Monitoring, Measurement and Testing

Author

K19G

Updated

October 31, 2026

Monitoring, Measurement and Testing

You cannot defend what you cannot see, and you cannot observe global interdomain routing anomalies from the perspective of a single border router. Comprehensive routing defense requires continuous global measurement, real-time streaming telemetry, and isolated testing environments where security controls can be validated safely before live deployment.

Real-Time Route Monitoring: BGPStream, RIS-Live and RouteViews

Modern security operations centers (SOCs) and network operations centers (NOCs) rely on distributed telemetry frameworks to monitor their prefixes from hundreds of external vantage points:

+-----------------------------------------------------------+
|                   Global Telemetry Collectors             |
|                                                           |
|  +-------------------+             +-------------------+  |
|  | RouteViews (UO)   |             | RIPE RIS (Europe) |  |
|  | Hundreds of peers |             | Distributed RRCs  |  |
|  +---------+---------+             +---------+---------+  |
|            |                                 |            |
+------------|---------------------------------|------------+
             |                                 |
             v                                 v
+-----------------------------------------------------------+
|               Real-Time Streaming Pipelines               |
|                                                           |
|  - RIS-Live (WebSocket JSON stream of raw updates)        |
|  - BGPStream (C++ / Python framework for MRT and streams) |
|  - BGPalerter (Automated standalone monitoring daemon)    |
+-----------------------------+-----------------------------+
                              |
                              v
+-----------------------------------------------------------+
|                 Operator Alerting & Defense               |
|                                                           |
|  - Instant Slack / PagerDuty / Webhook alarms             |
|  - Automated mitigation: disaggregate / activate ROA      |
+-----------------------------------------------------------+

1. RIPE RIS and RIS-Live

The RIPE Routing Information Service (RIS) operates remote route collectors (RRCs) at major Internet Exchange Points globally (London, Amsterdam, Tokyo, New York). RIS-Live exposes a real-time WebSocket firehose delivering BGP UPDATE messages within milliseconds of their occurrence on global backbones.

2. RouteViews

Operated by the University of Oregon, RouteViews provides multi-decade historical MRT archives and live multihop BGP peering with Tier-1 and Tier-2 service providers, serving as the gold standard for routing research and forensic investigation.

3. BGPStream and BGPalerter

  • BGPStream: An open-source software framework for parsing, filtering, and analyzing historical MRT dumps and real-time live BGP data streams.
  • BGPalerter: A self-hosted open-source monitoring application that tracks an organization’s prefixes, ASNs, and ROAs, firing instant webhook alerts if a prefix is hijacked, a route leaks, or a ROA nears expiration.

Looking Glasses and Prefix Monitoring Services

When an alert fires, engineers need interactive visibility into remote routing tables: - Looking Glasses (LG): Publicly accessible web portals hosted by Tier-1 operators (e.g., Level3/Lumen, NTT, Hurricane Electric) allowing operators to execute ping, traceroute, and show ip bgp <prefix> from specific points of presence across the planet. - Commercial SaaS Monitors: Services such as Cloudflare Radar, Cisco ThousandEyes, and Kentik provide graphical dashboards mapping global propagation paths, prefix visibility percentages, and AS path changes.

Safe Testing: Lab Environments and Controlled Announcements

Deploying new route policies or RPKI validators directly into production is unacceptably risky. Safe verification requires staging in containerized and software-defined testbeds:

1. Containerlab Network Topologies

Using Containerlab, engineers spin up multi-vendor containerized topologies (FRR, Nokia SR Linux, Arista cEOS, BIRD) running on a single developer workstation or CI/CD runner. Topologies simulate upstream transit providers, lateral peers, relying party validators (Routinator), and malicious rogue ASes.

# Example Containerlab test snippet simulating an upstream validator
name: bgp-security-lab
topology:
  nodes:
    validator:
      kind: linux
      image: routinator/routinator:latest
    border-router:
      kind: linux
      image: frrouting/frr:latest
    attacker-as:
      kind: linux
      image: frrouting/frr:latest

2. The PEERING Testbed

For academic and controlled research, the PEERING testbed (operated by USC and partner universities) allows vetted researchers to announce experimental prefixes into the real global Internet from multiple worldwide locations to measure live propagation dynamics without disrupting commercial traffic.

Public Incident Detection Systems and Alerts

Automated detection engines scan global feeds to identify attacks: - CAIDA BGP Mon: Automatically reconstructs prefix hijack events and tracks global prefix churn. - MANRS Observatory: Aggregates routing incidents per Autonomous System, scoring network operators on their compliance with anti-spoofing, filtering, and RPKI deployment standards.

Metrics That Matter: Convergence, Stability and Coverage

To evaluate the operational health of an organization’s routing posture, operators track five primary Key Performance Indicators (KPIs): 1. ROA Coverage: Percentage of announced IPv4 and IPv6 prefixes covered by valid ROAs (Target: 100%). 2. ROV Filtering Rate: Percentage of peering sessions actively enforcing hard drops on Invalid routes (Target: 100% of transit and peer sessions). 3. Prefix Stability / Flap Rate: Number of route withdrawal events per hour across peering sessions. 4. Convergence Latency: Time required for a planned BGP withdrawal or announcement to achieve 95% global propagation across RouteViews collectors (Target: \(< 60\) seconds). 5. ASPA Compliance: Progress in documenting and publishing upstream transit relationships in ASPA objects.