FastNetMon ASN report

FastNetMon Top ASN pie chart

This is a dashboard for FastNetMon to display Source and Destination ASNs with lookup of ASN names by an clickhouse DICTIONARY. The dictionary is a simple tab separated file that associates an ASN with a name. You can find such exports in the internet or, if you happen to have an irrd mirror server, you can just export yourself a list from there.

You need to have clickhouse traffic export enabled in your FastNetMon installation, see the documentation of FastNetMon to learn how to do this.

Revisions

• 3: renamed dictionaries
• 2: two dictionaries (one created by fill_dictionary, one for private mappings), three fields (autname, descr, country) per ASN
• 1: one dictionary, only one description field

Creating the lookup dictionary

Save your asn mapping file as /var/lib/clickhouse/user_files/asn.tsv and use this format (\t means tab):

15169\tGoogle
16509\tAmazon
...

The dictionaries are created with the following clickhouse statements:

USE fastnetmon:

CREATE DICTIONARY asn_descr
(
    `asn` UInt64 INJECTIVE,
    `autname` String,
    `descr` String,
    `country` String
)
PRIMARY KEY asn
SOURCE(FILE(PATH '/var/lib/clickhouse/user_files/asn_descriptions.tsv' FORMAT 'TabSeparated'))
LIFETIME(MIN 0 MAX 300)
LAYOUT(HASHED())

CREATE DICTIONARY asn_private_descr
(
    `asn` UInt64 INJECTIVE,
    `autname` String,
    `descr` String,
    `country` String
)
PRIMARY KEY asn
SOURCE(FILE(PATH '/var/lib/clickhouse/user_files/asn_private_descriptions.tsv' FORMAT 'TabSeparated'))
LIFETIME(MIN 0 MAX 300)
LAYOUT(HASHED())

Future Enhancements

• Display some meaningful rate instead of the packet length sum

Old Stuff

Old layout (only one description field, for revision 1):

USE fastnetmon
CREATE DICTIONARY asn2name
(
    `asn` UInt64 INJECTIVE,
    `name` String
)
PRIMARY KEY asn
SOURCE(FILE(PATH '/var/lib/clickhouse/user_files/asn.tsv' FORMAT 'TabSeparated'))
LIFETIME(MIN 0 MAX 300)
LAYOUT(HASHED())