sflow -> aggregated aspath visualization?

Mailman List Mirror (Read Only)
1

I’m looking for product recommendations:

We’ve noticed that about 20% of our traffic here lately has decamped from the free (or, at least, flat-rate) connection to CANARIE (our R&E network) and its various connected content-delivery networks, and onto our commercial provider.

While this is presumptively a legitimate shift, we’d like to better understand these changes when they occur, in a way that our executive can understand at a glance.

We do have sFlow (et al.) going to an Arbor PeakFlow box for analysis, but it’s lacklustre at best at understanding changes like this.

I want:

  • Top #n ASNs by traffic volume, per router/interface, stacked chart
  • Some way to visualize large jumps in that dataset, e.g. if Cloudflare ditched their CANARIE connection and now that traffic all goes commercial, I don’t know what sort of graphic would be useful, maybe a stacked polar chart so you could see when an AS jumped from one sector to another? Even stacked bar charts could be useful.

If anyone knows of tools capable of generating easy-to-understand reports, dashboards, including historical “what changed this week”-type data, please let me know.

For that matter, if you have a technique of collecting this data and using Excel to do the reporting, that would work too.

(Yes, I could theoretically build this off of existing open source tools… eventually)

Thanks,

-Adam

Adam Thompson
Consultant, Infrastructure Services
[MERLIN LOGO]
100 - 135 Innovation Drive
Winnipeg, MB, R3T 6A8
(204) 977-6824 or 1-800-430-6404 (MB only)
athompson@merlin.mb.ca
www.merlin.mb.ca

2

3

We’ve been on Kentik for about a year. Good things… Definitely beats the Arbor/Netscout number we had before. Mark.

4

If you have access to a modern ELK stack, you could try out Elastiflow:
https://github.com/robcowart/elastiflow

My understanding is that tuning the number and settings of the Logstash
instances can be challenging, but it's very pretty when it's working
correctly.

5

You could use Prometheus / Grafana to build the dashboards.

The following example is a starting point (top ASNs / Countries by traffic volume):
https://grafana.com/grafana/dashboards/11146

The example could be modified to make the make router / interface selectable, or cloned to create separate per router / interface dashboards.