RIPEstat's Multiple Widget and Resource Comparison

RIPEstat users can now compare results for multiple resources across multiple widgets in a new comparison page - and share the results with others using the permalink feature. Here we describe several use cases where this new functionality might come in handy.

RIPEstat comparison as 4 Figure 1: RIPEstat's new Widget Comparison page allows you to compare different widgets and resources side by side

Use cases

Being able to compare multiple resources across multiple widgets is useful in all sorts of different cases. For example, you might want to:

See how a region was affected by an Internet outage, including changes in announcements and withdrawals

Find the abuse contact for a given IP address, determine its geographical location, and find out who is announcing it

Investigate a particular ASN and see its announced prefixes, its neighbours and check its observed routing versus what's found in the registries - all on the same screen at the same time

Here we describe these three use cases in more detail, and how RIPEstat's new Widget Comparison page makes comparisons, investigations and analyses like these quick and easy.

Example 1: ASN profile

At some point, you may be interested in learning more about a particular ASN. Perhaps you're interested in peering with a network but want to find out more information first, or you want to choose your upstream provider. In this first example, we'll show you how to add different widgets step by step to end up with a useful overview of a particular ASN.

Let's start by looking up the AS in question in the Announced Prefixes widget to see all the address space being announced by it. Among other things, we can use this widget to see how the AS manages their allocations. For example, do they have large blocks of address space or many smaller ones?

RIPEstat comparison as 1 Figure 2: Start by looking up the AS in the Announced Prefixes widget

Next, you could add the Prefix Count widget to see, for example, whether the ASN's IPv6 allocations are actually being used.

RIPEstat comparison as 2 Figure 3: Select the Prefix Count widget and click on the 'add' button to view this beside the Announced Prefixes widget

The ASN Neighbours widget would also provide information about the different connections the AS has.

RIPEstat comparison as 3 Figure 4: Add a third widget to the mix by selecting the ASN Neighbours widget and clicking on 'add'

Finally, the AS Routing Consistency would give you an idea of how diligent the ASN is about keeping its records in sync with what's actually being seen in real-world routing.

RIPEstat comparison as 4 Figure 5: The complete view shows four different widgets side-by-side

Example 2: Investigating abuse

Being the victim of network abuse is frustrating, but being able to compare results from multiple widgets at the same time makes investigating abuse cases simpler than ever.

You might start by looking up the abuse contact in the Abuse Contact Finder widget so that you can report the abuse to the appropriate party.

Next, you could find out where the offending IP address is coming from by looking up the announcing AS in the Resource Overview widget.

RIPEstat comparison abuse Figure 6: Investigating a network abuse case
(Note: all Internet number resources in this example use space reserved for documentation examples)

It might be interesting to know where the abuse is originating from in terms of physical location, too, using the Geoloc widget. Here we see that the IP address is located in Amsterdam, the Netherlands.

You may also want to know what networks the announcing AS is using, to see whether any of these contain blacklist entries, for example. You can get the complete list of prefixes belonging to the AS in the Announced Prefixes widget.

Example 3: Country outage

Recently Syria, Egypt, Pakistan, Iran and other regions have all experienced Internet outages. Using RIPEstat's new widget and resource comparison functionality, an interested user could delve into the data to discover more about what's happening in an affected area.

First, the Country Routing Statistics widget for the given country displays the outage and when it occured. In this example, we'll look at Syria's recent outage from May 2013.

Next, we can add the Country Resource List to get a list of the ASNs, IPv4 and IPv6 prefixes for the region.

RIPEstat comparison country outage Figure 7: Probing a country-wide Internet outage

Once we see what prefixes belong to the region, we can choose a prominent one and look it up using the BGP Looking Glass widget to determine its state during the outage, as well as peering information. In the example below, we show the first few entries in the widget for a prefix belonging to a Syrian ISP.

Finally, we could lookup prefixes in the BGP Update Activity widget, which shows announcements and withdrawals for that prefix over time.

Benefits

These three use cases are just a few examples of the ways in which the multiple widget and resource comparison can help you find the information you're looking for and consolidate it in one place, making investigations, comparisons, and analyses easier and faster.

The permalink functionality offered on the Widget Comparison page is also useful for sharing your results with someone else, or coming back to your results at a later time without having to re-enter your data.

What's your use case?

Have your own ideas about how you could use the new multi-widget, multi-resource functionality? We want to hear about it! Send us a sentence or two about which widgets you would use and for what purpose, and we'll publish them in a follow-up RIPE Labs article. Write to us at stat [at] ripe [dot] net.