RIPEstat Live Demo #10

This article provides a summary of the RIPEstat live demo session held on Monday, 31 October 2011 at RIPE 63 in Vienna. The focus of this demo was to review all current features, show some use cases of RIPEstat, and an provide an overview of planned developments. Information about the next demo can be found at the end of the article.

Introduction

During the tenth live demo, Christian Teuschel provided a review of all existing RIPEstat views. This was especially useful for new RIPEstat users. He then demonstrated how RIPEstat could be used to find the location of a spammer and check prefix visibility. The demo was attended by an audience of about 75 people.

For reference, please see summaries of the previous demo sessions:

first demo

second demo

third demo

fourth demo
fifth demo

The RIPEstat pages on RIPE Labs containing background information about RIPEstat, can be accessed here .

RIPEstat Views

RIPEstat consists of a series of boxes, known as 'views' which contain a particular view of the data being displayed. In each view, there are links to the methodology used and the underlying raw data. The methodology identifies the data source, explains how it is processed, and describes how it is displayed. The raw data link enables the user to download the displayed information in a raw data format such as JSON or YAML. In the image below, you can see where these links are located.

RIPEstat Live Demo #10

Figure 1: RIPEstat main page pointing out links to view, methodology and raw data

Each view is available for either an Autonomous System Number (ASN) or an IP prefix. Some views are also available for both, although the view may differ slightly depending on the type of resource. See below a llist of all existing views:

Resource (AS and prefix) : Resource Information displays general information about the resource, which comes from routing information collected by our RSE network.

Whois (AS and prefix) : This view displays the information returned by the 'whois' service in an optimised, formatted manner.

Geolocation (AS and prefix) : The geolocation views displays the geographical usage of a resource. The view differs depending on the resource: for an AS, aggregation is on a country level, whereas for a prefix it is on the city level. The data is derived from the Maxmind GeoLite database.

Visibility (AS and prefix) : Visibility checks if a resource is seen by the RSEs. The data source is routing information.

Allocation history (AS and prefix) : The allocation history view presents the registration data found on both, the IANA and the RIR level.

AS Routing History (prefix) : This view visualises which AS announced the prefix over time.

Address Space Usage (prefix) : The data source for address space usage is registration data. It displays all the registration data (assignments and allocations) related to the queried prefix.

BGP Looking Glass (prefix) : BGP Looking Glass displays a realtime view of the routing status of the prefix.

Blacklist (prefix) : The blacklist view is made up from several blacklist databases and shows the number blacklisted entries for a prefix over time.

BGP Update Activity (prefix) : This view shows the announcements and withdrawls for a prefix over time.

Related Prefixes (prefix) : The related prefixes view shows prefixes which overlap (with greater or lesser specificity) or which are adjacent to the prefix in question.

Routing Consistency (prefix) : Routing Consistency compares registration data to routing data in order to determine the consistency of the data.

Announced Prefixes (AS) : Routing data is displayed so that all prefixes announced by an AS are shown.

Number of Announced Prefixes over Time (AS) : The view shows the total number of announced prefixes - both IPv6 and IPv4 - over time.

Prefix Size Distribution (AS) : This view shows the prefix sizes announced by an AS as percentages of the total number of prefixes announced by the AS.

Prefix Routing History (AS) : The purpose of this view is to show the prefixes announced by an AS over time (see an example in the image below).

Prefix Routing History Figure 2: RIPEstat view showing the prefix routing history

AS Path Length to RIS Locations (AS) : AS Path Length presents a matrix of the AS path length which shows minimum, average, and average (with prepending) path length.

Mobile Version

The latest version of RIPEstat for iOS was released yesterday. More details can be found at http://stat.ripe.net/mobile

Use Cases

This portion of the presentation was a live demonstration of how RIPEstat could be used to address two situations:

locating a spammer and
checking for visibility

These use cases and others are included a RIPEstat video which is being shown at the RIPE 63 info hub during the afternoon coffee break, and which is also available on YouTube: http://youtu.be/pNUj2EkU_kU

Feature Outlook

Three main future directions for development were presented. The first was the concept of 'widgets,' which will offer the flexibility of embedding views in other pages using a JS API. The second was an expansion of the raw data functionality to a URL-based approach with consistent parameters. The third objective is to improve data quality by filtering out irrelevant, incorrect or misleading data from primary sources.

Question & Answers

A member of the audience asked about raw data accessibility and frequency of update. Christian answered that the interface for raw data is being worked on, and information about the time lag for the data can be found in the methodology section.

The participant then asked if there are any plans to integrate DNSMON with RIPEstat. Daniel Karrenberg took the question. He said that RIPE NCC is working on the storage of a large volume of real-time measurements, derived from sources such as Atlas, and there are plans to eventually make this information available through a number of tools, including RIPEstat.