How fast can Cyclops react and alert me of anomalous events?
Cyclops can react as fast as a few seconds in case the event is detected in BGPmon real-time feeds. For other feeds, it tyipically takes anytime between 5 and 15 minutes. The data available from the left menu (connectivity, prefixes, anomalies) is tipically refreshed every 1 to 2 hours.
What about ipv6?
Cyclops processes only IPv4 data and the complemenary Cyclops6 (http://cyclops.6watch.net)
focuses on IPv6 data processing.
What about 4-byte ASNs?
Cyclops currently supports 4-byte ASNs. They are shown in ASDOT notation in BGP messages and in ASPLAIN in queries and tables.
What are link weights and how are they computed?
The link weights in connectivity mode are computed from full routing tables from RouteViews and RIPE-RIS. The numbers shown in the "Weight" columns are the number of routes averaged over 126 monitors with temporal average (0.8 * past_value + 0.2 * current_value). For link A-B Cyclops shows the number of routes that reach B from A (from), as well as the number of routes that reach A from B (to). The former value indicates how the Cyclops eye is reaching the rest of the Internet, while the latter indicates how the rest of the Internet is reaching the Cyclops eye.
How does Cyclops determine the geographical location where prefixes are originated?
Cyclops uses data from Maxmind's GeoLite City
. The accuracy is over 99.5% for country level and 79% on the city level for the US.
In what units are the lifetimes?
The lifetimes are usually measured in number of days.
What do alert activity and status mean?
The alert activity indicates if the offending attribute (e.g. a prefix) is still being observed in BGP updates in the last 8h ("On" state). If the attribute disappears from feeds for more than 8h, then the alert is automatically cleared to "Off" state. The alert status is a state controlled by the user. By default all alerts are created in the "open" state, but the user may want to "close" them later for house keeping purposes. The activity and status are independent properties of the alerts.
What is the Cyclops newsletter?
The Cyclops newsletter is a bi-monthly digest of the top routing anomalies detected by Cyclops. You can subscribe to the newsletter here
, bottom right corner.
What do I do when I start receiving false alerts?
Cyclops can adapt its filters to your feedback. If you think you're receiving false alerts, you can do two things. You can click on the email alert link that says "Mark as false alert". After you do this, Cyclops will automatically update its filters so that you won't receive an alert with same root-cause in the future. Alternatively, you can go to My Alerts
and flag each false alert by selecting it and clicking on the link "Mark as false alert". The alert will be removed and the filters updated.