Rcat :: About ... What Rcat is ... Rcat is an eBGP root cause analysis tool developped by Anthony Lambert, PhD student at Orange Labs, with the precious help of Mickael Meulle and Marc-Olivier Buob, many thanks to them . What Rcat does ... Rcat analyzes BGP announcements sent by route-views eBGP peers , so as to determine which ASs are the more likely to have originating the inter domain structure changes which have lead to the emission and spread of the BGP announcements collected. Rcat performs several tasks: Every day it computes for each eBGP peer its primary path to every prefix, based on the analysis of the previous month RIBs. Every 15 minutes, It searches route-views' data repository for new updates files to analyze. If some are available, it analyzes route-views eBGP peers' announcements they contain. These announcements are interpreted accordingly to the pre-computed primary paths, in order to detect the unavailability periods of the primary paths. These unavailabilities are then correlated: Inside of the different impacted origin AS trees to reduce the set of possible originators . Between impacted origin AS trees to gather the ones impacted by the same underlying event and reduce once again the set of possible originators. Finally, an event is extracted events when Rcat decides, it has seen all the primary path unavailabilities related to it, based on the conditional fading probability . Said in other words, Rcat is a very big state machine that keeps track for every primary path of its state: available or unavailable and correlates primary paths unavailabilities so as to extract the underlying events. What you can do with Rcat ... Rcat enables you to search for inter domain events with the possibility of setting many options (search period, time zone, impacted ASs, prefixes, inferred originators, size, multiplicity, etc.). For the events it finds, Rcat displays a picture (except for very huge events), details about each impacted prefix p, including the possibility of displaying the paths explored by each source router to reach p during the event. We strongly advertise you to throw an eye on the How To part to get a better understanding of the possibilities of Rcat. Rcat also enables you to draw many customizable graphs about announcements and events. (See stats part.) Interesting features of Rcat ... Among others, the possibility to set complex logical queries and the ability of Rcat to detect that the event it is extracting is an occurrence of some event that has already happened at least once in the month, making the concept of inter domain event signature real. Questions or comments about Rcat ... Please contact us at: