Packet Contents

Packet Contents

The data contained in the Event Log in the web interface can also be viewed in the CLI, and it can be captured as a file and directed to a remote URL, using either of the following commands:

eventdump
 
show event

Output will show the contents of the packets that are sent to the event-manager by the decision-maker process.

Packets are structured similar to the following BGP announcement packet:

------------PACKET HEADER-----------
 
spVer:1 spFlag:0 spType:8 Length:40 Version:100 Flag:0 SessionId:17767 
SequenceNum:702150 ProcessId:0 ThreadId:2 EventId:4 Time:00:00:05:845
 
--------HDR---------
 
-----------BGP ANNOUNCEMENT PACKET----------
 
KnownHop:true firstMention:false implicitWithdrawal:true AS Hop:3 prefix:64.76.167.0/24 
router:64.254.160.231 nextHop:12.124.42.137
 
-----------BAP----------
 
*******************************

The first section, labeled PACKET HEADER, contains some CNA-specific packet identifiers, including the time the packet was generated by the decision-maker process. This is the time that is displayed in the Event Log in the web interface.

The second section, which contains the packet payload, is identified by one of the following event-specific labels:

BGP ANNOUNCEMENT PACKET
BGP EVENT SUMMARY PACKET
BGP WITHDRAWAL PACKET
CONFIG-CHANGE PACKET
LINK STATUS PACKET
ROUTE ASSERTED PACKET
ROUTE CONFIRMED PACKET
ROUTE SELECTED PACKET
STATE TRANSITION PACKET
UNLOGGED ACTION

The event packet body contains various data, according to the specific event being recorded. This information can be viewed in the Event Details tab of the Event Log in the web interface.

BGP Announcement Packet

The BGP Announcement Packet payload consists of the following elements:

KnownHop--a boolean value indicating whether CNA has knowledge of the route’s next hop as identified by the BGP update
firstMention--a boolean value indicating whether this is the first time this router has spoken about this prefix
implicitWithdrawal--a boolean value indicating whether this update supersedes a prior announcement from this router
AS Hop--number of Autonomous Systems between the CNA system and the prefix
prefix--address in a.b.c.d format (without mask designation)
router--peering address of the router making the announcement to the CNA BGP table
nextHop--IP address of the next hop to the prefix

BGP Event Summary Packet

If you have configured a summary interval with the neighbor summarize-bgp-events command, the decision-maker process will periodically send a BGP Event Summary packet instead of individual BGP announcement or withdrawal packets.

The BGP Event Summary Packet payload consists of the following elements:

Router--the IP address of the router
Num BGP Announcements--the number of announcements made during the configured interval
Num BGP Withdrawals--the number of withdrawals made during the configured interval
Interval--the configured interval, in seconds

BGP Withdrawal Packet

The BGP Withdrawal Packet payload consists of the following elements:

Accept--a boolean value indicating whether the acceptingData bit for the prefix has been set to false

the packet’s Accept field will show true if the prefix’s acceptingData bit was set to false and it will show false if the prefix bit remains set to true

Prefix--address in a.b.c.d format (without mask designation)
Router--peering address of the router which is making the withdrawal from CNA system’s BGP table

Config-Change Packet

The Config-Change Packet payload consists of the following elements:

Command Name--the command keyword that was entered into the CNA configuration
list of param/value pairs--a list of the command parameters entered into the configuration along with their values

Link Status Packet

The Link Status Packet payload consists of the following elements:

Link--IP address of the link as defined in the CNA configuration
Prefix--address and mask in CIDR format (a.b.c.d/20)
flags--unused
reasonCode--one or more numerical codes indicating why the decision-maker process made the decision (see the section Decision Maker Events in this chapter for reason code definitions)

Route Asserted Packet

The Route Asserted Packet contains information about the links to and the links from which traffic is being moved, plus information about the number of prefixes moved to or from the link as a result of the assertion. The payload can include multiple iterations of each group of data:

When the device withdraws an assertion and the routers resume using BGP selections, there will be a set of to fields (next hop, HRTT, CNA metric, and AS path length) for each BGP route selection.
When a prefix crosses the sufficiently measured threshold and the CNA system asserts a route to it for the first time, there will be a set of from fields for each BGP route selection.
There will be an IP address and a pair of prefix-flow counters for each service provider link. Prefix-flow counters show how many prefixes have been moved onto or off your service provider links by CNA route assertions since the start of the decision-maker process. Since the same prefix can be moved on and off a link multiple times, these counters do not show how many prefixes are being served by the link. Rather, the difference between the to and from counters for any one link represents the degree to which the CNA system’s route assertions vary from natural BGP assignments.

