RIPE NCC Measurements Tools Workshop. Amsterdam September 2014

Size: px

Start display at page:

Download "RIPE NCC Measurements Tools Workshop. Amsterdam September 2014"

George Carroll
5 years ago
Views:

1 RIPE NCC Measurements Tools Workshop Amsterdam September 2014

2 Overview 1 - RIPEstat 2 RIPEstat Introduction to RIPE and the RIPE NCC Introduction to RIPEstat More about widgets List of widgets Exercise: Querying for a Resource Useful routing widgets Exercise: BGPlay Handling abuse Exercise: Handling Abuse Personalising RIPEstat Exercise: MyView Comparing results Exercise: Comparing Results Exercise: RIPEstat Use Cases

3 Overview 2 - RIPE Atlas 3 RIPE Atlas Introduction to RIPE Atlas What you can get from RIPE Atlas as a visitor Exploring public probes Live Demo Finding public measurements Exercise F: Analyse results Creating a measurement Exercise G: Create a measurement Network Monitoring Exercise H: Setting up Status Checks More RIPE Atlas features How to host a probe Advanced topics Use cases and success stories RIPE Atlas anchors RIPE Atlas community

4 Introduction to the RIPE NCC Section 1

5 RIPE NCC - Who are we? 5 RIPE NCC Located in Amsterdam Not-for-profit organisation One of the five Regional Internet Registries (RIRs) 10,000+ members (LIRs)

6 Our service region 6

7 What do we do? 7 Distribute IPv4, IPv6, ASNs Training courses RIPE Database Support RIPE community RIPE Atlas, RIPEStat, Resource Certification

8 RIPE (Reséaux IP Européens) 8 Started in 1989 Discussion forum open to all parties interested Not a legal entity and no formal membership Develops policies Work done in Working Groups Activities are performed on a

9 Introduction to RIPEstat Section 2

10 What is RIPEstat? 10 One interface for viewing all Internet number resource data One-stop shop

11 Landing page 11

12 What data? What sources? 12 RIPE Database Other RIR data BGP routing data (RIS) Active measurements (RIPE Atlas, DNSMON) GeoLocation (third party) Blacklist data (third party) More

13 Query? 13 IPv6 address IPv4 address ASN Hostname Country code

14 Why use RIPEstat? 14 For your own network: Is someone else announcing my prefix? How visible is my new IPv6 network? Is my BGP routing consistent with Routing Registry? Are my DNS and reverse DNS consistent? Location of my customers prefixes Was my prefix visible yesterday in Tokyo?

15 Why use RIPEstat? 15 For viewing other networks: How many IPv6 prefixes are announced in my country? IPv6 in my country compared to neighbours Who has more peers, AS1 or AS2? How does the upstream outage look? Is the prefix/asn that I want already announced? Which ASN announces an IP? Where can I report abuse from an IP?

16 Query page 16 AS3333 RIPEstat shows your own IP/ASN

17 Results default tab 17 AS3333 Widgets More tabs with results

18 More About Widgets Section 3

19 Get the data behind the widget! 19

20 Shareable URL of results 20 time zoom Immutable shareable URL for each result! URL includes: Zoom History

21 Where s the data from? 21

22 Freshness and Timescale of the Data 22 Timestamp and time period of data Can be adjusted in most cases Different widgets = different data update frequency Limits: Different maximum granularities

23 Embed the widget! 23

24 Embedding widgets on your site 24 This ISP embedded widgets on its page Prefix Count widget AS Path Length widget

25 List of Widgets Section 4

26 RIPEstat widgets (at a glance) 26 AS queried AS Overview Registry Browser Geolocation Routing Status Prefix queried Prefix Overview Registry Browser Geolocation Routing Status

27 Widget list 27

28 RIPEstat widgets (routing) 28 AS queried Routing Status BGP Update Activity Routing History Announced Prefixes AS Path Length ASN Neighbours ASN Neighbours History Prefix Count Visibility Prefix queried Routing Status BGPlay BGP Update Activity Routing History Routing History BGP Looking Glass Visibility Related Prefixes Prefix Routing Consistency Prefix Size Distribution AS Routing Consistency

29 RIPEstat widgets (DNS) 29 AS queried Reverse DNS Consistency Prefix queried Reverse DNS Reverse DNS Consistency

30 RIPEstat widgets (anti-abuse) 30 AS queried Abuse Contact Finder Prefix queried Abuse Contact Finder Blacklist Entries

31 RIPEstat widgets (database) 31 AS queried AS Overview Registry Browser Allocation History Whois Matches AS Routing Consistency Prefix queried Prefix Overview Registry Browser Address Space Hierarchy Allocation History Address Space Usage RIR Prefix Size Distribution Prefix Routing Consistency Reverse DNS Whois Matches

32 RIPEstat widgets (geographic) 32 AS queried Geolocation Geolocation History Prefix queried Geolocation Geolocation History

33 RIPEstat widgets (activity) 33 AS queried RIPE Atlas Probes RIPE Atlas Measurement Targets Prefix queried Observed Bandwidth Capacity Observed Network Activity Geolocation Geolocation History

34 RIPEstat widgets (suggestions) 34 AS queried RIPEstat Search Suggestions Prefix queried RIPEstat Search Suggestions

35 Query: Country code 35 COUNTRY CODE queried ROUTING DATABASE ACTIVITY { Country Routing Statisics Country Resource List Observed Bandwidth Capacity Observed Network Activity Address Space Distribution

36 Query: Hostname 36 HOST NAME queried AT A GLANCE { DNS { Geolocation DNS Chain Forward DNS DNS Chain Forward DNS GEOGRAPHIC ACTIVITY { Geolocation Geolocation History RIPE Atlas Measurement Targets

37 Exercise: Querying for a resource Exercise A Refer to the exercise booklet

38 Visualising BGP Routing Information Section 5

39 Querying 39 IP or ASN queried?! You get different widgets! ASN often visualised based on the prefixes it announces

40 RIS - Routing Information Service 40 RIPE NCC has been collecting BGP information since 1999 Raw data: ris.ripe.net RIS has 15 route collectors and 600+ peers RIPEstat visualises RIS data

41 At-a-glance view: Prefix queried 41 Announced? By which AS? Registered in the RIPE Database? Announced? By which AS? What % visible? Since when?

42 At-a-glance view: ASN queried 42 Announced? The rest is the same as for a prefix

43 BGPlay 43 See how your network is routed Announcements Withdrawals Path changes BGPlay shows routing history! Animated graphic Highly interactive

44 BGPlay 44 click play BGP event, ASN or ASN path details Control panel: Covered time period RRC selection Interactive animated graph Control timeline Detailed timeline with events click play click play movie

BGPlay 45 Examples: (2013/8/28-30) Prefix with announcements & withdrawals: 84.205.64.

45 BGPlay 45 Examples: (2013/8/28-30) Prefix with announcements & withdrawals: /24 Check IPv6 connectivity: 2001:67c:2e8::/48 Multi-homed prefix: /24 BGP hijacking : /24 Youtube traffic by Pakistan Telecom AS17557 Blackholing:

46 Prefixes visible for this ASN 46 IPv4 vs IPv6? Sort by prefix or Search. vs :: Time period shown in widget Default: last two weeks

47 Announced prefixes - useful for ASN 47

48 History of prefixes announced by ASN 48 subdivide prefixes according to first hop after queried ASN Time scale selection

49 Exercise: BGPlay Exercise B Refer to the exercise booklet

50 Reporting Abuse Section 6

51 Reporting abuse 51 Who is attacking your network? What kind of attack is it?

52 What to do if your network is attacked 52 Spam or unauthorised access? Find IP in message headers or logs Want to contact their admin? Find the correct for reporting abuse RIPE Database Contact details for every ASN and IP address In Europe, the Middle East and parts of Central Asia!!

53 Reporting abuse 53 Take action with the Abuse Contact Finder Go to Use Cases > Looking for Abuse Information In -depth information about abuse Enter IP address

54 Reporting abuse 54 Rating of the contact contact to report abuse

55 Reporting abuse 55 Details about the resource and abuse contact:

56 Exercise: Handling Abuse Exercise C Refer to the exercise booklet

57 Personalising RIPEstat Section 7

58 Create a RIPE NCC Access account 58

59 Why personalise RIPEstat? 59 If you have recurring lookup tasks that involve different widgets spread over multiple tabs Building a history of your lookups

60 Log in to RIPE NCC Access account 60

61 MyView 61 Create custom views Click the MyView button Drag and drop the widgets you want to the MyView tab Created under ASN or IP

62 MyView 62 MyViews are only visible to you. The option to share your views will be available soon! Newly created MyView

