Dashboard
⚙
Welcome to RouteLock! Let's get started.
Complete the Setup Wizard to configure routers, providers, NetFlow, and BGP peering. It only takes a few minutes.
Traffic (Last Hour)
Provider Traffic
| Provider | Status | Inbound | In Util | Outbound | Out Util | Link | 95th | Commit |
|---|
Commit Utilization
Top Inbound ASNs
Top Outbound ASNs
Pending Changes
Operating Mode:
No pending changes.
| Prefix | Reason | Source | Timestamp | Age | Actions |
|---|
Router Management
Total Routers
--
Active
--
Edge
--
Core
--
Routers
| Name | Hostname | NetFlow IP | Role | Status | Interfaces | Last Discovery | Actions |
|---|---|---|---|---|---|---|---|
Add Router
Interface Classification
Discovering...
Total Interfaces
--
Upstream (Provider)
--
Downstream (Customer)
--
Unmapped
--
Ignored
--
Interfaces
| IfIndex | Interface Name | Description | Speed | Status | Traffic | Role | Provider | Actions |
|---|---|---|---|---|---|---|---|---|
| Select a router to view interfaces | ||||||||
☇
Select a router to view and classify its interfaces
Use the dropdown above to choose a router, then discover interfaces via SNMP
Providers
Providers
| Name | Status | Type | ASN | Links | Link Size | Bandwidth | Trend | Util % | Cost / Commit | Actions |
|---|
Active Improvements
Improvements
| ID | Prefix | Old Provider | New Provider | Type | Old RTT | New RTT | Weight | Status | Actions |
|---|
Traffic Analysis
Top Prefixes
| Prefix | Destination AS | Provider | Mbps | Packets |
|---|
Traffic Analytics
to
Live
Compare with:
to
Traffic Over Time(DDoS events shown as red bands)
Top Inbound ASNs
| ASN | AS Name | Bandwidth | Packets | Flows | Prefixes |
|---|
Top Outbound ASNs
| ASN | AS Name | Bandwidth | Packets | Flows | Prefixes |
|---|
ASN Detail
Top Prefixes by Bandwidth
| Prefix | ASN | AS Name | Provider | Bandwidth | Packets | Flows |
|---|
Protocol Breakdown
| Protocol | Bandwidth | Packets | % |
|---|
Top Destination Ports
| Port | Protocol | Bandwidth | Packets | Flows |
|---|
Application Categories
BGP Sessions
BGP
--
Local AS
--
Router ID
--
Sessions Up
--
Sessions
| Protocol | State | Since | Info |
|---|
Inbound Traffic Optimization
Traffic Distribution by Provider
| Target | Provider | Inbound Mbps | Share | AS Path Len | Prepend |
|---|
Active Prepends
| Target | Provider | Prepend Count | Status | Reason | Created | Actions |
|---|
Add Inbound Prepend
DDoS Protection
Global DDoS Mitigation Config
--
Attacks Detected
0
| Target | Direction | Severity | Attack Type | bps | pps | Deviation | Detected | Duration | Actions |
|---|
Active Mitigations
0
| Target | Direction | Severity | Attack Type | Mitigation | bps | pps | Deviation | Started | Duration | Actions |
|---|
Flow Analysis - DDoS Pattern Detection
Click "Analyze" to scan flow data for DDoS patterns, large flows (>10G/20G), and anomalies.
Detected Anomalies
| Severity | Type | Direction | Target | Bandwidth | PPS | Flows | Description |
|---|
Large Flows (>10 Gbps)
| Time | Target | Src AS | Dst AS | Proto | Port | Bandwidth | Direction | Provider |
|---|
Scanner / Bot Detection
Click "Detect Scanners" to find IPs scanning your network (port scans, network sweeps, coordinated probes).
Real-time scanner alerts (from live netflow)
| Source IP | Type | Severity | Target Port | Dst IPs | Packets | Description |
|---|
| Source IP | AS | Scan Type | Severity | Unique Dst IPs | Ports | Top Port | Packets | PPS | Description |
|---|
Inline Scrubber (XDP/eBPF)
Scrubber Instances
| Hostname | API Address | Status | Last Heartbeat | Stats | Enabled | Actions |
|---|
Active Filter Rules
| ID | Type | Action | Source | Destination | Proto | Port | Packets | Bytes | Expires | Actions |
|---|
Probe Agents
One-Time Agent Token
Save now - won't be shown again
Agent Inventory
| Name | Status | Last Heartbeat | Capabilities | Source IPs | Version | Actions |
|---|
Add Scrubber Rule
Add Scrubber
Add Agent
Threat Intelligence
Intelligence Sources
Threat Intel Entries
| Source | Indicator | Type | Category | Confidence | Description | Last Seen | Actions |
|---|
Suppressions (Ignored Patterns)
| Type | Value | Reason | Permanent | Created | Actions |
|---|
Attack Management
Direction:
Attack Events
| ID | Target | Direction | Attack Type | Severity | Status | bps | pps | Intel Sources | Mitigation | Duration | Actions |
|---|
DDoS Events
✅
No Active Attacks
All clear. No ongoing DDoS attacks detected.
