Thursday, January 4, 2007

BGPlay and whois...

And here comes first "serious" post. :) It's about handy tool called BGPlay.

The purpose of this tool is to visualize AS connectivity in time from some point in the Internet to the given network/AS. Actually, it's Java applet, and you can find it here. I didn't saw link where source, or application, can be downloaded.

First of all, let me try to explain briefly what AS is. Internet consists of different networks connected together. But the real truth is that those networks are first grouped into autonomous systems (AS) and then those autonomous systems form the Internet. More precisely, autonomous system is a collection of (computer) networks that is under single administrative control. Usually, autonomous systems run single interior routing protocol, but not always.

So, armed with this, let's start the applet. It will present you the following dialog:

In field titled prefix, you write network address you are interested in. For example, we can put 161.53.0.0/16, it's prefix for Croatian Academic and Research Network (CARNet). Also, you may wish to change start date field into something earlier than offered by default. After clicking on OK, and some waitinig, you'll be presented with the following window:


This window has four parts. In the left, smaller, pane there is time axis with time running from bottom up. Values ploted on this axis represent number of changes in AS conectivity. In the right pane, the biggest one, there is drawn graph with shown connectivity of our network. Actually, it's not network shown, but AS to which out network belongs. This AS is marked red and it has number 2108. At the bottom of this window there are some controls that allow control of connectivity visualisation. Finally, at the top, you can see what's drawn at some particular moment.

So, start visualisation by pressing play button. What you'll see is how route change between different ASes, either because they are withdrawn, announced, or just changed. On the top pane in window is message that states what exactly happened. And, in the left pane, you can see arrow going up, meaning that the time is running.

So, nice, but there is something else that can be seen from this figure, and that is, with whom particular AS is connected. Looking at the figure, you see that two ASes domine in connectivity with our AS, AS1299 and AS3356. So, let's find out who's behind those ASes. For that purpose we'll use whois utility.

Run the following query in the Linux command line:

$ whois AS1299

After some short time you'll get output. There are few interesting peaces. The first one is the following:

aut-num: AS1299
as-name: TELIANET
descr: TeliaNet Global Network
descr: Telia International Carrier

This gives us idea who is behind this AS. It's TeliaNet, and after some simple googling, we find that it's internet provider from Sweden. Actually, googling reveals much more that this about TeliaNet, but that's unimportant for now.

The other important part of the output is:

remarks: 1299:210x Peers at VIX

which indicates us that CARNet is peering with TeliaNet at VIX peering exchange. Again, some small amount of googling, and we find it's Vienna Internet Exchange. Actually, search term was "VIX internet exchange", since searching only for VIX gives false results.

I'll leave searching for other AS to you.

There are also some caveats with this approach. You can not find out exact connectivity of some AS because peering arrangements are usually not propagated into BGP and thus, there is no way for this software to find out those connections.

Still, this is very interesting piece of software with only one shortcoming I found during this short period of it's use. There is no zoom button or anyhting like that!

No comments:

About Me

scientist, consultant, security specialist, networking guy, system administrator, philosopher ;)

Blog Archive