63 Customise MyView 63 Re-order widgets as you like Rename Re-order Control visibility Remove

64 Visibility of MyView 64 MyView is only accessible after you have queried an ASN or IP A MyView created after an ASN query is only visible for other ASN queries A MyView created after IP query is only visible for other IP queries This can be changed via settings

65 Controlling visibility 65 Monitor-2 was created after an ASN query You can change visibility, to make Monitor-2 available for IP range queries

66 MyView summary 66 RIPEAccess login required Customised selection of widgets It s like an extra tab, specifically for your queries By default, available for one type of resource (ASN or IP) Can t be shared

67 Exercise: MyView Exercise D Refer to the exercise booklet

68 Comparing Networks Section 8

69 Why compare networks? 69 Want to peer with AS-X? Learn by opening multiple widgets about AS-X Choosing upstream? Compare AS-X with AS-Y by opening same widget loaded with two different ASNs Internet outage in a country? Open multiple country-related widgets in same view!

70 How to compare 70 Compare results in different widgets Go to Use Cases > Compare Results Select widget Select resource

71 Compare results 71 Select Routing History widget 1 enter AS

72 Compare results 72 Share via Permalink

73 Compare resources summary 73 No login required Add widgets AND input query for each widget (ASN or IP or ) It is a result page with widgets and query results Share it via a permanent link

74 Comparing countries in one widget 74 Compare the growth of ASNs in DE and NL See IPv6 adoption rate in four countries at the same time Analyse IP hijacking with BGP Update Activity Widget!

75 In-widget comparison 75 Country Routing Statistics

76 Exercise: Comparing Results Exercise E Refer to the exercise booklet

77 Exercise: RIPEstat Use Cases Exercise F

78 Use cases 78 How can you see whether someone has hijacked your prefixes?! How can you see whether you had an outage?

79 Questions? 79

80 RIPE Atlas

81 Overview 2 - RIPE Atlas 81 RIPE Atlas Introduction to RIPE Atlas What you can get from RIPE Atlas as a visitor Exploring public probes Live Demo Finding public measurements Exercise F: Analyse results Creating a measurement Exercise G: Create a measurement Network Monitoring Exercise H: Setting up Status Checks More RIPE Atlas features How to host a probe Advanced topics Use cases and success stories RIPE Atlas anchors RIPE Atlas community

82 Introduction to RIPE Atlas Section 9

83 Definition 83 RIPE Atlas = global active measurements platform Goal: View Internet reachability Probes hosted by volunteers Measurements performed towards root name servers Visualised as Internet traffic maps ping, traceroute, DNS & SSL Data publicly available Users can also run customised measurements

84 RIPE Atlas coverage 84

85 RIPE Atlas coverage 85

86 Measurement devices 86 v1 & v2: Lantronix XPort Pro v3: TP-Link TL-MR3020 powered from USB port Does not work as a wireless router Same functionality as the old probe RIPE Atlas anchor: Soekris net

87 Probes photos 87

88 RIPE Atlas in numbers: August ,600+ probes connected 3,000+ active users this year! 1,000+ built-in measurements daily 5,000+ user-defined measurements daily! Available to hosts and members ping, traceroute, DNS, SSL Goal by end 2014: connected probes

89 Contacting RIPE Atlas 89 Users mailing list: Articles & updates on RIPE Labs: Questions and bugs: and #RIPEAtlas

90 What you can get from RIPE Atlas as a visitor Section 10

91 Internet traffic maps 91

92 Where is B-root? 92

93 Probes per ASN (in RIPEstat) 93

94 Where we want to place probes 94

95 Articles, papers, use cases, experiences 95

96 Looking up public probes Section 11

97 Logging-in 97 Create an RIPE NCC Access account Same for LIR Portal, RIPE Atlas, RIPEstat, RIPE Labs... Advanced LIR contact : additional benefits! Membership benefits for RIPE Atlas Share probe management with LIR colleagues Historical RIPE Database view in RIPEstat Add yourself as contact in LIR Portal

98 Searching for Probes 98 Filter based on ASN, Country, Location... My Atlas / Probes Possible to mark probes as favourites

99 Probe page - live demo 99

100 Zoomable ping graph 100 Replace multiple RRDs graphs: zoom in/out in time, in the same graph Easier visualisation of an event s details Selection of RTT class (max, min, average)

101 Finding Results of Public Measurements Section 12

102 Looking up measurement results 102 Log in to atlas.ripe.net Go to My Atlas > Measurements Tip: fast-forward to the last page ;-)

