Timely and well-presented data has long been essential for network operators to make informed decisions. Whether it's troubleshooting, maintenance, traffic engineering, or verifying intended outcomes, success hinges on having accurate, up-to-date information that is easy to access and understand. Over the past decade, the ThousandEyes team has focused on simplifying operators’ lives by delivering data that is both accessible and timely. And now, we are introducing the Border Gateway Protocol (BGP) Updates feature, which builds on this foundation, offering a powerful new solution for improved decision-making through data-rich, real-time insights.
Following a series of recent BGP-related product enhancements—including near real-time updates, Resource Public Key Infrastructure (RPKI) monitoring, and our expanded network of ThousandEyes BGP monitors—the BGP Updates feature provides operators direct access to raw BGP messages observed by our global monitor network. Coupled with advanced filtering options, the table empowers operators with the data they need to verify changes, diagnose issues, and improve network performance.
Where can I find this new feature?
You can find the solution under our new left navigation menu with path: Routing → BGP Updates.
What will I see?
In Figure 2, the Prefix column indicates the IPv4 prefix 8.8.8.0/24 for which real-time streaming messages (i.e., BGP updates) are displayed. The Monitor column shows which ThousandEyes monitor received this message at the specified timestamp. The Update Type indicates that this is an announcement, and the AS Path reveals an Autonomous System (AS) Path from AS20473 through AS4755 to AS15169, the origin of the announcement. The RPKI Status confirms this as an RPKI ‘Valid’ announcement. Lastly, the BGP Communities propagated along this path are detailed.
The table provides network operators with enhanced control plane monitoring, path validation, security assurance through RPKI validation, and insights into BGP Communities, thereby improving overall network visibility and reliability.
Figure 3 illustrates various filters that allow users to refine their data set. For example, to view only RPKI invalid announcements, users might select that category under the RPKI Status filter. A date selector enables them to examine messages that arrived around a specific event within the last 30 days. Additionally, an Auto Update toggle on the right can pause incoming streaming messages to facilitate point-in-time analysis.
What practical things can I do with the BGP Updates table?
Use Case 1: Perform Retrospective Forensic Analyses After a BGP Anomaly
BGP anomalies, such as hijacks, pose significant risks to network security. Unauthorized ASes may announce prefixes not allocated to them, disrupting traffic, compromising data, and potentially causing outages. To address this, use the BGP Updates table to filter for affected prefixes and identify the precise timestamp of the unauthorized announcement. Assess the propagation and impact of the false announcement through ThousandEyes’ global network of BGP monitors. Additionally, review all relevant BGP Community data gathered during the hijack, and access all this information in a single pane of glass.
Use Case 2: Rapidly Help Ensure Traffic Engineering Is Working as Intended
The BGP Updates table feature enables operators to quickly verify whether traffic engineering changes are having the desired effect.
For example, suppose you want to prepend your ASN multiple times to make a particular path less desirable. AS prepending is used to influence inbound traffic, encouraging it to follow a path with a shorter AS_PATH length instead. Figure 4 indicates that AS16509 has prepended its AS three times, indicated by “(3)”, toward AS6453 for the indicated IPv4 prefix. The operator would set their routing policy for prepending; shortly after, they would be able to verify the effects across ThousandEyes’ global network of monitors. Other traffic engineering use cases include redundancy management and distributed denial-of-service (DDoS) mitigation.
Use Case 3: Track BGP Communities, Verify They Are Behaving as Intended
BGP Communities are widely used to enforce routing policies and provide valuable network insights. Figure 5 shows that the prefix 65.9.176.0/21 has been tagged with a few BGP Communities. The community 35661:7000 indicates the route is learned through peering in Paris with AS35661. Communities 174:22012 and 174:21100 respectively indicate the route is learned in the U.K. and from a non-customer in Europe through peering with AS174. Furthermore, the AS Path shows that AS16509 is prepended three times.
Operators often set communities on advertised prefixes for traffic engineering and location-based policies. However, verifying these settings can be difficult due to unreliable or outdated third-party looking-glass tools. BGP Updates addresses this by providing real-time, global visibility into community-based routing decisions.
Use Case 4: Glean Real-time Visibility Into RPKI Status
In recent years, RPKI has become a critical tool for securing Internet routing. Numerous Tier-1 providers, many large ISPs, and a growing number of enterprises now participate in signing and validating RPKI prefixes. ThousandEyes provides comprehensive monitoring and alerting for RPKI status. The BGP Updates feature enhances this process.
Figure 6 shows AS393770 advertising a new prefix, 161.129.58.0/23, after establishing peering with AS174. Shortly afterward, they created an ROA to sign the prefix according to best practices. Note the RPKI status change from “NotFound” to “Valid” with messages having newer timestamps.
Given the high stakes involved in RPKI errors, verification is crucial. The BGP Updates feature provides real-time visibility into RPKI status from hundreds of BGP monitors, helping operators confirm how their prefixes are propagating and verify that RPKI configurations are correct.
Boosted BGP Operations
As the preceding use case examples demonstrate, access to timely and detailed BGP data empowers operators to make faster, better-informed decisions. The BGP Updates feature offers powerful filtering options, simplifying the process of finding relevant data. Combined with ThousandEyes’ network of BGP monitors, users get a near-real-time global view of their BGP posture. This comprehensive approach empowers operators, enhancing their ability to verify, troubleshoot, and optimize traffic engineering, ultimately placing them firmly in control of their network performance like never before.
