BGP/BMP Traffic Monitoring

BGP (Border Gateway Protocol) is the routing protocol that connects the global Internet by determining the paths data packets take between networks, while BMP (BGP Monitoring Protocol) is a separate, observational protocol used to safely stream real-time data about those BGP routing decisions to a centralized monitoring system.

BGP and BMP improve network visibility by transforming complex, hidden internet routing data into real-time, readable insights.While BGP generates the data that maps the internet, BMP acts as the window into that map, allowing network engineers to spot hidden routing errors, track external path changes, and prevent outages.

Starting with Enterprise M, nProbe integrates a new toold called bgp_server that implements both BGP and BMP protocols. As nProbe is a visibity tool, we have decided not to implement advertisements into the BGP protocol implementation so that ther is no risk that using bgp_server will advertise routes.

The bgp_server application is responsible for talking with one or more routers over BGP/BMP, receive the advertised routes and disribute them to applications such as nProbe that need to know more about traffic routing.

By establishing a peering session with actual network BGP routers, it maps traffic flows to their exact routing paths.

Core Responsibilities

  • BGP Peering: It acts as a lightweight BGP peer that establishes a session with your infrastructure’s BGP routers to natively receive live routing updates.

  • AS Path Extraction: It parses mandatory BGP attributes from those updates, specifically looking for the Autonomous System (AS) paths.

  • Flow Enrichment: It passes this routing information to nProbe or ntopng. This allows the network analyzer to attach the first ten Autonomous Systems (AS-path) to both the client and server sides of every monitored network flow.

  • Asymmetric Routing Visibility: Traditional tools like traceroute only track forward paths. The bgp_server framework helps map ingress (return) path routing, giving engineers visual clarity on how traffic is actually flowing across the internet.

To configure the bgp_server framework for your ntopng or nProbe deployment, you must complete a three-step configuration: allow passive BGP listening or active BMP, configure the execution arguments, and enable ZeroMQ delivery to pipe the AS data back to your monitoring dashboard.

Step 1: Configure Your Physical/Virtual BGP Router

Before starting the software daemon, configure your core network router (Cisco, Juniper, FRRouting, etc.) to treat your ntop server machine as a standard peer.

  • BGP Version: Ensure it uses BGPv4.

  • Peering Mode: Configure it as an Internal BGP (iBGP) or External BGP (eBGP) neighbor targeting the IP of your ntop collection server.

  • Alternatively (BMP): If your router supports the BGP Monitoring Protocol (BMP), configure it to stream BMP data to your server on TCP port 11019.

Step 2: Launch bgp_server

Run the bgp_server binary tool from the command line. You can use the explicit binary arguments to specify your Autonomous System Number (ASN), routing flags, and the ZeroMQ queue socket. You can launch the application as service bgp_server start and specify the options on /etc/nprobe/bgp_server.conf.

# ZMQ stream for updates and withdraws
-z=tcp://127.0.0.1:11059

# BGP Id (local IP address used for peering)
-i=10.82.4.121

# BGP port (default 179)
-b=179

# Private AS for peering
-a=65000

# Monitored prefixes
-n=/etc/nprobe/prefixes.txt

Argument Breakdowns:

  • -z <URL>: The ZeroMQ messaging publisher string. This sends parsed BGP data to your collector.

  • -b <port>: The passive listening port for incoming BGP sessions (Default is 179). Change to 0 if you only want BMP.

  • -p <port>: (Optional) The listener port for BMP stream collection (Defaults to 11019).

  • -a <ASN>: The local AS number your ntop box will report during the initial BGP handshake.

  • -i <IP>: The BGP Router ID string, input in dotted-decimal format.

  • -v: Verbose mode, which outputs live parsed routing logs directly onto your terminal screen.

  • -n: list of prefixes you want the bgp_server to monitor and report changes to monitoring application (e.g. ntopng). The file format is a list of prefixes (one per line) in CIDR format (both IPv4 and IPv6 are supported)/