Grafana dashboard: FastNetMon ASN report
Description: Top Source and Destination ASNs

# FastNetMon Top ASN pie chart

This is a dashboard for FastNetMon to display Source and Destination ASNs with lookup of ASN names by an clickhouse DICTIONARY. The dictionary is a simple tab separated file that associates an ASN with a name. You can find such exports in the internet or, if you happen to have an irrd mirror server, you can just export yourself a list from there.

You need to have clickhouse traffic export enabled in your FastNetMon installation, see the documentation of FastNetMon to learn how to do this.

## Revisions

- 3: renamed dictionaries
- 2: two dictionaries (one created by fill_dictionary, one for private mappings), three fields (autname, descr, country) per ASN
- 1: one dictionary, only one description field

## Creating the lookup dictionary

Save your asn mapping file as `/var/lib/clickhouse/user_files/asn.tsv` and use this format (\t means tab):

    15169\tGoogle
    16509\tAmazon
    ...

The dictionaries are created with the following clickhouse statements:

    USE fastnetmon:

    CREATE DICTIONARY asn_descr
    (
        `asn` UInt64 INJECTIVE,
        `autname` String,
        `descr` String,
        `country` String
    )
    PRIMARY KEY asn
    SOURCE(FILE(PATH '/var/lib/clickhouse/user_files/asn_descriptions.tsv' FORMAT 'TabSeparated'))
    LIFETIME(MIN 0 MAX 300)
    LAYOUT(HASHED())
    
    CREATE DICTIONARY asn_private_descr
    (
        `asn` UInt64 INJECTIVE,
        `autname` String,
        `descr` String,
        `country` String
    )
    PRIMARY KEY asn
    SOURCE(FILE(PATH '/var/lib/clickhouse/user_files/asn_private_descriptions.tsv' FORMAT 'TabSeparated'))
    LIFETIME(MIN 0 MAX 300)
    LAYOUT(HASHED())

## Future Enhancements

- Display some meaningful rate instead of the packet length sum

## Old Stuff

Old layout (only one description field, for revision 1):

    USE fastnetmon
    CREATE DICTIONARY asn2name
    (
        `asn` UInt64 INJECTIVE,
        `name` String
    )
    PRIMARY KEY asn
    SOURCE(FILE(PATH '/var/lib/clickhouse/user_files/asn.tsv' FORMAT 'TabSeparated'))
    LIFETIME(MIN 0 MAX 300)
    LAYOUT(HASHED())


