Session Analysis with the 128T Router

Trapped inside due to the pandemic, I've been rekindling my love/hate affair with Python recently. One of my first self-appointed projects was to write some tools to perform the types of analysis that I routinely perform when optimizing (or troubleshooting) a customer network.

As anyone that's worked with 128T can attest, it produces a wealth of data on a network's goings-on. So much data, in fact, that it can be overwhelming to parse through it. One of the primary data sources I rely on when investigating a customer network is the session table – the table that contains the state for all in-process sessions (forward and backward flow data) that the 128T has processed.

Taking snapshots of the session table provides deep insight into a network. I can take a look at a session table and invariably find areas for tightening up the configuration, a number of ways to secure it (you always find traffic you don't expect to see there...), and the composition of the application ecosystem that the networked devices are using. As a part of my morning coffee routine, I like to investigate a few 128T devices I frequent (mostly my own home network) to look for any new happenings.

Before my recent reunion with Python, I'd take a copy of the session table (by redirecting PCLI output to a local file) and slice and dice it using UNIX tools from the 1980s: sed and awk. Being a child of the 1970s, I'm pretty good with sed and awk (if I do say so myself), but as the workload of parsing through 128T data grew, so did my desire to develop some routine around this method. Enter analyzer.py.

I took about a week this summer and built a python tool for performing this analysis, which you can find on my Github page. It makes quick work of parsing the session table (and can even retrieve it from a Conductor using GraphQL, if deployed on a compatible conductor), and lets you slice and dice the results to your heart's content.

I took some time to write up a detailed Users Guide to walk through some common use cases. Give it a try, and let me know your thoughts. I'll gladly take any pull requests – particularly those that clean up my juvenile Python.