mrt analysis

Pre-Alpha. This page describes behavior that may change.

Ze provides both daemon-side MRT recording and a standalone analysis tool. The daemon records live BGP sessions to MRT files (RFC 6396). The analysis tool processes MRT dump files from any source, including public route collectors (RIPE RIS, RouteViews), local recordings, and HTTP URLs.

Daemon MRT Recording

Ze produces MRT dumps from live BGP sessions via the mrt component. Configure under mrt {} in the YANG config. Three independent streams (following FRR's model):

1. Updates -- BGP4MP records for UPDATE messages only
2. All -- BGP4MP records for all BGP messages plus state changes
3. Routes -- periodic TABLE_DUMP_V2 RIB snapshots

Features: per-peer filtering, direction filtering (received/sent), extended timestamps (BGP4MP_ET), add-path aware, on-demand CLI dump via request mrt dump-rib, strftime filename rotation, async non-blocking writes.

Chaos MRT Recording

The ze-chaos orchestrator can also produce MRT files with the --mrt-file flag. It writes standard BGP4MP_MESSAGE_AS4 and BGP4MP_STATE_CHANGE_AS4 records from chaos peer events, readable by bgpdump, bgpkit-parser, and ze-analyze.

Analysis Tool

ze-analyze is the standalone MRT analysis tool. It reads MRT dump files and extracts statistics that inform Ze's internal buffer sizing, caching strategies, and congestion handling. It is also a general-purpose MRT Swiss Army knife for filtering, replaying, and converting BGP data.

Building

make analyze

This produces bin/ze-analyze. The target is independent from make ze, so you can build it without building the daemon.

Fetching data

ze-analyze download grabs MRT files from two public BGP collectors. Files land in test/internet/ (gitignored).

bin/ze-analyze download                     # Today's data at 00:00 UTC
bin/ze-analyze download 20260324            # Specific date
bin/ze-analyze download 20260324 1200       # Specific date and time
bin/ze-analyze download -o /tmp/mrt         # Custom output directory

Source	Type	Interval	Size
RIPE RIS rrc00 (Amsterdam)	BGP4MP updates	5 min	~5 MB per file
RIPE RIS rrc00	TABLE_DUMP_V2 RIB	Latest	~400 MB
RouteViews route-views2	BGP4MP updates	15 min	~2 MB per file
RouteViews route-views2	TABLE_DUMP_V2 RIB	2-hour intervals	~100 MB

RouteViews bz2 files are converted to gzip on download for Go stdlib compatibility.

Analysis commands

density

Measures how many NLRIs each UPDATE carries and how many UPDATEs arrive per second. Separates traffic into setup (table dumps, convergence) and maintenance (steady-state churn) using per-source-peer burst detection.

bin/ze-analyze density test/internet/ripe-updates.*.gz

Output sections: NLRIs per UPDATE distribution (announced, withdrawn, total); UPDATEs per active second distribution; setup vs maintenance classification per source peer; per-peer maintenance rate distribution; channel-sizing recommendation with empirical P50, P95, and P99.

attributes

Analyses attribute repetition across routes to guide caching decisions. Measures per-attribute cache hit rates, bundle deduplication effectiveness, and temporal locality (consecutive identical bundles).

bin/ze-analyze attributes test/internet/latest-bview.gz 2>/dev/null | jq .
bin/ze-analyze attributes test/internet/latest-bview.gz >/dev/null          # summary only

JSON on stdout, human summary on stderr.

communities

Identifies per-ASN community defaults: communities that appear in nearly every route from a given ASN.

bin/ze-analyze communities test/internet/latest-bview.gz
bin/ze-analyze communities --threshold 0.90 --format json test/internet/latest-bview.gz
bin/ze-analyze communities --post-policy test/internet/latest-bview.gz

Flag	Default	Description
--threshold	0.95	Minimum frequency to be considered a default.
--min-routes	1000	Minimum routes from an ASN to generate defaults.
--format	yaml	yaml or json.
--post-policy	off	Strip action communities to simulate a route server post-policy view.

aspath

Builds a reversed trie over AS_PATHs from MRT dumps to measure suffix sharing. Reports compression ratio, path length distribution, trie depth stats, fanout, and top origin ASNs.

bin/ze-analyze aspath test/internet/latest-bview.gz

count-attrs

Counts how many path attributes each route carries, and produces a distribution table showing the typical attribute-set size.

bin/ze-analyze count-attrs test/internet/latest-bview.gz

show

Human-readable MRT dump (like bgpdump). Displays record headers, peer info, and decoded BGP message contents including attributes, AS paths, and prefixes.