{
  "__inputs": [
    {
      "name": "DS_CLICKHOUSE",
      "label": "ClickHouse",
      "description": "",
      "type": "datasource",
      "pluginId": "vertamedia-clickhouse-datasource",
      "pluginName": "ClickHouse"
    }
  ],
  "__requires": [
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "7.1.3"
    },
    {
      "type": "panel",
      "id": "grafana-piechart-panel",
      "name": "Pie Chart",
      "version": "1.5.0"
    },
    {
      "type": "datasource",
      "id": "vertamedia-clickhouse-datasource",
      "name": "ClickHouse",
      "version": "2.0.2"
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": "-- Grafana --",
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "type": "dashboard"
      }
    ]
  },
  "description": "Top Source and Destination ASNs",
  "editable": true,
  "gnetId": 12780,
  "graphTooltip": 0,
  "id": null,
  "iteration": 1597152555306,
  "links": [],
  "panels": [
    {
      "aliasColors": {},
      "breakPoint": "50%",
      "cacheTimeout": null,
      "combine": {
        "label": "Others",
        "threshold": 0
      },
      "datasource": "${DS_CLICKHOUSE}",
      "decimals": null,
      "fieldConfig": {
        "defaults": {
          "custom": {
            "align": null
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "fontSize": "80%",
      "format": "bytes",
      "gridPos": {
        "h": 12,
        "w": 11,
        "x": 0,
        "y": 0
      },
      "id": 1,
      "interval": null,
      "legend": {
        "header": "Traffic",
        "show": true,
        "sort": null,
        "sortDesc": null,
        "values": true
      },
      "legendType": "Right side",
      "links": [],
      "maxDataPoints": 3,
      "nullPointMode": "connected",
      "pieType": "pie",
      "pluginVersion": "7.1.1",
      "strokeWidth": 1,
      "targets": [
        {
          "database": "fastnetmon",
          "dateColDataType": "packetDate",
          "dateLoading": false,
          "dateTimeColDataType": "packetDateTime",
          "dateTimeType": "DATETIME",
          "datetimeLoading": false,
          "extrapolate": true,
          "format": "time_series",
          "formattedQuery": "SELECT $timeSeries as t, count() FROM $table WHERE $timeFilter GROUP BY t ORDER BY t",
          "interval": "",
          "intervalFactor": 1,
          "query": "SELECT 1 as time, groupArray((displayAsn, length)) as groupArr\nFROM \n(\n    SELECT \n        srcAsn,\n        concat(dictGetOrDefault('fastnetmon.asn_private_descr', 'autname', toUInt64(srcAsn), dictGetOrDefault('fastnetmon.asn_descr', 'autname', toUInt64(srcAsn), 'UNKNOWN')), ' (', toString(srcAsn), ')') as displayAsn,\n        sum(length) AS length\n    FROM $table\n    WHERE $timeFilter\n    GROUP BY srcAsn\n    ORDER BY length DESC\n    LIMIT $topn\n)\n",
          "rawQuery": "SELECT 1 as time, groupArray((displayAsn, length)) as groupArr FROM  (     SELECT          srcAsn,         concat(dictGetOrDefault('fastnetmon.asn_private_descr', 'autname', toUInt64(srcAsn), dictGetOrDefault('fastnetmon.asn_descr', 'autname', toUInt64(srcAsn), 'UNKNOWN')), ' (', toString(srcAsn), ')') as displayAsn,         sum(length) AS length     FROM fastnetmon.traffic     WHERE packetDate >= toDate(1597066294) AND packetDateTime >= toDateTime(1597066294)     GROUP BY srcAsn     ORDER BY length DESC     LIMIT 16 )",
          "refId": "A",
          "round": "0s",
          "table": "traffic",
          "tableLoading": false
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Source ASN report",
      "type": "grafana-piechart-panel",
      "valueName": "current"
    },
    {
      "aliasColors": {},
      "breakPoint": "50%",
      "cacheTimeout": null,
      "combine": {
        "label": "Others",
        "threshold": 0
      },
      "datasource": "${DS_CLICKHOUSE}",
      "decimals": null,
      "fieldConfig": {
        "defaults": {
          "custom": {
            "align": null
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "fontSize": "80%",
      "format": "bytes",
      "gridPos": {
        "h": 12,
        "w": 10,
        "x": 11,
        "y": 0
      },
      "id": 2,
      "interval": null,
      "legend": {
        "header": "Traffic",
        "show": true,
        "sort": "current",
        "sortDesc": true,
        "values": true
      },
      "legendType": "Right side",
      "links": [],
      "maxDataPoints": 3,
      "nullPointMode": "connected",
      "pieType": "pie",
      "pluginVersion": "7.1.1",
      "strokeWidth": 1,
      "targets": [
        {
          "database": "fastnetmon",
          "dateColDataType": "packetDate",
          "dateLoading": false,
          "dateTimeColDataType": "packetDateTime",
          "dateTimeType": "DATETIME",
          "datetimeLoading": false,
          "extrapolate": true,
          "format": "time_series",
          "formattedQuery": "SELECT $timeSeries as t, count() FROM $table WHERE $timeFilter GROUP BY t ORDER BY t",
          "interval": "",
          "intervalFactor": 1,
          "query": "SELECT 1 as time, groupArray((displayAsn, length)) as groupArr\nFROM \n(\n    SELECT \n        dstAsn,\n        concat(dictGetOrDefault('fastnetmon.asn_private_descr', 'autname', toUInt64(dstAsn), dictGetOrDefault('fastnetmon.asn_descr', 'autname', toUInt64(dstAsn), 'UNKNOWN')), ' (', toString(dstAsn), ')') as displayAsn,\n        sum(length) AS length\n    FROM $table\n    WHERE $timeFilter\n    GROUP BY dstAsn\n    ORDER BY length DESC\n    LIMIT $topn \n)\n",
          "rawQuery": "SELECT 1 as time, groupArray((displayAsn, length)) as groupArr FROM  (     SELECT          dstAsn,         concat(dictGetOrDefault('fastnetmon.asn_private_descr', 'autname', toUInt64(dstAsn), dictGetOrDefault('fastnetmon.asn_descr', 'autname', toUInt64(dstAsn), 'UNKNOWN')), ' (', toString(dstAsn), ')') as displayAsn,         sum(length) AS length     FROM fastnetmon.traffic     WHERE packetDate >= toDate(1597066313) AND packetDateTime >= toDateTime(1597066313)     GROUP BY dstAsn     ORDER BY length DESC     LIMIT 16  )",
          "refId": "A",
          "round": "0s",
          "table": "traffic",
          "tableLoading": false
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Destination ASN report",
      "type": "grafana-piechart-panel",
      "valueName": "current"
    }
  ],
  "schemaVersion": 26,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": [
      {
        "allValue": null,
        "current": {
          "selected": true,
          "text": "16",
          "value": "16"
        },
        "hide": 0,
        "includeAll": false,
        "label": "TopN",
        "multi": false,
        "name": "topn",
        "options": [
          {
            "selected": false,
            "text": "8",
            "value": "8"
          },
          {
            "selected": true,
            "text": "16",
            "value": "16"
          },
          {
            "selected": false,
            "text": "32",
            "value": "32"
          }
        ],
        "query": "8,16,32",
        "queryValue": "",
        "skipUrlSync": false,
        "type": "custom"
      }
    ]
  },
  "time": {
    "from": "now-24h",
    "to": "now"
  },
  "timepicker": {
    "refresh_intervals": [
      "10s",
      "30s",
      "1m",
      "5m",
      "15m",
      "30m",
      "1h",
      "2h",
      "1d"
    ],
    "time_options": [
      "5m",
      "15m",
      "1h",
      "6h",
      "12h",
      "24h",
      "2d",
      "7d",
      "30d"
    ]
  },
  "timezone": "browser",
  "title": "FastNetMon ASN report",
  "uid": "LTQeAe4Gk",
  "version": 21
}