Network observability solution for detecting routing anomalies
In one implementation, a method is disclosed comprising: identifying, based on path tracing probes sent through a network, data plane forwarding paths between nodes in the network; determining, based on topology data for the network, expected protocol-based paths between the nodes; detecting, based on a comparison of the data plane forwarding paths and the expected protocol-based paths between the nodes, a routing anomaly in the network when the data plane forwarding paths and the expected protocol-based paths differ; and causing performance of a mitigation action in the network with respect to the routing anomaly.
1 . A method, comprising:
identifying, by a device and based on path tracing probes sent through a network, all data plane forwarding paths being utilized for traffic between two particular nodes in the network, wherein the path tracing probes are generated to ensure distribution across all potential paths between the two particular nodes in the network;
determining, by the device and based on topology data for the network, all expected protocol-based paths to be utilized for traffic between the two particular nodes and translating each expected protocol-based path into a corresponding ordered sequence of path tracing interface identifiers, based on telemetry-derived associations between egress interfaces corresponding to hops of the expected protocol-based path and respective path tracing interface identifiers;
detecting, by the device, a routing anomaly in the network based on a comparison of the ordered sequence of path tracing interface identifiers for each expected protocol-based path against ordered path tracing interface-identifier sequences obtained from the path tracing probes; and
causing, by the device, performance of a mitigation action in the network with respect to the routing anomaly.
2 . The method as in claim 1 , wherein the routing anomaly is a blackholing path.
3 . The method as in claim 2 , wherein the blackholing path is detected based on an expected protocol-based path not being detected as a data forwarding path by the path tracing probes.
4 . The method as in claim 1 , wherein the routing anomaly is a wrong or non-expected path.
5 . The method as in claim 4 , wherein the wrong or non-expected path is detected based on a data forwarding path detected by the path tracing probes not mapping to an expected protocol-based path.
6 . The method as in claim 1 , wherein the expected protocol-based paths are equal cost multi-path paths between two nodes in the network.
7 . The method as in claim 1 , wherein the expected protocol-based paths are based on an interior gateway protocol.
8 . The method as in claim 1 , wherein translating each expected protocol-based paths between the two particular nodes comprises translating a list of Layer 3 adjacencies into the corresponding ordered sequence a list of path tracing interface identifiers using the telemetry-derived associations.
9 . The method as in claim 1 , further comprising:
generating the path tracing probes with different flow labels such that each path tracing probe is routed through a different forwarding path in the network.
10 . The method as in claim 1 , wherein each unique data plane forwarding path of the data plane forwarding paths is identified based on a sequence of path tracing identifiers acquired from egress interfaces traversed by a corresponding path tracing probe.
11 . The method as in claim 1 , wherein detecting the routing anomaly includes identifying a node in the network at which a path is being drifted from a correct path.
12 . The method as in claim 1 , wherein the mitigation action includes generating an alert that indicates a misconfigured line card at a particular node.
13 . The method as in claim 1 , wherein the mitigation action includes reconfiguring a node in the network to mitigate the routing anomaly.
14 . An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the one or more network interfaces and configured to execute one or more processes; and
a memory configured to store a process that is executable by the processor, the process, when executed, configured to:
identify, based on path tracing probes sent through a network, all data plane forwarding paths being utilized for traffic between two particular nodes in the network, wherein the path tracing probes are generated to ensure distribution across all potential paths between the two particular nodes in the network;
determine, based on topology data for the network, all expected protocol-based paths to be utilized for traffic between the two particular nodes and translate each expected protocol-based path into a corresponding ordered sequence of path tracing interface identifiers, based on telemetry-derived associations between egress interfaces corresponding to hops of the expected protocol-based path and respective path tracing interface identifiers;
detect a routing anomaly in the network based on a comparison of the ordered sequence of path tracing interface identifiers for each expected protocol-based path against ordered path tracing interface-identifier sequences obtained from the path tracing probes; and
cause performance of a mitigation action in the network with respect to the routing anomaly.
15 . The apparatus as in claim 14 , wherein the routing anomaly is a blackholing path and wherein the blackholing path is detected based on an expected protocol-based path not being detected as a data forwarding path by the path tracing probes.
16 . The apparatus as in claim 14 , wherein the routing anomaly is a wrong or non-expected path, wherein the wrong or non-expected path is detected based on a data forwarding path detected by the path tracing probes not mapping to an expected protocol-based path, and wherein detecting the routing anomaly includes identifying a node in the network at which a path is being drifted from a correct path.
17 . The apparatus as in claim 14 , wherein the expected protocol-based paths are equal cost multi-path paths between two nodes in the network and wherein the expected protocol-based paths are based on an interior gateway protocol.
18 . The apparatus as in claim 14 , wherein the process is further configured to:
translate each expected protocol-based paths between the two particular nodes by translating a list of Layer 3 adjacencies into the corresponding ordered sequence of path tracing interface identifiers using the telemetry-derived associations.
19 . The apparatus as in claim 14 , wherein the mitigation action comprises at least one of: reconfiguring a node in the network to mitigate the routing anomaly or generating an alert that indicates a misconfigured line card at a particular node.
20 . A tangible, non-transitory, computer-readable medium having computer-executable instructions stored thereon that, when executed by a processor on a computer, cause the computer to perform a method comprising:
identifying, based on path tracing probes sent through a network, all data plane forwarding paths being utilized for traffic between two particular nodes in the network, wherein the path tracing probes are generated to ensure distribution across all potential paths between the two particular nodes in the network;
determining, based on topology data for the network, all expected protocol-based paths to be utilized for traffic between the two particular nodes and translating each expected protocol-based path into a corresponding ordered sequence of path tracing interface identifiers, based on telemetry-derived associations between egress interfaces corresponding to hops of the expected protocol-based path and respective path tracing interface identifiers;
detecting a routing anomaly in the network based on a comparison of the ordered sequence of path tracing interface identifiers for each expected protocol-based path against ordered path tracing interface-identifier sequences obtained from the path tracing probes; and
causing performance of a mitigation action in the network with respect to the routing anomaly.