Renesys Corp

Real-time Internet alarms make Internet security simple

Protecting critical Internet assets against hostile attacks, errors and unpredictable adverse events is one of the most important actions you can take to assure smooth, uninterrupted operation of your business.

Renesys Routing Alarms (RA) can help you do it. Just select the networks and routes you want to monitor, and within minutes you’ll be ready to receive real-time Internet alarms that are triggered by various routing changes and incidents to your selected networks.

You’ll be able to solve problems, such as suspected hijackings and network instability, before they can affect performance, productivity or availability. And your customers and employees can blissfully conduct business as usual.

Core technologies

• The Internet’s most comprehensive and detailed routing alarms, displayed in plain language.
• Data is collected continuously; routing analysis and alarming is delayed by 60 seconds—even when alarming on a majority of the Internet.
• Diverse views of worldwide routing tables make it easy to understand complicated routing events.

Additional information

• Request a Demo

Features

The Routing Alarms dashboard is your personal alarms command center. It’s configured to receive and display a variety of alarms — such as network hijackings, instability and outages — on networks you select. And you can select as many Internet networks and Autonomous Systems (AS) as you like.

Each alarm is classified and rated according to threat level, so you can easily monitor the status of networks and routes important to you, and take remedial action if needed. Keep track of your own networks, those of your business partners and customers, even your competition!

The alarms can also be delivered to you in 30-60 seconds as standard Unix/Linux logging (syslog) messages, email (SMTP), etc., even when alarming on a majority of the Internet.

Types of alarms

Hijacked Network
Detects any unauthorized AS origin for your monitored prefixes, which may indicate network hijacking. You can take prompt action to prevent possible adverse effects to your networks.

Hijacked Subnetwork
Detects the unauthorized origin of a subnetwork from your originating AS or an unexpected originating AS, from the perspective of the announced subnetwork. This may indicate a hijacking, but could be a simple misconfiguration of announced networks.

Unreachability
Alerts you if any of your monitored networks becomes unreachable from a significant portion of the Internet. This is usually due to a local outage, but can also indicate routing problems at transit providers (ISPs).

Unexpected Routed Network
Detects an unexpected network announced by one of your Autonomous Systems. Similar to the Hijacked Network alarm, but from the perspective of the AS, i.e., it looks like your AS is originating a previously unknown network. We’ll alert you to any networks that are not authorized for announcement.

Unexpected Route
Detects an unexpected provider AS in your announced AS paths. Once you configure your upstream providers, you’ll receive alerts on unexpected routes that do not travel through your providers.

Unexpected Activity
Detects and alerts you to activity on networks you have specified as unrouted (not announced or visible to the outside world).

Networks Disappeared
Displays networks showing no BGP routes in the preceding 28 days, which may indicate disconnected networks. You can remove inactive networks from your network tree.

Unavailable Subnetwork
Detects when one of your monitored networks, though still reachable through a larger network, stops being announced. Rated serious because this could indicate a misconfiguration even though the monitored network is still reachable.

Rapid Route Change
Detects networks that are announced and withdrawn repeatedly during a short time span. Such unstable networks may be dropped by other routers. You’ll be alerted to outside network instability that could affect your networks.

Benefits

Secure Internet. Business as usual.

You can rest easier knowing that you’re in the know — within 60 seconds. From disconnected and unstable networks to suspected hijackings, route leakage and degradation, you’ll have time to protect your critical assets and systems from costly damages or downtime.

Alarm for the unexpected

• Assure the integrity of your network configuration by setting an alarm for unauthorized changes.
• Catch misconfigurations in real-time.
• Protect against hostile attacks and configuration blunders outside your network.
• Detect and fix BGP network issues before your customers are affected.

Use Cases

CDN Alarming: Assure your customers’ global availability.

PhantomCDN is getting inaccessibility complaints from YourShow (a content provider client), even though everything looks great inside their network and from various external points. Then as suddenly as the outage started, it stops.

Dana, Phantom’s senior engineer, doesn’t like unsolved events, even if they resolve themselves. She stays into the evening going through her checklist, step by step. Nothing. Dana doesn’t believe in ghosts. So, who’s she gonna call? A few minutes Googling gives her the answer: Renesys.

In a flash, Renesys has the strange, but not-as-unlikely-as-you might-think answer: for a few hours that afternoon one of Phantom's NSPs, MissingLink Networks, had been originating the same network as Phantom’s other NSP!

How come? One of MissingLink’s clients had taken a few 'shortcuts' implementing a global upgrade. What they had was a network overload, but they thought they were a DOS victim and started complaining. Before MissingLink really knew what was happening, they black-holed all traffic from the source network to all their customers. Then they announced the black-holed network as their own and started originating a network that actually belongs to Phantom’s other NSP!

YourShow and Phantom suffered collateral damage from a series of mistakes made by MissingLink and its client. Dana will be ready next time. Routing Alarms will warn her within 30 seconds about any suspicious activity—inside or outside her network.

Too much software. Not enough information.

Never again! Ryan told himself as he picked up the phone in his cube at GlobalWorks. Despite the suite of advanced monitoring tools his engineers had developed, it took them more than an hour to track down why they lost a large part of their address space last night. His manager was not amused.

As GlobalWorks’ networks and announced prefixes grew, so did the number of software systems to manage it all. But they still had no warning — not a clue! — that one of their providers had a minor outage, and that minor outage would cause GlobalWorks such mayhem.

Consolidation, Ryan thought as he punched numbers on his phone. Another software system is the last thing his team needs. They need one system. One efficient system that doesn’t require constant monitoring. A system that will tell them when extra vigilance is required; when a hijacking or man-in-the-middle attack seems likely, new prefixes are announced, or routes start flapping, leaking or become unavailable. And what about assuring compliance with best practices for BGP-speaking networks…he could go on and on.

Almost there. It’s ringing. Hello, Renesys. Tell me more about your Routing Alarms.