Peering Analytics

Peering Analytics in the Kentik Detect portal is covered in the following topics:

• About Peering Analytics
• BGP Datasets Page
• Add Dataset Dialog
• Peering Analytics Page
• Peering Sidebar Controls
• Peering Data Display
• Path Details Dialog

Note: The following additional resources can help you learn more about analytics in Kentik Detect:
- Peering Analytics screencast video (plays from YouTube in a new window).
- Introducing BGP Peering Analytics (blog post).

General information about peering analytics in Kentik Detect is covered in the following topics:

• Peering Analytics Overview
• Peering Analytics Process
• Building a BGP Dataset
• Exploring Peering Analytics
• Peering Analytics Considerations

The BGP data collected by Kentik Detect may be used for sophisticated peering analysis that can show you, using diagrams and tables, the Autonomous Systems that traffic leaving your network passes through on the way to its destination. These capabilities are designed to help you understand the flow of traffic from your network by AS, device, and geography using filterable visualizations and tables (see Exploring Peering Analytics for more details). A better understanding of this aspect of your traffic can help you find prospects for peering relationships and generally improve management of transit costs.

Using peering analytics in Kentik Detect is a two-step process:

1. Create a BGP dataset on the BGP Datasets Page (see also Building a BGP Dataset).
2. Explore that dataset on an individual Peering Analytics Page (see also Exploring Peering Analytics).

Note: When creating a BGP dataset you can set it up as a regularly scheduled peering report that is emailed to a specified list of subscribers (see Recipients in Add Dataset Dialog).

To build a BGP Dataset for Peering Analytics:

• In the Kentik Detect portal, click on Analytics in the navbar at top to go to the BGP Datasets page.
• Create a BGP dataset representing the traffic that you want to analyze. A BGP dataset is a subset of your traffic data that’s stored in the Kentik Data Engine (KDE):
  - You can include traffic from all or just some of your devices.
  - You can use filters to narrow the scope of the included data.
• When the build of your BGP dataset is complete (may take several minutes) the new BGP dataset will be listed on the BGP Datasets page as a row in the BGP Datasets List, and the peering icon will appear in the Peering column of that row (under Actions at right).

Note: For more information on creating a BGP Dataset, see Add Dataset Dialog.

To explore peering analysis on a BGP dataset:

• Click the peering icon for a BGP dataset in the BGP Datasets List.
• On the resulting Peering Analytics page you will find five tabs:
  - BGP Paths show traffic by major network path as it leaves your network.
  - Transit ASNs shows summed through and to traffic for each AS past the first hop, so that you can see potential peers and customers.
  - Origin ASNs shows the ASNs and countries to which traffic leaving your network is ultimately going, so that you can quickly see where your traffic is being consumed.
  - Next Hop ASNs shows the traffic flow from your network to the ASs with which you have a direct relationship.
  - Countries shows the source and destination countries of traffic flowing through your network.
• To filter the above graphs and tables by ASN use the Limit by ASN field.
• To drill down on AS-specific traffic flows, click on an ASN in the displayed graphs.

Note: For more information on peering analysis, see Peering Analytics Page.

The following important considerations apply when working with BGP datasets:

• Your deployment must include BGP peering with Kentik.
• You must have at minimum 3-4 days of recorded data stored on the Kentik platform for the feature to be practically useful.
• The network data in a BGP dataset is always drawn from a Fast resolution dataseries (see About Dataseries Resolution), which means that for each device included in a given BGP dataset the data for the timespan covered by that dataset is represented in the Kentik Data Engine as a series of one-hour “slices.”
• The date range used when defining a BGP dataset is a minimum of two days, which means that a minimum-duration BGP dataset covers data from two days worth of one-hour slices for each included device.
• To ensure complete information in every slice, the start time of the last slice will be more than one hour but less than two hours before the time at which the dataset is created. For example, if a BGP dataset is created at 21:31 UTC the most recent one-hour slice in the BGP dataset will start at 20:00.