103 Searching for msm by type 103

104 Downloading measurement results 104 Click on msm, then Download Or go to URL Or use the API Results in JSON Libraries for parsing available on github

105 Anchors mesh visualisation 105 Multiple ping measurements in one view Stacked chart and interactive control panel Go to Results > Anchors > choose one from the list > ping Members/massimo_candela/ seismograph-user-guide

106 Search for msm by target in RIPEstat 106 Go to RIPEstat > RIPE Atlas Activity

107 Use existing measurements! 107 There are many measurements already running!! Search for existing public measurements first! Only then schedule your own measurement if you don t find what you re looking for

108 Exercise: Analyse Measurements Results Exercise G Refer to the exercise booklet

109 Creating a Measurement Section 13

110 Scheduling a measurement 110 Log in to atlas.ripe.net My Atlas > Measurements New Measurement or One-off Most are periodic and last a long time Choose type, target, frequency, # of probes, region... You will spend credits Or use the API:

111 Credit system 111 Measurements cost credits ping = 10 credits, traceroute = 20, etc. Hosting a probe earns credits Earn extra credits by: Why? Fairness and to avoid overload Being a member Hosting an anchor Sponsoring probes

112 Credits overview 112 My Atlas / Credits Give credits to someone

113 Exercise: Create a Measurement Exercise H Refer to the exercise booklet

114 Network Monitoring Section 14

115 Network monitoring 115 Network operators use tools for monitoring network health Nagios & Icinga Tools receive input from RIPE Atlas via the API Benefits: pings from 500 out of probes around the world See your network from the outside Plug into your existing practices

116 Integration with monitoring systems 116! 1. Create a RIPE Atlas ping measurement! 2. Go to Status Checks URL! 3. Add your alerts in Icinga or Nagios

117 Creating Status Checks 117 Status Checks work via RIPE Atlas' RESTful API MEASUREMENT_ID/ You define the alert parameters, for example: Threshold for the percentage of probes that successfully received a reply How many most recent measurements to base it on What is the maximum packet loss acceptable Documentation:

118 Icinga examples 118 Community of operators contributed configuration code! Making use of the built-in check_http plugin GitHub repo examples: scripts_for_nagios_icinga_alerts Post on Icinga blog:

119 Exercise: Setting up Status Checks Exercise I Refer to the exercise booklet

120 More RIPE Atlas Features Section 15

121 Latest results API Widget monitoring value in real time (100 probes pinging websites worldwide) Alert based on average measurements per hour Big network event, e.g. Internet outage in a region DNS domain monitoring; configurable measurements using 10 RIPE Atlas anchors suzanne_taylor_muzzin/ripe-atlas-latest-resultsapi-and-parsing-library

122 Secure creation & sharing of measurements 122 Use API keys to: Create measurements without logging in Securely share your measurement data with others To create, manage and delete API keys: Examples:

123 Security aspects 123 Probes: Hardware trust material (regular server address, keys) No open ports; initiate connection; NAT is okay Don t listen to local traffic No passive measurements Measurements triggered by command servers Inverse ssh tunnels Source code published Reported vulnerabilities:

124 Additional membership benefits 124 RIPE Atlas: Guaranteed probe application Do NOT have to host a probe in order to perform customised measurements 1,000,000 extra credits monthly via LIR Portal Quick Look measurements via LIR Portal IPv6 reachability testing (free - no credits needed) Sharing probe management with LIR colleagues RIPEstat: Historical view of RIPE DB objects

125 How to Host a Probe Section 16

126 Hosting a probe Create a RIPE NCC Access account 2. Go to 3. You will receive a probe by post 4. Register your probe 4. Plug in your probe If you receive a probe from an ambassador (trainer, sponsor, someone at a conference), just register it and plug it in!

127 Questions? 127

128 Ende Konec Kraj Lõpp Fine The End! Beigas הסוף Einde Соңы Vége Pabaiga Fim Amaia Loppu Kрай Fí Finvezh Ënn Endir Sfârşit Канeц Конeц Liðugt Fund Son An Críoch Y Diwedd Finis Kiнець Kpaj Fin Τέλος Slut Slutt Tmiem Koniec

RIPE NCC Measurements and Tools. Training Course

RIPE NCC Measurements and Tools Training Course Training Services RIPE NCC January 2018 Schedule 09:00-09:30 11:00-11:15 13:00-14:00 15:30-15:45 17:30 Coffee, Tea Break Lunch Break End 2 Introduction Name