Ongoing Attacks
⚠ Some events may be stale — verify before taking action
| Target | Attack Type | Severity | Direction | Bandwidth | Packets/s | Duration | Mitigation Status | Mitigation | Actions |
|---|
| Target | Attack Type | Severity | Direction | Bandwidth | Packets/s | Started | Ended | Mitigation |
|---|
0 low severity events in the last 24 hours
| Target | Attack Type | Direction | Bandwidth | Packets/s | Status | Time | Duration |
|---|
Top Source IPs
Attack Details
Protocol Breakdown
TCP Flags Analysis
Port Analysis
Unique Sources Over Time
Sample Timeline
Drop Reasons
Top Source IPs (with ASN)
Top Source / Destination Ports
Top Protocols
Raw Counter Samples
Top Flows (live)
disconnected| Src | Sport | Dst | Dport | Proto | PPS | BPS | Action |
|---|---|---|---|---|---|---|---|
| No data yet — click Start. | |||||||
DDoS Analytics
Total Traffic
Median--
Peak--
Total Packets
Median--
Peak--
IP Sources
Median--
Peak--
PPS by Protocol
Source IPs by Protocol (log10)
count
TCP Flags
Top Countries
Top ASNs
Top Source Ports
Top Destination Ports
Source IP (BPS)
Top 10
Top Flows
| Time | Loc | Proto | Source | Src AS | Src Country | Destination | ICMP | TCP Flags | Packets | Total Traffic |
|---|
| Started | Ended | Prefix | Rule | Rule Type | Attack Type | Direction | PPS | BPS | Status | Actions |
|---|
⚙
Active Mitigation Rules
Active mitigation rules will appear here.
Raw Analytics JSON
{}
Alerts
Alerts
| Time | Severity | Category | Title | Message | Actions |
|---|
Reports
Active Providers
--
Active Improvements
--
Traffic
--
Unack Alerts
--
DDoS Events (24h)
--
Avg Latency Reduction
--
Traffic by Provider
Optimization Performance
| Provider | Improvements | Avg Latency Before | Avg Latency After | Reduction | Avg Loss Before | Avg Loss After | Traffic (Mbps) |
|---|
Cost Analysis
| Provider | Traffic (TB) | 95th (Mbps) | Commit (Mbps) | Utilization | Cost/Mbps | Est. Cost |
|---|
Security Summary
Maintenance Windows
Scheduled Maintenance
| Provider | Title | Scope | Start | End | Auto Withdraw | Suspend Probing | Status | Actions |
|---|
Routing Domains
Configured Domains
| ID | Name | BIRD Socket | Local AS | Router ID | Status |
|---|
High Availability
Node State
--
Peer State
--
Epoch
--
Peer Last Seen
--
HA Details
Probe IP Configuration
Assign dedicated source IPs to providers for PBR-based path probing
Total IPv4 IPs
--
Assigned IPv4
--
Total IPv6 IPs
--
Assigned IPv6
--
IPv4 Probe IPs
| IP Address | Label | Status | Assigned Provider | Actions |
|---|---|---|---|---|
IPv6 Probe IPs
| IP Address | Label | Status | Assigned Provider | Actions |
|---|---|---|---|---|
User Management
Users
| Username | Role | 2FA | Last Login | Actions | |
|---|---|---|---|---|---|
Create User
API Key Management
API Keys
| Name | Key Prefix | Created | Last Used | Expires | Actions |
|---|---|---|---|---|---|
Create API Key
API Key Created
Copy this key now. It will not be shown again.
Configuration
Our Network Prefixes
Define your announced network prefixes (IPv4 and IPv6) so RouteLock can classify traffic as inbound (destined to your network) or outbound (sourced from your network) for DDoS detection and attack management.
Runtime Settings
Controls how RouteLock optimizes your traffic in real-time
▸ What does this do?
Performance picks the fastest route (lowest latency/loss). Cost picks the cheapest provider that still meets quality thresholds. Learn more
▸ What does this do?