Groupings will be identified in the packet payload by a number in brackets following each item name (the numbering scheme always starts at [0] for the first element, with [1] representing the second element, [2] for the third, and so on).

The Route Asserted Packet payload consists of the following elements:

Prefix--address and mask in CIDR format (a.b.c.d/n)
ToNextHop[n]--IP address of the asserted link’s ISP-facing interface on the edge router
ToHRTT[n]-- HRTT of the asserted link for the prefix
ToMetric[n]--CNA-calculated metric of the asserted link for the prefix
ToASPathLength[n]--length of the AS path of the natural route to the prefix through the asserted link
ToOriginAS[n]--AS number of the prefix, as learned from the link designated by the suffix [n]
FromNextHop[n]--IP address of the previously asserted link’s ISP-facing interface on the edge router
FromHRTT[n]--HRTT of the previously asserted link
FromMetric[n]--CNA-calculated metric of the previously asserted link
FromASPathLength[n]--length of the AS path of the natural route to the prefix through the previously asserted link
FromOriginAS[n]--AS number of the prefix, as learned from the link designated by the suffix [n]
routerId[n]--IP address of each router
advisedFlags[n]--an array of integers
linkFacingAddress[n]--IP address of the ISP-facing interface on the edge router
linkFacingAddress[n]--IP address of the ISP-facing interface on the edge router
linkFacingAddress[n]--IP address of the ISP-facing interface on the edge router
cumulativeToPrefixFlow[n]--shows the number of prefixes moved to the link (identified by the linkFacingAddress field with a matching suffix, [n]) as a result of this route assertion
cumulativeFromPrefixFlow[n]--shows the number prefixes moved off the link (identified by the linkFacingAddress field with a matching suffix, [n]) as a result of this route assertion

Route Confirmed Packet

The Route Confirmed Packet is generated whenever a router explicitly acknowledges that an asserted route is valid.

The payload consists of a single field:

Prefix--address and mask in CIDR format (a.b.c.d/n)

NOTE: Not all route assertions generate corresponding confirmations. If the CNA system asserts an already confirmed route to replace another previously confirmed route, there will be nothing to trigger a Route Confirmed Packet.

Route Selected Packet

The Route Selected Packet payload contains the same information as the Route Asserted Packet payload, plus the following:

reasonCode--one or more numerical codes indicating why the decision-maker process made the decision (see the section Decision Maker Events in this chapter for definitions of reason codes)

State Transition Packet

The State Transition Packet event consists of the following elements:

Mode--operating mode following the state transition; can be one of:

Reporting Mode
Route Assert Mode
Load Optimization Mode
Performance Only Mode
Unknown state of dmaker

Reason--string identifying reason for change in mode; can be one of:

Unknown
User change
Load polling required
BGP unknown status
Unknown link
Link status up and load polling available
Link status up
Load polling available
Load optimization disabled
Polling usage disabled
Polling usage enabled
In use table valid
Table becomes valid
Startup config
Unknown reason from dmaker

Transition time--timestamp identifying when the event occurred
MaxAvoidances on Links--a list of max-avoidance values configured with the link for each service provider

Unlogged Action

The BGP Packet Loss event means that the Event Manager process was unable to properly log one or more packets sent to it by the CNA decision-maker process.

This rare occurrence is most likely due to a rapid burst of decision-maker decisions temporarily overwhelming the Event Manager. It does not indicate a decision-maker failure. See the Event Details tab in the Control Panel for more information about dropped packets.

The BGP Packet Loss payload consists of the following elements, all of which show numerical counts:

bgpAnnounce--number of BGP announcement events
bgpWithdrawLoss-- number of BGP withdrawal events
confirmLoss--number of router-confirmation events
determinedLoss--number of CNA route-selection events
advisedLoss--number of CNA route-assertion events
configChangeLoss--number of Config-Change events dropped
linkStatusLoss--number of Link Status events dropped
bgpEventSummaryLoss--number of BGP Event Summary events dropped
stateTransitionLoss--number of State Transition events dropped
packetLoss--number of Unlogged Action events dropped