Skip to content

BGP Update based flap detection

Notifications You must be signed in to change notification settings

Kioubit/FlapAlerted

Repository files navigation

FlapAlerted

Receives BGP Update messages by peering with your BGP daemon. Detects path changes and BGP flapping events.

Overview Page Event details page
a b

Setup notes

The program will listen on port 1790 for incoming BGP sessions (passive mode - no outgoing connections). It is recommended to adjust the routeChangeCounter and minimumAge parameters (see usage) to produce the desired result.

Usage

Usage:
  -asn int
        Your ASN number
  -asnPosition int
        The position of the last static ASN (and for which to keep separate state for) in each path. Use of this parameter is required for special cases such as when connected to a route collector. (default -1)
  -debug
        Enable debug mode (produces a lot of output)
  -disableAddPath
        Disable BGP AddPath support. (Setting must be replicated in BGP daemon)
  -minimumAge int
        Minimum age in seconds a prefix must be active to be detected. Has no effect if the routeChangeCounter is set to zero (default 540)
  -noPathInfo
        Disable keeping path information. (only disable if memory usage is a concern)
  -pathInfoDetectedOnly
        Keep path information only for detected prefixes (decreases memory usage)
  -period int
        Interval in seconds within which the routeChangeCounter value is evaluated. Higher values increase memory consumption. (default 60)
  -routeChangeCounter int
        Number of times a route path needs to change to list a prefix. Use '0' to show all route changes. (default 700)
  -routerID string
        BGP Router ID for this program (default "0.0.0.51")

Example BIRD bgp daemon configuration

protocol bgp FLAPALERTED {
    local fdcf:8538:9ad5:1111::3 as 4242423914; # This address cannot be ::1, it must be another address assigned to the host
    neighbor ::1 as 4242423914 port 1790;

    ipv4 {
        add paths on;
        export all;
        import none;
    };

    ipv6 {
        add paths on;
        export all;
        import none;
    };
}

Module Documentation

The program supports additional modules that can be customized at build-time.

mod_httpAPI (Enabled by default)

Provides the following http API endpoints on port 8699:

  • /capabilities
  • /flaps/active/compact
  • /flaps/prefix?prefix=<cidr value>
  • /flaps/active/history?cidr=<cidr value>
  • /flaps/metrics/json
  • /flaps/metrics/prometheus
  • /flaps/avgRouteChanges90

It also provides a user interface (on the same port) at path:

  • /

To disable this module, add the following tag to the MODULES variable in the Makefile: disable_mod_httpAPI

mod_log (Enabled by default)

Logs each time a prefix exceeds the defined routeChangeCounter within the defined period to STDOUT.

To disable this module, add the following tag to the MODULES variable in the Makefile: disable_mod_log

mod_roaFilter (Disabled by default)

Filters a ROA file in JSON format to remove flapping prefixes. The filtered prefixes are to be re-added by the external program updating the ROA file at regular intervals. See the command line help for required arguments.

To enable this module, add the following tag to the MODULES variable in the Makefile: mod_roaFilter


Building

Manually

You will need to have GO installed on your system. Then run make release and find the binary in the bin/ directory.

Docker

Clone this repository and run docker build . to generate a docker image. Environment variables can be used to specify the configuration options by capitalizing the command line flags and adding a FA_ prefix to them. For instance, to set the ASN number, use the following environment variable: FA_ASN=<asn value>