

1. The data comes in real time from the RIS websocket, the tool doesn't have to periodically fetch data. If there is too much data coming in we could process data in batch but I don't think it will be needed.
2. Yes the user has to give filters to start the tool. If performance is not good then we should think about how to aggregate data
3. This is not planned for the first version of the tool, but could be a nice feature to have in the future

[AdamLucife]

@romain-fontugne I have gone through the documentation and I got one small question what should be the filter parameter? Prefix and path? And what specific data this live bgp monitor will show.

[romain-fontugne]

For the filters:

- implement an interface to get a prefix and set of collectors from the user
- connect to RIS live websocket with filters corresponding to the user input

For the graph:

• at least a graph (node/edges) that shows the paths
• a few line chart that show stats over time, for example number of changes over time

[0xAnon0602]

Hey @romain-fontugne I've few question regarding this

1. We are going to use the websocket endpoint provided by https://ris-live.ripe.net/ for all the realtime data to be displayed on the UI right?
2. Which types of graph do you think will be best to display the routes?
3. Do you think we need knowledge of IYP for any data to implement this idea?

[romain-fontugne]

Hi,

1. Yes, RIS live data for the realtime data and we may need IYP data for adding some extra information
2. I'm not completely sure yet, but at least a graph (node/links) to show the routes to the prefix would be good and maybe a few line charts to show stats over time (number of changes over time for example)
3. We can get simple things like AS names from IYP

[0xAnon0602]

@romain-fontugne
In 2
You mean the routes to reach the ASN provided by the UI, which changes with each update message, correct?

This is the path that RIS Live gives us, so we probably need to use this to show it in a meaningful graph, right or I am missing something?

[romain-fontugne]

yes, that's correct! 👍

[Arunjagan12]

@romain-fontugne sir, I tried using BGPlay. If I give any input like ASN, IP prefix, either it takes more time to load due to large amount of data or gives a pop-up stating that the graph might be unresponsive. To tackle these issues while implementing it in IHR website, could you suggest some measures that can be taken into this??

[romain-fontugne]

BGPlay shows the whole path for update messages, we want to show only the closest ASes to the monitored (which actually are the last ASes in the paths) so the number of nodes will be much smaller than the ones displayed by bgplay