Methods and systems for monitoring network routing
The disclosed methods and systems include collecting routing data from a plurality of network routers, and correlating the routing data across routers and across time to obtain network data. The network data can be streamed to a user in real-time and the user can interactively query the data. In one embodiment, interactive routing analyzes, drill-down, and forensics can be performed using a repository of Border Gateway Protocol (BGP) update traffic. Alarms can be set to detect selected routing problems. In setting the alarms, the message data for each router can be processed in timestamp order. Current message data from each router can be compared with previous message data to determine a condition status. An alarm can be provided when the condition status meets a temporal correlation criterion and/or a spatial correlation criterion. Based on the computed instability metrics for individual network prefixes and on a common property of those prefixes, a group instability metric for a group of network prefixes can be computed.
1. A method comprising:
computing a first set of network instability metrics, corresponding to a first set of related network prefixes sharing a first common property, based on a first plurality of route changes associated with the first set of related network prefixes;
computing a second set of network instability metrics, corresponding to a second set of related network prefixes sharing a second common property, based on a second plurality of route changes associated with the first set of related network prefixes;
configuring a graphical user interface (GUI) to simultaneously display:
(a) a representation of the first set of network instability metrics associated with the first set of related network prefixes, and
(b) a representation of the second set of network instability metrics associated with the second set of related network prefixes,
wherein the method is performed by at least one device comprising a hardware processor.
2. The method of claim 1 , wherein the first set of related network prefixes and the second set of related network prefixes share a third common property.
3. The method of claim 2 , wherein:
the first common property corresponds to a first geographic region,
the second common property corresponds to a second geographic region, and
the third common property corresponds to a third geographic region comprising the first geographic region and the second geographic region.
4. The method of claim 2 , wherein:
the first common property corresponds to a first organizational entity,
the second common property corresponds to a second organizational entity, and
the third common property corresponds to a relationship between the first organizational entity and the second organizational entity.
5. The method of claim 1 , wherein:
the first common property corresponds to a first geographic region,
the second common property corresponds to a second geographic region, and
the GUI is configured to simultaneously display:
(a) the representation of the first set of network instability metrics in association with the first geographic region, and
(b) the representation of the second subset of network instability metrics in association with the second geographic region.
6. The method of claim 1 , further comprising:
computing a group network instability metric based on a combination of the first set of network instability metrics,
wherein configuring the GUI to display the representation of the first set of network instability metrics comprises configuring the GUI to display the group network instability metric.
7. The method of claim 1 , further comprising:
identifying the first set of related network prefixes and the first set of network instability metrics, wherein the identifying comprises:
(a) determining that the first set of network prefixes shares the first common property; and
(b) determining that the first set of network instability metrics exceed a particular threshold.
8. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising:
computing a first set of network instability metrics, corresponding to a first set of related network prefixes sharing a first common property, based on a first plurality of route changes associated with the first set of related network prefixes;
computing a second set of network instability metrics, corresponding to a second set of related network prefixes sharing a second common property, based on a second plurality of route changes associated with the first set of related network prefixes;
configuring a graphical user interface (GUI) to simultaneously display:
(a) a representation of the first set of network instability metrics associated with the first set of related network prefixes, and
(b) a representation of the second set of network instability metrics associated with the second set of related network prefixes.
9. The medium of claim 8 , wherein the first set of related network prefixes and the second set of related network prefixes share a third common property.
10. The medium of claim 9 , wherein:
the first common property corresponds to a first geographic region,
the second common property corresponds to a second geographic region, and
the third common property corresponds to a third geographic region comprising the first geographic region and the second geographic region.
11. The medium of claim 9 , wherein:
the first common property corresponds to a first organizational entity,
the second common property corresponds to a second organizational entity, and
the third common property corresponds to a relationship between the first organizational entity and the second organizational entity.
12. The medium of claim 8 , wherein:
the first common property corresponds to a first geographic region,
the second common property corresponds to a second geographic region, and
the GUI is configured to simultaneously display:
(a) the representation of the first set of network instability metrics in association with the first geographic region, and
(b) the representation of the second subset of network instability metrics in association with the second geographic region.
13. The medium of claim 8 , the operations further comprising:
computing a group network instability metric based on a combination of the first set of network instability metrics,
wherein configuring the GUI to display the representation of the first set of network instability metrics comprises configuring the GUI to display the group network instability metric.
14. The medium of claim 8 , the operations further comprising:
identifying the first set of related network prefixes and the first set of network instability metrics, wherein the identifying comprises:
(a) determining that the first set of network prefixes shares the first common property; and
(b) determining that the first set of network instability metrics exceed a particular threshold.
15. A system comprising:
one or more hardware processors; and
one or more one or more non-transitory computer-readable media storing instructions, which when executed by the one or more hardware processors, cause execution of operations comprising:
computing a first set of network instability metrics, corresponding to a first set of related network prefixes sharing a first common property, based on a first plurality of route changes associated with the first set of related network prefixes;
computing a second set of network instability metrics, corresponding to a second set of related network prefixes sharing a second common property, based on a second plurality of route changes associated with the first set of related network prefixes;
configuring a graphical user interface (GUI) to simultaneously display:
(c) a representation of the first set of network instability metrics associated with the first set of related network prefixes, and
(d) a representation of the second set of network instability metrics associated with the second set of related network prefixes.
16. The system of claim 15 , wherein the first set of related network prefixes and the second set of related network prefixes share a third common property.
17. The system of claim 16 , wherein:
the first common property corresponds to a first geographic region,
the second common property corresponds to a second geographic region, and
the third common property corresponds to a third geographic region comprising the first geographic region and the second geographic region.
18. The system of claim 16 , wherein:
the first common property corresponds to a first organizational entity,
the second common property corresponds to a second organizational entity, and
the third common property corresponds to a relationship between the first organizational entity and the second organizational entity.
19. The system of claim 15 , wherein:
the first common property corresponds to a first geographic region,
the second common property corresponds to a second geographic region, and
the GUI is configured to simultaneously display:
(a) the representation of the first set of network instability metrics in association with the first geographic region, and
(b) the representation of the second subset of network instability metrics in association with the second geographic region.
20. The system of claim 15 , the operations further comprising:
computing a group network instability metric based on a combination of the first set of network instability metrics,
wherein configuring the GUI to display the representation of the first set of network instability metrics comprises configuring the GUI to display the group network instability metric.