BGP IPFIX Analysis, Records & Network Traffic Monitoring
Analyzing IPFIX with BGP Insights
BGP Overview
Border Gateway Protocol (BGP) is a standardized exterior gateway protocol designed to exchange routing and reachability information for connecting autonomous systems (AS is a term that is used to indicate a fully operational, independent network) to the Internet. BGP is what is used for routing on the Internet. BGP has visibility to all Internet networks, mapping them out as Autonomous Systems and which Autonomous Systems a packet flow has to go through as it makes its way from source to destination IP addresses.
The paths or routes between Autonomous Systems are composed of the ASN identifier of every AS in the route to a given destination AS. The BGP routing protocol is used by border routers to “advertise” these routes to and from an AS to other systems that need them in order to deliver traffic to another network.
The advertising of routes helps a network operator in two ways that are critical to efficiently managing traffic flows across their networks. The first is to make informed routing decisions concerning the best path for a particular route to take outbound from a network. Otherwise border routers would default to the same route for all traffic flows destined for transit providers. Secondly, operators can advertise their routes to those transit providers, for them to make available to peering routers and external transit routers for their use.
BGP Traffic Analysis with IPFIX
Analyzing BGP paths is a very effective way to understand how network traffic is traversing the Internet. BGP routing information alone, however, does not provide visibility to how much traffic is on any given path. In order to do this, the BGP data needs to be correlated with IPFIX data so that not only the paths available in the network are shown, but also what paths are actually being used and the traffic volume on each path between autonomous systems.
Support for BGP fields in IPFIX enables the export of source AS, destination AS, and BGP next hop information. BGP next hop data provided the possibility for network engineers to know which BGP peer, and hence which neighbor AS, outbound traffic was flowing through. More recently, traffic flow analysis solutions have used BGP passive peerings to gather routing updates directly from the protocol.
BGP IPFIX Analysis Use Cases
This enables various use cases for network monitoring and peering analysis:
- Quickly notice AS path, peering, or traffic engineering anomalies
- Pick a specific peer, customer, or site and see a complete view of where the traffic is coming from, passing through, and exiting
- See in a snapshot which countries/regions/cities traffic is going to or coming from
- View traffic on a single BGP path and see how it changed over time
- Determine least cost path routing depending on traffic volumes and paths
This analysis can be used by network operators to answer fundamental questions about their network including:
- Who is my traffic going to? Which AS paths is it taking? Which country or region does it terminate in?
- Whom should I connect (peer) to? Which transit provider is the most cost effective?
- How much is traffic costing me for a particular server, customer, or peer?
- Should I add more circuit capacity to my network? What paths?
- Do I need new peering agreements to reduce traffic costs?
BGP IPFIX Analysis correlates IPFIX records with BGP routing info to not only visualize AS paths but see how much traffic is traversing these paths in real-time. BGP-based peering analysis can be performed on this data in real-time using different filters without building a presentation dataset from scratch. Real-time analysis of the full dataset means that the number of operationally relevant use cases explodes, because the number of different questions that you can ask is never limited by predefined reporting tables that you’ve had to populate in advance.
In this approach, the combination of filters on which you can run a query in real time is nearly infinite. And because you can ask what you want when you want, it’s possible to enable a completely interactive — and therefore far more intuitive — presentation of BGP traffic paths.
More Reading about BGP
To get other expert perspectives and details on BGP and NetFlow, sFlow and IPFIX analysis see these blog posts…
BGP Routing Tutorial Series, Part 1
The Evolution of BGP NetFlow Analysis, Part 1
Evolution of BGP NetFlow Analysis, Part 2
About Kentik Solutions for BGP and jflow
Kentik offers a suite of advanced network monitoring solutions designed for today’s complex, multicloud network environments. The Kentik Network Observability Platform empowers network pros to monitor, run and troubleshoot all of their networks, from on-premises to the cloud. Kentik’s network monitoring solution addresses all three pillars of modern network monitoring, delivering visibility into network flow, powerful synthetic testing capabilities, and Kentik NMS, the next-generation network monitoring system.
To see how Kentik can bring the benefits of network observability to your organization, request a demo or sign up for a free trial today.
