Skip to content
Switch branches/tags
Go to file

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time


Travis GoReportCard

For constantly tracing routes

routebeat sends ICMP pings to a list of targets to record TCP/IP routing information.
It uses for sending/recieving ping packets and tracing routes. As well as elastic/libbeat to talk to Elasticsearch and other outputs. Essentially, those two libraries do all the heavy lifting, routebeat is just glue around them.

Routebeat has three events it can publish, including:

  • Route summary stats (with a type of "route")
  • Route hop messages (with a type of "route_hop")
  • Route changes during a beat run (with a type of "route_change")

By default, only the first route event is published.


routebeat has the same requirements around the Go environment as libbeat, see here.

Supported Platforms

Currently only MacOS X and Linux are supported due to the use of syscall in


Install and configure Go.

Install and update this go package with go get -u The routebeat binary will then be available in $GOPATH/bin.

If intending on using the Elasticsearch output, you should add a new index template using the supplied one, for example with curl -XPUT /_template/routebeat -d @/path/to/routebeat-template.json.


See the example configuration file for configuring your targets and assigning an output (default output is Elasticsearch).

Once you've created a configuration file you can run routebeat with routebeat -c /path/to/pingbeat.yml.

NOTE: you will likely need to run sudo routebeat in order to send ICMP pings. If you'd like to see everything routebeat is doing, run something like: sudo ./routebeat -e -v -d routebeat -c etc/pingbeat.yml which will output information from the Debug logger "routebeat".

Kibana Dashboard

There is a Kibana export you can use to create some basic visulizations and a simple dashboard to explore routebeat data.

Note on privileges

In order to send regular ICMP ping packets, routebeat needs to open raw sockets, which can only be done with superuser privileges. So you either need to run routebeat with sudo or as root to send regular pings. I haven't tried a non-priviledged UDP traceroute yet.

Feel free to submit a PR if that is useful:)


pingbeat is licensed under the Apache 2.0 license.


An elastic beat to capture network routes




No releases published


No packages published