Review Only monitors traffic and suggests changes without modifying BGP. Active injects optimized routes into your routing table via BIRD. Start with Review Only until you're confident. Learn more
▸ What does this do?
Minimum packet loss improvement (%) required before switching a prefix to a different provider. Higher = fewer switches, lower = more aggressive optimization. Default 3% is recommended for most networks.
▸ What does this do?
Minimum latency improvement (ms) required before switching a prefix. A new provider must be at least this many milliseconds faster to trigger an optimization. Default 10ms works well for most use cases.
▸ What does this do?
Analyzes NetFlow data for volumetric DDoS attack patterns — high bandwidth spikes, port floods, protocol anomalies. When detected, triggers mitigation based on the DDoS Mode setting below. Learn more
▸ What does this do?
Manual: alerts only, you decide. Moderated: proposes FlowSpec/RTBH rules for your approval. Automated: deploys mitigations instantly, notifies you after. Start with Manual or Moderated. Learn more
▸ What does this do?
How often (in minutes) the detector revisits an active mitigation to decide whether to keep, escalate, or withdraw it. Range: 1-30. Restart routelock service to apply.
NetFlow Status
NetFlow Configuration Generator
Generate router flow export configuration. Select your flow type, fill in the details, and choose your platform.
▸ Which flow type should I use?
NetFlow v9: Recommended for most Cisco routers (IOS 12.4+, IOS-XE). FNF: Cisco IOS-XE/IOS-XR with customizable fields. IPFIX: Industry standard, supported by Juniper, Nokia, Huawei. NetFlow v5: Legacy, IPv4 only, no MPLS/BGP fields. sFlow: Packet sampling, common on switches (Arista, Broadcom). Learn more
▸ Port info
UDP port RouteLock listens on for flow data. Default 1025. Common ports: 2055 (NetFlow), 6343 (sFlow), 4739 (IPFIX). Must match your router's export config.
▸ What sampling rate?
Sample 1 out of every N packets. 512 is recommended for 1G-10G links. Use 1024-2048 for 100G+ links. Lower = more accurate but higher CPU on router. Must match what you configure on the router.
BGP Peering Configuration Generator
Generate BGP peering config between your routers and the RouteLock route server. Fill in the details and select your platform.
Server Network Interfaces
Interface Discovery 0 unmapped
As NetFlow data arrives, router interfaces are automatically discovered here. Classify each interface as a provider link, internal, management, or ignore.
| Router | ifIndex | Type | Label | Next-Hops / Flow Info | Mapped To | Traffic (Total) | Last Seen | Actions |
|---|---|---|---|---|---|---|---|---|
| No interfaces discovered yet. Start sending NetFlow data to begin discovery. | ||||||||
Provider Analytics
★
Select a provider to view detailed analytics
Choose from the dropdown above, or click a provider on the Providers page
Commit Utilization
Traffic Over Time
Top 10 ASNs
| ASN | AS Name | Bandwidth | Packets |
|---|
Top 10 Prefixes
| Prefix | Bandwidth | Packets | Flows |
|---|
Cost Summary
DDoS Playbooks
Playbooks
| Name | Description | Enabled | Rules | Prefixes | Direction | Actions |
|---|---|---|---|---|---|---|
Create Playbook
Rules
Prefixes
Operator-Defined Prefixes
Each prefix has Route-Intelligence (Noction-style optimization) and DDoS-Mitigation config. Click Edit per row.
| Prefix | Kind | ASN | Description | Route Intel | DDoS | Status | Actions |
|---|---|---|---|---|---|---|---|
Add Prefix
Route Intelligence —
DDoS Mitigation —
Threshold overrides (blank = inherit system default)
Prefix Policies
Prefix Policies
| Prefix | Policy | Probe Interval | Notes | Actions |
|---|---|---|---|---|
Add Prefix Policy
DDoS Test Harness
Validate the pattern catalog against the test prefix in batches of 10 attacks
with manual review between batches. Default target: 68.235.59.2.
| Run | Started | Batch | Range | Status | Pass / Fail / Skip | Pass rate | |
|---|---|---|---|---|---|---|---|
| Loading... | |||||||
DDoS Test Run
| Attack type | PPS avg/peak | Mbps avg/peak | Latency (before / during / after) |
Loss % | Mitigation | Mitigation lat (s) | Classifier | Result |
|---|
Pattern
Sample command
Run history
| Run | Started | Result | Mitigation | Classifier | Latency during (ms) |
|---|
Audit Log
Auto-refresh 30s| Timestamp | User | Action | Resource | Resource ID | Details | IP |
|---|---|---|---|---|---|---|
Customers & Ports
Map customer accounts onto router ports. Telemetry-joined view shows live SNMP link state and cumulative NetFlow bytes per port — gaps highlight where collector attribution is missing.
Customers
--
Ports Mapped
--
Active Ports
--
Capacity Sum
--
Customers
| ID | Name | ASN | Status | Contact | Billing ID | Ports | Notes | Actions |
|---|---|---|---|---|---|---|---|---|
Customer Ports + Telemetry
| Customer | Router | IfIndex / Name | Type | Capacity | SNMP State | Link Speed | NetFlow Bytes | Last Seen | Actions |
|---|---|---|---|---|---|---|---|---|---|
Add Customer
Map Customer Port
Hardware Sizing
Reference profiles for each routelock role. Use the recommendation engine to find the smallest profile that meets a target throughput.
Recommendation Engine
Role
Target throughput (Gbps)
All Profiles
| Role | Tier | Throughput | PPS | CPU | RAM | NIC | Disk | Notes | Actions |
|---|---|---|---|---|---|---|---|---|---|
Add Hardware Profile
SPAN Ports
Interfaces classified as SPAN/monitor sources — typically connected to taps or mirror ports for sFlow/NetFlow ingest. Mark interfaces as monitor on the Interfaces page to populate this list.
SPAN Sources
| Router | Interface | Alias | Oper Status | Link Speed | Last Seen |
|---|---|---|---|---|---|
Scoring & Stats
Phase 1: Elimination
→
Phase 2: Scoring
→
Phase 3: Decision
→
Route Change
Probe Pipeline
Live
Hot Prefixes
--
tracked in rolling 30m window
Hot Traffic
--
avg throughput · 30m window
Scheduled Probes
--
-- due, -- assigned
Probes (5 min)
--
-- ok (--)
Distinct Paths
--
-- traces, avg -- hops
Warm / Cool
--
prefixes awaiting promotion / cooling off
Phase 1 — Elimination Gates
✓ Provider must be reachable (recent successful probes)
✓ Provider must NOT be in maintenance
✓ Provider must have capacity (<85% link utilization)
✓ Probe data must be fresh (<15 minutes old)
✓ Route must exist via this provider
Any provider that fails a gate is immediately eliminated from consideration for that prefix. No score is calculated.
Phase 2 — Weighted Scoring (0-100)
40%
30%
15%
15%
Total: 100%
Must equal 100%
Phase 3 — Decision Gates
% better than current
windows required
minutes
prefixes
Enabled
Provider Cost Facts
Billing Reference
| Provider | Billing Model | Monthly Cost | Commit | Overage Rate | Port Size | Max Util | Live Status |
|---|---|---|---|---|---|---|---|
| RCN | Fixed | $2,100/mo | 100G (full link) | None | 100G | 92G | |
| Liberty Global | Fixed | $2,475/mo | 100G (full link) | None | 100G | 92G | |
| PCCW | Commit+Overage | Base + overage | 50G | $0.05/Mbps | 100G | 92G | |
| Zayo | Commit+Overage | Base + overage | 30G across 200G | $0.08/Mbps | 2x100G | 184G | |
| NetActuate | Per-Mbps | Usage-based | 1G min | $0.10/Mbps | 100G | 92G |
● RCN and Liberty Global are flat-rate — sending more traffic through them has ZERO marginal cost
● Zayo and PCCW have overage charges — traffic above commit costs real money
● NetActuate is most expensive but has unique peering/routes others may not have
● Links can sustain up to 92% utilization maximum
● Peak times: Saturday/Sunday evenings (CST)
24-Hour Network Statistics
Total Inbound
--
SNMP polled
Total Outbound
--
SNMP polled
Active Providers
--
Reachable
Active Improvements
--
Current optimizations
Prefixes Monitored
--
Unique prefixes
NetFlow Records (24h)
--
From collectors
Per-Provider Traffic
| Provider | Inbound | Outbound | Util % | Commit | Status | Commit Status |
|---|---|---|---|---|---|---|
Top 10 Inbound ASNs
| # | ASN | Name | Traffic | Share |
|---|---|---|---|---|
Top 10 Outbound ASNs
| # | ASN | Name | Traffic | Share |
|---|---|---|---|---|
Traffic by Protocol
Peak Hours Indicator
Current Time (CST):
--
Off-peak
Weekday evening
Weekend peak
Current hour
Scoring History / Optimization Decisions
Last 50 decisions
| Timestamp | Prefix | From | To | Score | Reason | Status |
|---|---|---|---|---|---|---|
Setup Wizard
Step 0