routebeat
For constantly tracing routes
routebeat sends ICMP pings to a list of targets to record TCP/IP routing information.
It uses github.com/aeden/traceroute for
sending/recieving ping packets and tracing routes. As well as
elastic/libbeat to talk to
Elasticsearch and other outputs. Essentially, those two libraries do
all the heavy lifting, routebeat is just glue around them.
Routebeat has three events it can publish, including:
- Route summary stats (with a type of "route")
- Route hop messages (with a type of "route_hop")
- Route changes during a beat run (with a type of "route_change")
By default, only the first route event is published.
Requirements
routebeat has the same requirements around the Go environment as libbeat, see here.
Supported Platforms
Currently only MacOS X and Linux are supported due to the use of syscall in github.com/aeden/traceroute
Installation
Install and configure Go.
Install and update this go package with go get -u github.com/xeb/routebeat
. The routebeat
binary will then be
available in $GOPATH/bin
.
If intending on using the Elasticsearch output, you should add a
new index template using the
supplied one, for example with curl -XPUT /_template/routebeat -d @/path/to/routebeat-template.json
.
Usage
See the example configuration file for configuring your targets and assigning an output (default output is Elasticsearch).
Once you've created a configuration file you can run
routebeat with routebeat -c /path/to/pingbeat.yml
.
NOTE: you will likely need to run sudo routebeat
in order to send ICMP pings.
If you'd like to see everything routebeat is doing, run something like:
sudo ./routebeat -e -v -d routebeat -c etc/pingbeat.yml
which will output information
from the Debug logger "routebeat".
Kibana Dashboard
There is a Kibana export you can use to create some basic visulizations and a simple dashboard to explore routebeat data.
Note on privileges
In order to send regular ICMP ping packets, routebeat needs to open raw sockets, which can only be done with superuser privileges. So you either need to run routebeat with sudo or as root to send regular pings. I haven't tried a non-priviledged UDP traceroute yet.
Feel free to submit a PR if that is useful:)
License
pingbeat is licensed under the Apache 2.0 license.