bin/ze-analyze show test/internet/ripe-updates.*.gz | head -50

routes

Extracts a prefix table from TABLE_DUMP_V2 files as JSON. Each entry includes prefix, next-hop, AS path, origin, local-pref, MED, and communities.

bin/ze-analyze routes test/internet/latest-bview.gz | jq '.[] | select(.prefix == "1.0.0.0/24")'

inject

Opens a BGP session to a remote peer and sends routes from an MRT file. Supports both TABLE_DUMP_V2 (RIB entries) and BGP4MP (UPDATE messages).

bin/ze-analyze inject --target 10.0.0.1:179 --local-as 65000 --peer-as 65001 test/internet/latest-bview.gz

replay

Replays BGP4MP messages over a BGP session preserving original inter-message timing. Configurable speed multiplier.

bin/ze-analyze replay --target 10.0.0.1:179 --local-as 65000 --peer-as 65001 --speed 10 test/internet/ripe-updates.*.gz

convert

Converts MRT records to other formats.

bin/ze-analyze convert pcap test/internet/ripe-updates.*.gz output.pcap      # BGP4MP to pcap
bin/ze-analyze convert json test/internet/ripe-updates.*.gz | jq .           # record headers as JSON

export

Send MRT data to network targets.

bin/ze-analyze export bmp --target 10.0.0.1:4321 test/internet/ripe-updates.*.gz
bin/ze-analyze export bmp --target collector:4321 --peer-ip 10.0.0.1 test/internet/ripe-updates.*.gz

Connects to a BMP collector and sends each BGP4MP message as a BMP Route Monitoring message. Optional --peer-ip filters to a single peer.

record

Record incoming protocol streams to MRT files.

bin/ze-analyze record bmp --listen :4321 output.mrt

Listens for incoming BMP (RFC 7854) connections. Received Route Monitoring messages are written as BGP4MP_MESSAGE_AS4 MRT records. Peer Up/Down notifications are written as BGP4MP_STATE_CHANGE_AS4. Multiple concurrent BMP connections are supported (writes are serialized).

serve

Passive BGP server that sends MRT file contents to any peer that connects. Useful for IXP traffic replay testing.

bin/ze-analyze serve --local-as 65000 --listen :1179 test/internet/latest-bview.gz
bin/ze-analyze serve --local-as 65000 --per-peer test/internet/ripe-updates.*.gz

With --per-peer, only records matching the connecting peer's ASN are sent.

statistics

Per-type/subtype counts, AFI breakdown, peer summary, timestamp range, and BGP message type distribution.

bin/ze-analyze statistics test/internet/ripe-updates.*.gz

filter

Select records by peer IP, peer ASN, prefix, AS-path regex, community regex, MRT type, or timestamp range. Writes matching records verbatim (no re-encoding) to a new MRT file. Multiple filters are AND-composed.

bin/ze-analyze filter --peer-asn 13335 -o cloudflare.mrt test/internet/latest-bview.gz
bin/ze-analyze filter --prefix 1.0.0.0/24 --after 2026-06-01 test/internet/ripe-updates.*.gz
bin/ze-analyze filter --as-path "174 .* 13335" -o transit.mrt test/internet/latest-bview.gz
bin/ze-analyze filter --community "13335:" -o tagged.mrt test/internet/latest-bview.gz

AS-path regex matches against space-separated ASNs. Community regex matches per-community strings: standard high:low, large global:local1:local2, extended high:low.

mrt-dump

Dumps MRT records as BGP UPDATE hex, one per line. Useful for piping into ze bgp decode.

bin/ze-analyze mrt-dump test/internet/ripe-updates.*.gz | head -5
bin/ze-analyze mrt-dump test/internet/latest-bview.gz | bin/ze bgp decode -

HTTP URL support

HTTP and HTTPS URLs are accepted anywhere a file path is expected. Compression is auto-detected from the URL suffix.

bin/ze-analyze statistics https://data.ris.ripe.net/rrc00/2026.06/updates.20260607.0000.gz

MRT formats

ze-analyze handles two MRT record types from RFC 6396.

Type	Content	Used by
TABLE_DUMP_V2	RIB snapshots (one entry per route per peer).	attributes, aspath, communities, count-attrs, mrt-dump, show, routes, inject, filter, statistics.
BGP4MP	Live UPDATE messages with timestamps.	density, attributes, communities, mrt-dump, show, inject, replay, convert, filter, statistics.

Both .gz and .bz2 compressed files are supported.

See also

• In-tree MRT analysis for the full version.
• MRT Architecture for daemon component design.
• Update Density Analysis for the empirical findings that inform forward pool channel sizing.

Adapted from main/docs/guide/mrt-analysis.md.