Monitor Prefixes

Prefixes Overview

When you start with Crosswork Cloud Network Insights, you begin by adding prefixes. After you add prefixes, the prefixes window provides a consolidated view of prefixes, associated policies, and other useful information for monitoring large networks. The External Routing Analytics > Monitor > Prefixes window:

  • Provides a location for storing and tracking your prefix information.

  • Displays prefix state, alarm status, and prefix details.

  • Monitors prefixes from worldwide vantage points, detecting regional events that might otherwise be overlooked by a single vantage point monitoring system.

  • Lets you subscribe or unsubscribe from prefixes.

Add Prefixes

Procedure

Step 1

In the main window, click Prefixes.

Step 2

Click Subscribe to Prefixes.

Step 3

Click on one of the following tabs:

  • Manual—Enter the prefix IP addresses to which you want to subscribe. To add multiple prefixes, enter a comma (,) between each one. You can't add prefix masks smaller than /8. For example, you can't add a prefix such as 1.1.0.0/3.

  • ASN Lookup—Enter an ASN for which you want to search for associated prefixes.

  • CSV Overwrite—Upload a CSV file that contains prefix information. See Upload a Configuration File for more information.

Step 4

If you selected Manual or ASN Lookup, after you enter the required information, click Next.

Step 5

If you previously created a policy, select a policy to associate to the prefix from the Policy drop-down list. See Add Crosswork Cloud Network Insights policies for more information.

Note

 

You can associate a prefix to one policy only.

Step 6

(Optional) Enter meaningful text in the Tags field.

Note

 

If you have entered more than one prefix, the policy and tag you specify is applied to all prefixes.

Step 7

Review your changes, then click Submit to apply your changes.

View all prefixes

You can view all prefixes as described in the following steps:

Procedure

Step 1

Choose Monitor > Prefixes.

Crosswork Cloud Network Insights displays a list of prefixes with information in the following columns:

  • Prefix—The prefix IP address.

  • Policy—The policy associated with the prefix.

  • Tags—List of tags associated with the prefix.

  • Active Alarms—Number of active alarms associated with the prefix.

  • Severity—The alarm level (High, Medium, or Low) associated with the prefix.

  • Last Active Alarm—The alarm type, day, and time of the last active alarm associated with the prefix.

Step 2

To view more details about a specific prefix, click the prefix. These tabs provide more prefix details:

  • Overview—Contains summary information about your prefix.

  • Alarms—Provides details about alarms associated with the prefix.

  • Traffic—If applicable, provides details about any traffic running on the prefix.

  • BGP Updates—Contains details about the BGP updates, as reported by peers, that triggered alarms.

  • Looking Glass—Contains looking glass information for the prefix

  • ROA—Contains details about all known ROAs associated with the prefix.

  • RPSL—Contains RPSL data that is associated with the prefix.

Step 3

To add a new prefix, click Subscribe to Prefixes. See Add prefixes.

View prefix details

You can view detailed information about a specific prefix.

Procedure

Step 1

Choose External Routing Analytics > Monitor > Prefixes.

Step 2

To view more details about a specific prefix, click the IP address of the prefix.

Step 3

Click one of the tabs to display more details about the prefix:

  • Overview—Contains summary information about your prefix. See Prefix Overview details for more details.

  • Alarms—Provides details about alarms that are associated with the prefix. See Prefix alarm details for more details.

  • BGP Updates—Contains details about the BGP updates, as reported by peers, that triggered alarms. See Prefix BGP Update details for more details.

  • Looking Glass—Contains looking glass information for the prefix. See Prefix Looking Glass details for more details.

  • ROA—Contains details about all known ROAs associated with the prefix. See Prefix ROA Details for more details.

  • RPSL—Contains Routing Policy Specification Language (RPSL) data that is associated with the prefix. See Prefix RPSL details for more details.

Prefix Overview details

To view prefix overview details, choose External Routing Analytics > Monitor > Prefixes, click the IP address of the prefix, then click the Overview tab.