The BGP Datasets page is home to the BGP Datasets List, which lists your organization’s BGP datasets. To see the BGP Datasets page, choose Peering from the Analytics menu on the portal’s main navbar. Details of the BGP Datasets page are covered in the following topics:

• BGP Datasets Page UI
• BGP Datasets List

The BGP Datasets page has the following main UI elements:

• Information area: Helpful information about:
  - what BGP datasets are;
  - what data to include in order to create an effective BGP dataset.
• Filter field: Filters the list of datasets based on the string entered in the field.
• Add Dataset button: Opens the Add Dataset Dialog, allowing you to add a new BGP dataset.
• BGP Datasets List: see BGP Datasets List.

The BGP Datasets List is a table that lists all existing BGP Datasets for a given customer. The table provides the following information and actions for each BGP Dataset:

• Dataset Name: Name of this BGP dataset.
• Created By: The Kentik user ID of the person who created the BGP dataset.
• # Devices: The number of devices whose network data is included in the BGP dataset. Hovering over the number will pop up a tooltip with a comma-separated list of devices.
• # Filters: The number of filters applied when the BGP dataset was created. Hovering over the number will pop up a tooltip with a comma-separated list of filters.
• Depth: The path depth of the dataset (how far down it extends in terms of top-X paths):
  - Low: fastest to create and also to filter on the Peering Analytics page.
  - Medium: default setting.
  - High: includes more rows for increased detail and accuracy, but slower.
• Time Range:
  - If the dataset is not a scheduled report, the start and end dates of time range in UTC.
  - If the dataset is a scheduled report, the scheduled interval (daily, weekly, monthly) and the lookback duration (how far back the time range extends from the time at which the report is run), plus a cancel link that opens a dialog to cancel the report.
• Created: The date, expressed as UTC, that the BGP dataset was created.
• # Rows: The number of rows in the BGP dataset.
• Expires: The date, expressed as UTC, on which the dataset will expire.
• Actions: Operations that can be performed on the BGP Dataset:
  - Open Dataset: Go to the Peering Analysis page for this BGP dataset.
  - Delete: Open a confirming dialog that allows you to remove the BGP Dataset from Kentik Detect.

The Add Dataset dialog is used to configure a BGP dataset, determining the traffic that is or is not included. The following list covers the fields of the dialog:

• Dataset name: A user-provided name string (alphanumeric plus underscores) for the BGP Dataset.
• Expires in (days): The life-span in days, forward from today, of the BGP dataset. Default = 60.
• Path Depth: The depth of the dataset (how far down it extends in terms of top-X paths):
  - Low: Fastest to create and also to filter on the Peering Analytics page.
  - Medium: Default setting.
  - High: Includes more rows for increased detail and accuracy, but slower.
• Run/Schedule: Set to Once to create a BGP dataset that will not generate schedule reports.
  Set to Daily, Weekly, or Monthly to create a scheduled report based on the dataset.
• Time Range (only if Run/Schedule is set to Once): Set the start date and end date of the time-span to include in the BGP dataset.
• On (only if Run/Schedule is set to Weekly or Monthly):
  - If Weekly, the day of the week to run the scheduled report;
  - If Monthly, the day of the month to run the scheduled report.
• Lookback (only if Run/Schedule is set to Daily, Weekly, or Monthly): The date-span in days, back from the day the report is sent, to include in the BGP dataset.
• Recipients (only if Run/Schedule is set to Daily, Weekly, or Monthly): Enter a comma-separated list of subscribers to whom the scheduled report email will be sent as an attachment.
  Note: To change recipients, go to Admin » Subscriptions (see Subscriptions) and edit the subscription whose name matches the dataset name.
• Devices: A list of the devices that your organization has registered with Kentik Detect. To change the devices covered in the dataset, click on any device to open a Selected Devices Dialog.
• Filters: A list of filters currently applied to the dataset.
• Edit Filters button: To change the filters applied to the dataset, click the button to open a Filtering Options Dialog.
• Cancel button: Closes the dialog without adding a new dataset.
• Add Dataset button: Closes the dialog and starts the processing of the new dataset (see Dataset Preparation).

Once a new BGP dataset has been configured in the Add Dataset Dialog, Kentik Detect prepares the new dataset. On the BGP Datasets Page, a new row for the newly created BGP dataset will appear in the BGP Datasets list. Until processing of the new BGP dataset is complete, the Created column for that row will indicate “Creating” and the Actions column will be blank.

