Systems and methods for preemptive detection and correction of network issues based on control plane messaging
Provided is a Routing Early Warning System (“REWS”) that preemptively detects and corrects network issues based on control plane messaging. REWS receives control plane messages for network paths to a source node, groups the control plane messages to different bins based on time, detects an anomaly based on a number of a first set of control plane messages grouped to a particular bin differing, by a threshold amount, from a steady state number of control plane messages grouped to at least one other bin, and isolates a cause of the anomaly based on a number of updated paths and addressing of one or more nodes specified in the first set of control plane messages. REWS modifies routing of the source node data plane traffic before the anomaly significant impacts the data plane in response to detecting the anomaly and isolating the anomaly cause using the control plane messages.
1. A method comprising:
receiving a plurality of control plane messages for a plurality of paths that connect to a source node;
grouping the plurality of control plane messages to a plurality of bins based on time, wherein said grouping comprises adding a first set of the plurality of control plane messages to a particular bin of the plurality of bins;
detecting an anomaly based on a number of the first set of control plane messages grouped to the particular bin differing from a steady state number of control plane messages grouped to at least one other bin of the plurality of bins by a threshold amount;
isolating a cause of the anomaly based on which one or more paths from the plurality of paths are updated in the first set of control plane messages and the first set of control plane messages comprising addressing of one or more nodes including the source node; and
modifying routing of data plane traffic of the source node in response to detecting the anomaly and isolating the cause of the anomaly.
2. The method of claim 1 , wherein receiving the plurality of control plane messages comprises:
receiving a first subset of the plurality of control plane messages from one or more routers of a first transit provider; and
receiving a different second subset of the plurality of control plane messages from one or more routers of a second transit provider.
3. The method of claim 1 , wherein receiving the plurality of control plane messages comprises:
aggregating the plurality of control plane messages from one or more network collectors with established Border Gateway Protocol (“BGP”) sessions established with different Autonomous Systems (“ASes”).
4. The method of claim 1 further comprising:
filtering the plurality of control plane messages to retain a first subset of the plurality of control plane messages from a first AS with one or more paths to the source node, and to exclude a second AS with no paths to the source node.
5. The method of claim 1 further comprises:
determining the steady state number of control plane messages from two or more bins of the plurality of bins having a number of control plane messages that are within a specified range.
6. The method of claim 1 , wherein the plurality of control plane messages comprise BGP announcements issued by a plurality of routers that serve as network hops for the plurality of paths.
7. The method of claim 1 , wherein isolating the cause comprises:
detecting a network issue at the source node based on the first set of control plane messages specifying changes to paths from the plurality of paths that are operated by different providers, and the first set of control plane messages comprising addressing of the source node; and
detecting a network issue at a particular provider based on the first set of control plane messages specifying changes to one or more paths operated by the particular provider, and the first set of control plane messages comprising addressing of a node in addition to or different than the addressing of the source node.
8. The method of claim 1 , wherein modifying the routing comprises:
shifting the data plane traffic from a first path of the plurality of paths to a different second path of the plurality of paths in response to isolating the cause of the anomaly to a downstream event away from the source node; and
shifting the data plane traffic from the source node to an alternate node in response to isolating the cause of the anomaly to the source node.
9. The method of claim 1 further comprising:
performing a risk assessment of the anomaly by calculating a probability that the anomaly impacts flow of the data plane traffic; and
wherein modifying the routing comprises:
shifting the data plane traffic from a current path of the plurality of paths or the source node in response to the probability from the risk assessment exceeding a risk threshold; and
maintaining the data plane traffic on the current path or the source node in response to the probability from the risk assessment not exceeding the risk threshold.
10. The method of claim 1 ,
wherein detecting the anomaly comprises detecting a potential data plane issue based on the first set of control plane messages; and
wherein modifying the routing comprises implementing a shift of the data plane traffic from a current path of the plurality of paths or the source node prior to a disruption to a flow of the data plane traffic.
11. The method of claim 1 , modifying the routing comprises:
changing one or more of a routing table or a routing policy of a router at the source node.
12. The method of claim 1 , modifying the routing comprises:
redirecting the data plane traffic from a current path of the plurality of paths to a different path of the plurality of paths, or from the source node to an alternate node.
13. A system comprising:
one or more processors configured to:
receive a plurality of control plane messages for a plurality of paths that connect to a source node;
group the plurality of control plane messages to a plurality of bins based on time, wherein said grouping comprises adding a first set of the plurality of control plane messages to a particular bin of the plurality of bins;
detect an anomaly based on a number of the first set of control plane messages grouped to the particular bin differing from a steady state number of control plane messages grouped to at least one other bin of the plurality of bins by a threshold amount;
isolate a cause of the anomaly based on which one or more paths from the plurality of paths are updated in the first set of control plane messages and the first set of control plane messages comprising addressing of one or more nodes including the source node; and
modify routing of data plane traffic of the source node in response to detecting the anomaly and isolating the cause of the anomaly.
14. The system of claim 13 , wherein the one or more processors are further configured to:
receive a first subset of the plurality of control plane messages from one or more routers of a first transit provider; and
receive a different second subset of the plurality of control plane messages from one or more routers of a second transit provider.
15. The system of claim 13 , wherein the one or more processors are further configured to:
aggregate the plurality of control plane messages from one or more network collectors with established Border Gateway Protocol (“BGP”) sessions established with different Autonomous Systems (“ASes”).
16. The system of claim 13 , wherein the one or more processors are further configured to:
filter the plurality of control plane messages to retain a first subset of the plurality of control plane messages from a first AS with one or more paths to the source node, and to exclude a second AS with no paths to the source node.
17. The system of claim 13 , wherein isolating the cause comprises:
detecting a network issue at the source node based on the first set of control plane messages specifying changes to paths from the plurality of paths that are operated by different providers, and the first set of control plane messages comprising addressing of the source node; and
detecting a network issue at a particular provider based on the first set of control messages specifying changes to one or more paths operated by the particular provider, and the first set of control plane messages comprising addressing of a node in addition to or different than the addressing of the source node.
18. The system of claim 13 , wherein modifying the routing comprises:
shifting the data plane traffic from a first path of the plurality of paths to a different second path of the plurality of paths in response to isolating the cause of the anomaly to a downstream event away from the source node; and
shifting the data plane traffic from the source node to an alternate node in response to isolating the cause of the anomaly to the source node.
19. The system of claim 13 , wherein the one or more processors are further configured to:
perform a risk assessment of the anomaly by calculating a probability that the anomaly impacts flow of the data plane traffic; and
wherein modifying the routing comprises:
shifting the data plane traffic from a current path of the plurality of paths or the source node in response to the probability from the risk assessment exceeding a risk threshold; and
maintaining the data plane traffic on the current path or the source node in response to the probability from the risk assessment not exceeding the risk threshold.
20. A non-transitory computer-readable medium, storing a plurality of processor-executable instructions to:
receive a plurality of control plane messages for a plurality of paths that connect to a source node;
group the plurality of control plane messages to a plurality of bins based on time, wherein said grouping comprises adding a first set of the plurality of control plane messages to a particular bin of the plurality of bins;
detect an anomaly based on a number of the first set of control plane messages grouped to the particular bin differing from a steady state number of control plane messages grouped to at least one other bin of the plurality of bins by a threshold amount;
isolate a cause of the anomaly based on which one or more paths from the plurality of paths are updated in the first set of control plane messages and the first set of control plane messages comprising addressing of one or more nodes including the source node; and
modify routing of data plane traffic of the source node in response to detecting the anomaly and isolating the cause of the anomaly.