Crosswork Cloud Network Insights displays prefix overview details as described in the following table.

Table 1. Prefix Overview details field descriptions

Field

Description

Linked Policy

The policy associated with the prefix.

Last Modified

Date and time the prefix was most recently modified.

Tags

User-specified tags that are applied to the prefix.

Last Active Alarm

List of last active alarms associated with the prefix.

Summary

Summary data including a map showing the geographical location and number of peers. The estimated prefix geolocation is based on the geolocation of a sampling of IPs in the prefix that matches the address information from the Registrar. The location confidence level is calculated as one of the following: Low, Med, or High.

Valid RPSL coverage

The total number of RPSL records for this prefix that have an origin ASN matching the ASN observed by Crosswork Cloud Network Insights. See Prefix RPSL details for more information.

Peers

Number of peers and a map indicating the location of the peers. Click Table for a tabular view of peers.

Contacts

Contact information for the prefix.

Origins

Origins details including observed values and from where they are derived.
Observed Observed values and from where they are derived.

Upstream

Upstream details and from where they are derived.

Notes

Any user-entered notes associated with the prefix.

Prefix alarm details

To view prefix alarm details, in the main window, click External Routing Analytics > Monitor > Prefixes, click the IP address of the prefix, then click the Alarms tab.

Crosswork Cloud Network Insights displays prefix alarm details as described in the following table.

Table 2. Prefix alarm details field descriptions

Field

Description

Alarm state

Click any of the following alarm states:

  • Active—Crosswork Cloud Network Insights displays a list of all active alarms that are sorted by priority.

  • Acknowledged—Crosswork Cloud Network Insights displays a list of all acknowledged alarms that are sorted by priority.

Alarm Details

Details about the alarm.

# Peers

The number of peers that reported the violation.

Severity

The configured severity level of the alarm.

Activated

Date and time the alarm occurred.

Notes

Any notes entered about the alarm.

Prefix BGP Update details

To view prefix BGP update details, choose Monitor > Prefixes, click the IP address of the prefix, then click the BGP Updates tab.

Table 3. Prefix BGP Update Field Descriptions

Field

Description

BGP Updates Graph

Specify a specific timeframe by selecting a value from the Timeframe drop-down list.

The interactive dual-axis graph displays the BGP advertisements and withdrawals that occurred during that time range. The number of advertisements are represented on the left side of the graph. The number of withdrawals are represented on the right side of the graph.

Peer AS

The Peer AS from which the BGP update was received.

Prefix

The prefix.

AS Path

The AS routing path.

Communities

The communities path attribute, if applicable.

Update Type

The BGP update type.

Last Updated

Date and time of the last BGP update.

Prefix Looking Glass details

To view prefix looking glass details, choose External Routing Analytics > Monitor > Prefixes, click the IP address of the prefix, then click the Looking Glass tab.

Crosswork Cloud Network Insights displays looking glass details as described in the following table.

Table 4. Prefix Looking Glass Field Descriptions

Field

Description

Peer AS

The Peer AS.

Peer

The peer identifier, which is used to identify the peer but keep its identity private.

AS Path

The AS routing path.

Communities

The communities path attribute, if applicable.

Last Modified

Date and time the prefix was most recently modified.

Prefix ROA Details

To view prefix ROA details, choose External Routing Analytics > Monitor > Prefixes, click the IP address of the prefix, then click the ROA tab.

The Prefix Route Origin Authorization (ROA) page (External Routing Analytics > Monitor > ASNs > prefix-ip-address > ROA) lists the ASN prefixes with active and expiring ROAs. To filter which prefixes are active or expiring within a given time range, select an option under the Expires Within field.

Crosswork Cloud Network Insights displays prefix ROA details as described in the following table.

Table 5. Prefix ROA Details Field Descriptions

Column/Field

Description

Last Updated

The last date and time that information was retrieved

ROA Prefix

The prefix that the ROA authorizes the ASN to advertise.

