Director Concepts

RioRey Director facilitates out-of-band network monitoring, anomaly detection, and automation. It leverages network and customer definitions from rWeb to minimize the amount of effort needed to maintain consistent network routing and mitigation behavior. When deployed, it can monitor traffic conditions using flow samples and mitigate attacks through redirection or other traffic engineering policies.

Network Monitoring

Director receives network traffic samples from your network devices (or even external customer network devices, such as when providing scrubbing services). It calculates incoming traffic against the Group and Zone configuration pulled from rWeb. The traffic rates are checked against the configured workflows (more on this in the next section.md) to determine what, if any, actions need to be taken.

Workflow Configuration

The top level configuration concepts for Director are mappings, workflows, and actions:

• A mapping is used to associate Zones with a given workflow. This is either specified directly by Zone ID, or is derived through the Group (where the Group either owns the Zone directly, or is the ancestor of another Group which does via the group-id-recursive key). The Zones and Groups themselves are configured on rWeb, which is then polled by Director.
• A workflow is used to determine the set of actions that should be taken in response to network events. A given workflow will have two general sections: a set of triggers that are the network events you want to respond to, and the set of actions that will fire when any of the triggers for the workflow are met.
• An action is the concrete action that will be executed when a workflow is triggered. A BGP or BGP Flowspec announcement can be used for traffic redirection, but Director has the capability to execute arbitrary scripts as well.

The majority of effort in your configuration will likely be in designing your workflows, as that is the configuration element most responsible for tying together observed network behavior with any desired reaction behavior (such as traffic redirection).

Workflow Escalation

Each workflow has its own set of triggers to determine when it should initiate the associated actions. The same triggers can be used at higher thresholds to serve as escalations based on detected network behavior. Since workflows are independent of each other, this means that if you use the same trigger with a higher threshold, when that higher threshold is met both workflows will be triggered (the second won't stop the first). Likewise, when conditions drop below the second but not the first, only the second workflow will stop but the first workflow's actions will still be in effect.

This methodology is shown in the basic offramp scrubbing example. One workflow kicks in when a host reachs a specific bit rate, and the other kicks in when the associated Zone reachs a much higher bit rate.

When using BGP or BGP Flowspec actions for these types of situations, you should also consider order of operations (as Flowspec rules will usually be applied before normal BGP routing.md). If the action could match an existing announcement, and you need to ensure some degree of priority, consider using some of the optional configuration fields such as local-pref to help determine which announcement is used.

Network Redirection

Director actions describe how attacks should be mitigated by interacting with your network or other systems.

Director runs its own instance of BGP that can be configured to peer with other instances internal or external to your network. In most cases redirecting your traffic will be done by configuring your workflows and actions to issue appropriate BGP or BGP Flowspec announcements to these neighbors.

If you are not using BGP, you can instead design custom scripts (e.g. something that logs into your router and does manual route updates.md) instead.