Skip to content

Osprey 1.2.3

Choose a tag to compare

View all tags
@MichelW6667 MichelW6667 released this 10 Aug 20:37
· 2 commits to main since this release
v1.2.3
ece4bc1

Osprey 1.2.3. Network topology intelligence for OSPF, IS-IS, EIGRP, BGP, MPLS, and EVPN — passive discovery, protocol-accurate modelling, no agents on your routers and no routes injected.

The theme this time is BGP honesty. A router can no longer be shown holding a path it actually refused, and the AS-flow view no longer flattens a multi-hop internet into a single row. Alongside that: a dedicated frontend audit, a fourth round of protocol correctness work, and a rebuilt user administration surface.

Highlights since 1.2.2

BGP you can take at face value

  • A router is no longer credited with a path it rejected. BGP monitoring feeds deliberately include the paths a router declined to install — that is what a pre-policy feed is. Osprey was treating them as candidates, so a router could be shown reaching a destination through a route it had thrown away on arrival. In the clearest case a router was shown reaching its own directly connected subnet by way of two other autonomous systems, a full lap around the internet, while the router itself reported no such route at all. Loop rejection now runs exactly where the standard puts it, the "what if this peer fails" and traffic-shift analyses apply the same rule, and any such phantom already recorded is removed on upgrade — including from history, so time travel is corrected too. Paths a router genuinely did install with allowas-in are untouched.
  • The AS-flow view lays out the internet in layers. Autonomous systems were grouped by their role in the path, which put every intermediate network in one column no matter how far away it was — so real structure collapsed into a tangle of crossing lines. Systems are now placed by how many hops away they are, one column per hop, which is what an AS-path graph is supposed to show. Positions still stay put while you scrub the timeline, so a network that moves is a routing change and not a redraw.
  • An autonomous system that appears twice in one graph is drawn twice. Where a network legitimately shows up in two roles at once, the two were collapsed onto one spot with contradictory figures, the system count was overstated, and a leftover bubble could linger after switching to a different network. This is also the shape a route leak makes, so it is now shown rather than swallowed.
  • Return paths across a domain boundary resolve again. A path leaving one routing domain and coming back could stop after two hops with "entry point unknown" while the traffic itself flowed fine. The border router was being identified as the one that selected the route rather than the one that owns the address it points at.
  • Long cross-domain paths keep their labels. On a path stitched across protocols, an entire routing domain's worth of interior hops could render as anonymous dots.

Correctness, found on purpose

  • Nineteen new randomised test targets found six real defects, all fixed. These target the decision layers between parsing and storage, where the existing protocol-level testing did not reach. Among them: a bulk device query could stop halfway and present the partial result as complete; equal-cost BGP path selection could depend on the order the database happened to return rows, so the same question had more than one answer; two textually different identifiers could collapse onto one entry; a directory group name containing an escaped comma silently dropped a user's group membership, which is what role mapping runs on.
  • A fourth audit round, this time on the web interface, closed six primary findings and seventeen secondary ones in a single pass.
  • A third round on IGP correctness closed sixteen findings across OSPFv3, IS-IS and the passive recorders — including link-state records that were incomplete over IPv6, parallel point-to-point links being merged, and two places where the recorders put a non-conformant value on the wire.
  • Security hardening ahead of enterprise deployments. Three findings closed in the provisioning-token and two-factor paths, plus a self-review pass over those very fixes that caught three further defects in them before any of it shipped.

Administration

  • The Users panel was rebuilt after two independent design reviews reached the same conclusion about the previous version. Accounts are now row-cards with clear grouping, showing at a glance how each account signs in — local password, directory, or single sign-on — and whether two-factor is on.
  • The account shield became a real self-service page: identity, sign-in method, password and two-factor management, active sessions, and recovery codes in one place.
  • The Dashboard's device and link counts no longer drop to zero when the topology is unchanged since your last view.
  • A fresh installation is told the correct evaluation limit. The packaged configuration file claimed 16 devices where the software has granted 32 for some time. Existing installations were never actually limited; only the shipped file was wrong.

Install

curl -LO https://github.com/wijnberg-net/osprey/releases/latest/download/osprey_amd64.deb
curl -LO https://github.com/wijnberg-net/osprey/releases/latest/download/SHA256SUMS
sha256sum -c SHA256SUMS
sudo apt install ./osprey_amd64.deb

Debian 12+, Ubuntu 24.04+ (bare metal, Proxmox LXC, or VM). PostgreSQL, NATS, and nginx are pulled in as dependencies; services start under systemd and a self-signed TLS certificate is generated on first install. Open https://your-server/ and log in with the admin account created during setup.

Free evaluation: all features, up to 32 devices, no time limit. Commercial licensing: sales@wijnberg.net.

Full documentation: https://www.wijnberg.net/docs/

Assets 4
Loading