Max Length

The maximum prefix length of the most specific IP prefix that the ROA authorizes the ASN to advertise.

Source

The organization that published the ROA. Examples:

  • American Registry for Internet Numbers (ARIN)

  • Internet Numbers Registry for Africa (AFRINIC)

  • Asia-Pacific Network Information Centre (APNIC)

  • Latin American and Caribbean Internet Addresses Registry (LACNIC)

  • Réseaux IP Européens (RIPE NCC)

ROA ASN

The AS number that is authorized by the ROA to originate the prefix.

Start

The start date and time for which this ROA is considered valid.

End

The end date and time for which this ROA is considered expired.

Prefix RPSL details

To view prefix RPSL details, choose External Routing Analytics > Monitor > Prefixes, click the IP address of the prefix, then click the RPSL tab.

Crosswork Cloud Network Insights compares the ASN record associated with the prefix in the RPSL database with the ASN record in the Whois database. Crosswork Cloud Network Insights displays the prefix RPSL details as described in the following table

Table 6. Prefix RPSL Details Field Descriptions

Field

Description

Last Scan

The date and time Crosswork Cloud Network Insights last scanned the RPSL databases. External Routing Analytics > Monitor > Prefixes scans RPSL databases once per day.

To view the specific date and time Crosswork Cloud Network Insights scanned each RPSL database, click on the date. This helps you determine when Crosswork Cloud Network Insights last retrieved data from the RPSL databases.

Source

The RPSL database source from which Crosswork Cloud Network Insights retrieved this record. Because prefixes can have records in multiple RPSL databases, Crosswork Cloud Network Insights displays each database source in a new row.

Origin ASN

The prefix origin ASN that is specified in the RPSL record.

Description

The descr attribute in the RPSL route/route6 record, which typically contains a description about the route record.

Member Of

The member-of attribute in the RPSL route/route6 record, which indicates the route-sets with which the route/route6 record is associated.

Classification

Crosswork Cloud Network Insights compares the ASN record associated with the prefix in the RPSL database with the ASN record in the Whois database. When Crosswork Cloud Network Insights cannot find an RPSL record for an exact match of the prefix, it examines the RPSL record corresponding to its parent to determine the classification. The classification values can be:

  • Mismatch—Indicates that Crosswork Cloud Network Insights has determined that the prefix has an origin ASN different from that specified in the RPSL database. The Overview tab shows the observed ASN for this prefix, which does not match the origin ASN in the RPSL database.

  • Exact Match—Indicates that Crosswork Cloud Network Insights validated that the prefix originates from the origin ASN as specified in the RPSL record and the WhoIS database for that prefix.

  • Partial Match—Indicates that Crosswork Cloud Network Insights validated that the prefix originates from the ASN specified as the origin ASN in the RPSL record of the parent for that prefix (while not an exact match, an RPSL record for the supernet was present).

  • No RPSL—Indicates that Crosswork Cloud Network Insights did not find any RPSL records for the prefix or its parent in any RPSL databases.

Last Updated

The date and time of the latest changed attribute in the RPSL record for the prefix or its parent.

View Prefix Traffic Details

You can view traffic details for one or multiple prefixes.

Procedure

Step 1

In the main window, click Traffic Analysis > Monitor > Prefixes.

Step 2

Filter and displays prefixes that are relevant to the device, device group, or tag group you select. You can also perform a search by entering specific prefix criteria. Select one of the following tabs:

  • Relevant Prefixes—Select this tab to view a list of prefixes by device or device group.

  • Grouped by Tag—Select this tab to view a list of prefixes by an assigned tag.

  • Search All—Select this tab to enter additional prefix search criteria.

Step 3

To compare traffic details for two or more prefixes, click the check box next to the prefixes, then click Traffic Comparison at the top of the table.

Step 4

To view transmitted (TX) and received (RX) utilization for a particular prefix, click on the prefix. Use the Time drop-down list to filter the time period you are interested in.

Step 5

To view device and data gateway connectivity, click the device name.