PingVault
Network intelligence and BGP cascade forensics platform — reconstructing propagation, blast radius and timing after a routing event.
--- title: "PingVault" summary: "Network intelligence and BGP cascade forensics platform — reconstructing…" stack: ["BGP", "Python", "DuckDB"] relevance: "Answering what actually happened, once the event is over." featured: true section: work ---
Afterwards
During a routing event the work is restoration, and nobody is taking notes. Once service is back the questions start — what propagated, how far, how fast, and who saw it — and the state that would answer them is already gone. BGP keeps no history. The table holds what is true now, and it was rewritten while everyone was busy.
Reconstruction
Control-plane data comes from RIPE RIS — the RIPEstat REST API for historical state, and the RIS Live WebSocket feed for updates as they arrive. Replayed in timestamp order, those rebuild a per-prefix view of what each RIS collector peer believed at any given moment during the event.
The unit of analysis is the triple of prefix, observing peer, and time. Once the event is expressed that way, the questions that were unanswerable become ordinary queries: which peers saw the withdrawal, in what order, and which never saw it at all.
RIPE Atlas supplies the other half of the picture. BGP says what was advertised; Atlas measurements say what was reachable, and those are not the same claim. MaxMind GeoLite2 enriches the result geographically, so a reconstruction can be read by region rather than only by AS number.
Blast radius
Reach is not the same as impact. A prefix can be withdrawn globally and affect nothing, or shift by one AS hop and break the single path that happened to carry everything that mattered.
Blast radius is therefore expressed as three signals rather than as a count of affected prefixes: deviation from each prefix's established path baseline, AS-level churn across the observation window, and reannouncement-rate anomaly windows, where a prefix is withdrawn and readvertised faster than its steady state.
Those are indicators, not a damage figure. What they do is narrow where to look.
Timing
Propagation is neither instant nor uniform, and the spread is usually the most diagnostic part of the record. Convergence measured per peer distinguishes an event that propagated cleanly and slowly from one that oscillated — which points at different causes and different fixes.
Why it is a vault
Forensics only works on data that was already being kept. Collector archives age out, and the window in which an event can still be reconstructed is shorter than the window in which someone will ask about it.
Retaining the reconstruction, rather than the ability to perform one later, is the whole premise of the tool.