Note: The time required to prepare a new BGP dataset depends on the volume of underlying network traffic data (flow records) in the date-range specified for the BGP dataset.

Each BGP Dataset listed in the BGP Datasets list has a corresponding Peering Analytics page, which is reached by clicking the Open Dataset button in the row for that BGP Dataset. Peering Analytics pages are divided into two main areas:

• Sidebar: An area at left that contains the controls (see Peering Sidebar Controls) used to specify the query whose results are returned in the display area.
• Display area: An area for display of the current peering view, which is made up of a set of graphs and tables (see Peering Data Display).

The sidebar on each Peering Analytics page contains the following set of information and control panes, which are covered in the following topics:

• Peering Sidebar Overview
• Peering Sidebar Panes
• Peering Options Pane

The Peering sidebar contains the following UI elements:

• Run Query button: Applies changed sidebar settings to the graphs and tables in the display area to the right (see Run Query Button). When there are no changes to apply, the button is grayed-out.
• Sidebar panes: A set of panes that are used to set values for the queries whose results (typically graphs and tables) are shown in the display area. The panes can be in either Edit mode or Summary mode (see Pane Display Modes).

In Peering, the sidebar contains the following panes to control the query whose results are displayed in the display area:

• Options pane: Configures the type of analysis you’d like to see in the data display area; see Peering Options Pane.
• Filtering pane: Specifies filters that may be applied to the query; see Filtering Pane Settings.
• Devices pane: Specifies the Kentik-registered devices covered by the query; see Devices Pane Settings.

Note: For additional general information about panes see About Sidebar Panes.

The Options pane enables you to configure what BGP path information you’d like to display about the underlying BGP dataset.

The report type options control what to display in the main display area:

• BGP Paths show traffic by major network path as it leaves your network.
• Transit ASNs shows summed through and to traffic for each AS past the first hop, so that you can see potential peers and customers.
• Origin ASNs shows the ASNs and countries to which traffic leaving your network is ultimately going, so that you can quickly see where your traffic is being consumed.
• Next Hop ASNs shows the traffic flow from your network to the ASs with which you have a direct relationship.
• Countries shows the source and destination countries of traffic flowing through your network.

The remaining settings of the Options pane enable additional control over how the peering analysis is displayed:

• Breakdown by Devices (switch): Displays device traffic with colored vertical bars directly after the site bars.
• Ignore first hop (switch): Skips over the first hop in visualizations except those showing a full path.
• Include All Devices in Dataset (switch): This is the equivalent of clicking the All button at the upper left of the Selected Devices Dialog. When this switch is on, the query will include all devices in the current BGP Dataset and the Devices pane will be locked.
• Visualization Depth (slider): Determines how much detail (10 = high) is included in the graphs (line charts and Sankey diagrams) in the display area. A low setting shows the most important paths with less clutter; a high setting includes paths representing relatively lower volume.
• Filter by ASNs (field): Filter the autonomous systems included in the BGP Dataset to a subset whose ASN matches the entered text, enabling peering analytics based on one or more specific autonomous system. Multiple ASNs may be entered in a comma-separated list.

The components of the display area are covered in the following topics:

• Dataset Info Pane
• Dataset Sankey Diagram
• Dataset Top-X Line Graph
• Dataset Totals Pane
• Dataset Top-X Table

The Dataset info pane displays general information about the BGP Dataset, including some of the same information that is found in the BGP Dataset’s row in the BGP Datasets List (see Add Dataset Dialog):

• Dataset Name: Name of the BGP dataset.
• Start Time: Start of dataset time range.
• End Time: End of dataset time range.
• Direction: Portion of BGP path displayed, either destination or source.

The dataset Sankey diagram shows paths taken by network traffic. Hops are represented by colored vertical bars, and the width of the gray bands between hops is proportional to the quantity of traffic (95th percentile Mbps). When you hover the cursor over a gray band, the band is highlighted from source to destination and a tool tip appears with information about the path represented by the band. Click on a path or an ASN in the diagram to open a dialog displaying more detailed analytics about the item.

The line graph below the Sankey diagram shows the traffic volume (in Mbps), over the specified timespan, for each of the top paths.

A display showing the following information related to the Dataset Top-X Table:

• Avg (Mbps): The average traffic volume over the timespan covered by the BGP dataset.
• Max (Mbps): The Mbps of the time-slice with the highest traffic volume.
• 95th Percentile (Mbps): The Mbps of the time-slice during which the traffic volume was greater than in 95 percent of the time-slices in the BGP dataset’s timerange.
• Date/time of 95th Percentile (UTC): The start time of the 95th Percentile time-slice.

A list of the paths, ASNs, or countries, in descending order, along with further details about each. Each table contains the following columns displaying information for the path, ASN, or country in a given row:

• Primary metric: The metric that is shown the graphs and tables in the display area. the metric is determined by the report type setting in the Peering Options Pane: BGP Path, Transit ASNs, Last-hop ASNs, Next Hop ASNs, or Countries.
  Note: Except when the primary metric is Countries, the ASes that make up the path will be shown as individual buttons that are each labeled with an AS number. You can open a Path Details Dialog for any AS by clicking on its button.
• Avg (Mbps): The traffic volumes for the path, ASN, or country for each one-hour time-slice over the timespan covered by the BGP dataset.
• Max (Mbps): The Mbps of the time-slice during which the path, ASN, or country had the highest traffic volume.
• Percent of total at 95th percentile time: The percent of the overall traffic represented by this path, ASN, or country at the time shown in the Date/time of 95th Percentile column.
• Date/time of 95th Percentile (UTC): The start time of the time-slice represented in the 95th Percentile column.
• 95th Percentile (Mbps): The Mbps of the time-slice during which the traffic volume of the path, ASN, or country was greater than in 95 percent of the time-slices in the BGP dataset’s time-range.
• View in Explorer: A button that opens Data Explorer in a new tab or window, with a one-day timespan and the metrics, devices, and filters applied to correspond to this path, ASN, or country in the BGP dataset.
  Note: You must click the Run Query button at the top of the Explorer sidebar to see the results.

The Path Details dialog is covered in the following topics:

• About Path Details
• Path Graphs and Tables

The contents of the Path Details dialog are similar to those of the main peering analytics display area (see Peering Data Display) except that the information (graphs and tables) is filtered to shown only traffic whose path includes a given Autonomous System (AS).

You can open a Path Details dialog in either of the following ways:

• In the Dataset Sankey Diagram, click on the ASN label for one of the colored vertical bars.
• In the Dataset Top-X Table, click on an ASN button in the left-hand column.

The Path Details dialog includes a variety of information about traffic in the BGP dataset that uses any path that includes the AS for which the dialog was opened. A summary is provided in the Total Traffic pane at top, with additional details presented in the graphs and tables below.

The Total Traffic pane shows the following data points:

• Avg (Mbps): The average traffic volume over the timespan covered by the BGP dataset.
• Max (Mbps): The Mbps of the time-slice during which the paths had the highest traffic volume.
• 95th Percentile (Mbps): The Mbps of the time-slice during which the traffic volume was greater than in 95 percent of the time-slices in the dataset’s timerange.

The following graphs are presented below the Total Traffic pane:

• Traffic from Devices Via AS: A Sankey diagram that shows the path of traffic through the target AS starting with the interfaces of the devices in the BGP dataset.
• Traffic on AS by Countries and Devices: A Sankey diagram that shows the source country, device, and destination country of the paths in the dataset that include the target AS.
• Total Traffic Transiting AS: A line graph that shows the total traffic volume, over the BGP dataset timerange, on all paths in the dataset that include the target AS.
• Traffic on Top Paths that Include AS: Shows the traffic volume, over the BGP dataset timerange, on the top paths that include the target AS.

The following tables show average, max, and 95th percentile traffic volume (in Mbps). Each row in the tables also includes a View in Explorer button that opens Data Explorer in a new window or tab with settings corresponding to the traffic represented by the row:

• Top BGP Path: Top countries from which traffic on the paths originates.
• Top Device: Top device in any of the paths.
• Top Source Geo: Top countries from which traffic on the paths originates.
• Top Destination Geo: Top countries to which traffic on the paths is going.