feat(monitoring): what the network sees of us, and not only what we see of it #9
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat/external-view"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Every metric this repository had described what a node sees of ITSELF. This one asks
the DN42 Global Route Collector what it sees of the AS, and it catches failures no
local metric can: our announcements filtered by a peer, a more-specific leaking out
through somebody else's de-aggregation, or the AS quietly becoming invisible while
every session on our side stays green.
It runs quarter-hourly, from the one node that feeds the collectors, under
ip vrf exec dn42. Both the interval and the singularity are manners: this is aservice run for the community.
Five things that had to be measured rather than assumed.
primaryin the query is not cosmetic, and leaving it out is the bug this commit cameclosest to shipping. Without it Bird prints every path it holds and the answer reaches
65537 bytes — one past a 64 KiB cap. The response is then TRUNCATED,
Table master6falls off the end, and the probe reports zero v6 prefixes originated: the exact false
alarm this metric exists to raise for real. With
primary, 274 bytes.dn42_external_probe_truncatedexists so that trap can never be silent again.bird-lg-go's API is a POST with a JSON body. Every GET form answers
{"error":"EOF"}—the handler reads an empty body and reports the read failure, not the mistake — which
reads exactly like a missing endpoint and is not one.
The TLS chain is the DN42 PKI's, so the root is pinned for this one
curl --cacertandinstalled NOWHERE else. A CA that legitimately signs
.dn42names has no businesssigning
mimir.thystips.xyzon a border router. Provenance rather than trust: fetchedfrom inside the overlay, then checked against the subject key identifier and serial the
wiki publishes over clearnet, and confirmed by validating the collector's chain
(ssl_verify_result=0). Worth knowing: that chain goes through burble's staging ACME
intermediate, almost certainly a misconfiguration on their side. The root is the
production one; the guarantee is weaker than it would otherwise be, and this is a
read-only monitoring value.
The certificate is committed as
.crtand not.pem, which is not cosmetic either:*.pemis gitignored precisely because the extension says nothing about the contents —it holds a private key as happily as a certificate. A public root a role has to ship
MUST be in git, or the role cannot be deployed from a clean clone. The first version of
this commit silently shipped nothing at all.
The firewall gained nothing, and that is checkable rather than asserted: the probe
satisfies the anti-leak guard instead of dodging it, because
ip vrf execputs it on aDN42 interface. The same request without it would be dropped — which is the behaviour
we want, and is now written both in flow-matrix.md and beside the rule itself.
Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01FGwvXLVXJ2PrRFwJTB3Xp9
Every metric this repository had described what a node sees of ITSELF. This one asks the DN42 Global Route Collector what it sees of the AS, and it catches failures no local metric can: our announcements filtered by a peer, a more-specific leaking out through somebody else's de-aggregation, or the AS quietly becoming invisible while every session on our side stays green. It runs quarter-hourly, from the one node that feeds the collectors, under `ip vrf exec dn42`. Both the interval and the singularity are manners: this is a service run for the community. Five things that had to be measured rather than assumed. `primary` in the query is not cosmetic, and leaving it out is the bug this commit came closest to shipping. Without it Bird prints every path it holds and the answer reaches 65537 bytes — one past a 64 KiB cap. The response is then TRUNCATED, `Table master6` falls off the end, and the probe reports zero v6 prefixes originated: the exact false alarm this metric exists to raise for real. With `primary`, 274 bytes. `dn42_external_probe_truncated` exists so that trap can never be silent again. bird-lg-go's API is a POST with a JSON body. Every GET form answers `{"error":"EOF"}` — the handler reads an empty body and reports the read failure, not the mistake — which reads exactly like a missing endpoint and is not one. The TLS chain is the DN42 PKI's, so the root is pinned for this one `curl --cacert` and installed NOWHERE else. A CA that legitimately signs `.dn42` names has no business signing `mimir.thystips.xyz` on a border router. Provenance rather than trust: fetched from inside the overlay, then checked against the subject key identifier and serial the wiki publishes over clearnet, and confirmed by validating the collector's chain (ssl_verify_result=0). Worth knowing: that chain goes through burble's *staging* ACME intermediate, almost certainly a misconfiguration on their side. The root is the production one; the guarantee is weaker than it would otherwise be, and this is a read-only monitoring value. The certificate is committed as `.crt` and not `.pem`, which is not cosmetic either: `*.pem` is gitignored precisely because the extension says nothing about the contents — it holds a private key as happily as a certificate. A public root a role has to ship MUST be in git, or the role cannot be deployed from a clean clone. The first version of this commit silently shipped nothing at all. The firewall gained nothing, and that is checkable rather than asserted: the probe satisfies the anti-leak guard instead of dodging it, because `ip vrf exec` puts it on a DN42 interface. The same request without it would be dropped — which is the behaviour we want, and is now written both in flow-matrix.md and beside the rule itself. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FGwvXLVXJ2PrRFwJTB3Xp9