SwiNOG#38 | Query, measure and alert on BGP state in real time via GraphQL | Vasileios Kotronis

Title: Query, measure and alert on BGP state in real time via GraphQL
Presenter: Vasileios Kotronis, Code BGP

Abstract: BGP hijacks, route leaks and routing changes can critically affect the security, reliability and performance of our networks. In this presentation, we show how we can combine modern APIs and query languages like GraphQL with real-time streaming control-plane data ingestion, processing and storage in order to detect routing events in seconds. This is enabled by tracking the current state of the network's BGP resources, such as prefixes and routes, and using live queries and subscriptions to get non-policy compliant, and thus alertable/actionable, data. We present the basic concepts of GraphQL in the context of BGP, forming a custom and expressive BGPQL query language. We explain the key mechanisms of a well-known open source GraphQL middleware named Hasura GrapgQL engine, which eases the process of DB schema to GraphQL mapping. Finally, we analyze some relevant use cases implemented in the context of a commercial BGP security and monitoring platform, focusing on UIs, API access, metric collection and alert generation.

Event: SwiNOG #38 - http://www.swinog.ch
Day: 21.06.2023
Location: Bern, Gurten (https://www.gurtenpark.ch/)

Slides: https://www.swinog.ch/meetings/swinog38/

Swiss Network Operators Group The Swiss Network Operators Group (SwiNOG) is an informal group of people who are concerned with engineering and operation of the Swiss Internet. SwiNOG (Swiss Network Operators Group) is a community for (not only) Swiss service providers and IT specialists since 24th of february 2000. SwiNOG is analogue to NANOG und DENOG. SwiNOG was founded as the very first European NOG. SwiNOG exists to enhance the quality of Internet services available in Switzerland. It does this by fostering the free exchange of technical ideas and information between different companies and organisations.
For more details please see: https://www.swinog.ch -   / swinog   (#swinog)