Kentik

---
name: kentik
description: "Expert coverage of Kentik network observability platform: large-scale flow analytics, BGP monitoring, DDoS detection and mitigation, Kentik NMS, Kentik Map, AI-powered insights, natural language queries, and REST API automation. Use for \"Kentik\", \"flow analytics\", \"NetFlow analyzer\", \"Kentik NMS\", \"Kentik Map\", \"DDoS detection\", \"BGP monitoring\", \"Kentik API\", \"network observability\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `network-monitoring` skill."
license: MIT
---

# Kentik

This skill covers the Kentik network observability platform. Areas of expertise include:

- Large-scale flow analytics (NetFlow v5/v9, IPFIX, sFlow, VPC Flow Logs, eBPF)
- Flow enrichment with BGP AS path, GeoIP, RPKI, custom tags
- DDoS detection via ML-based baseline profiling and anomaly detection
- Automated DDoS mitigation triggers (A10, Radware, RTBH, Flowspec)
- BGP route monitoring, hijack detection, and route leak alerting
- Kentik NMS (SNMP device monitoring integrated with flow data)
- Kentik Map (automated topology from flow + BGP + SNMP)
- AI Insights ("What Changed?" analysis, natural language queries)
- Synthetic monitoring (built-in active probing)
- REST API, webhooks, Python SDK, Terraform provider

## How to Approach Tasks

1. **Classify** the request:
   - **Traffic analysis** -- Flow query design, top talkers, application visibility, capacity planning
   - **DDoS** -- Detection tuning, mitigation integration, alert configuration
   - **BGP** -- Route monitoring, hijack detection, path analysis
   - **Infrastructure** -- Kentik NMS SNMP polling, Kentik Map topology
   - **Automation** -- REST API, webhooks, Terraform, Python SDK

2. **Identify data sources** -- Which flow protocols are available (NetFlow, sFlow, IPFIX, VPC Flow Logs)? Are BGP feeds configured? Is SNMP polling enabled?

3. **Analyze** -- Apply Kentik-specific reasoning. Kentik's strength is correlating flow, BGP, and device data at massive scale with sub-second ad-hoc queries.

4. **Recommend** -- Provide specific query strategies, dashboard designs, alert policies, or API calls.

## Core Architecture

### Flow Analytics Engine
- **Ingestion**: NetFlow v5/v9, IPFIX, sFlow, VPC Flow Logs (AWS, GCP, Azure), eBPF agent
- **Scale**: Designed for billions of flow records per day; proprietary time-series datastore
- **Query speed**: Sub-second ad-hoc queries across months of full-granularity data
- **Retention**: Full-granularity flow data retained for months (not sampled/rolled up)

### Flow Enrichment
Every flow record is automatically enriched with:
- **BGP AS path**: Source and destination AS, transit providers
- **Geographic data**: GeoIP (MaxMind) for location context
- **RPKI validation**: Route origin validation status
- **IANA port registry**: Application identification by port
- **Custom tags**: Device role, site, customer, business unit (user-defined)
- **Device metadata**: Hostname, vendor, model (from SNMP)

### Data Model
Flows are stored with all enrichment dimensions, enabling ad-hoc multi-dimensional queries:
```
Flow Record = {
  src_ip, dst_ip, src_port, dst_port, protocol,
  bytes, packets, duration,
  src_as, dst_as, as_path,
  src_geo, dst_geo,
  device, interface, direction,
  custom_tags...
}
```

## DDoS Detection and Defense

### Baseline Profiling
- ML-based traffic profiling per customer, network, application, interface
- Learns normal patterns: volume, packet rate, protocol distribution, geographic distribution
- Builds per-dimension baselines (hourly, daily, weekly)

### Anomaly Detection
- Real-time comparison of current traffic against learned baselines
- Alert triggers when traffic exceeds normal by configured multiplier
- Multi-dimensional detection: volume, packet rate, protocol ratio, source diversity

### Attack Classification
- **Volumetric**: Bandwidth exhaustion (UDP flood, DNS amplification, NTP reflection)
- **Protocol**: State exhaustion (SYN flood, ACK flood, fragmentation)
- **Application**: Application-layer exhaustion (HTTP flood, DNS query flood)

### Automated Mitigation
- **RTBH (Remote Triggered Black Hole)**: Announce /32 route to null via BGP community
- **Flowspec**: BGP Flowspec rules for granular traffic filtering
- **A10 Networks**: API integration for scrubbing center activation
- **Radware DefensePro**: API-triggered mitigation
- **Custom webhook**: Trigger any external system via HTTP POST

### Mitigation Workflow
```
1. Kentik detects anomaly exceeding baseline threshold
2. Alert fires with attack classification details
3. Automated mitigation trigger activates (RTBH, Flowspec, or scrubber API)
4. Mitigation in effect; Kentik continues monitoring
5. Attack subsides; auto-withdrawal or manual deactivation
6. Post-incident report generated
```

## BGP Monitoring

### Route Collection
- Receives full BGP table feeds from customer routers
- Integrates with public route collectors (RIPE RIS, RouteViews)
- Stores BGP RIB snapshots and update streams

### Detections
- **Route change alerts**: Prefix announcement/withdrawal, AS path changes
- **Prefix hijack**: Unexpected origin AS for your prefixes
- **Route leak**: Unexpected transit AS in path (customer announces provider routes)
- **RPKI ROA validation**: Alerts on RPKI-invalid route origins
- **Subprefix hijack**: More-specific prefix announced by unauthorized AS

### BGP + Flow Correlation
- Correlate BGP route changes with traffic shifts observed in flow data
- Answer: "When the route changed, did traffic follow? Did latency increase?"
- Identify traffic engineering opportunities based on AS path analysis

## Kentik NMS

SNMP-based device monitoring integrated with flow analytics:

- **SNMP polling**: Device CPU, memory, interface utilization, error counters
- **Auto-discovery**: Discover devices and interfaces via SNMP walk
- **Correlation**: Overlay device metrics on flow analytics dashboards
- **IP address search**: Find IP assignments across devices (2025 feature)
- **Kentik Map**: Automated network topology from SNMP + flow + BGP data

### Kentik Map
- Automated topology visualization combining multiple data sources
- Geographic and logical views
- Interface-level traffic overlay from flow data
- Device health overlay from SNMP polling
- Interactive: click device for drill-down to flow analytics

## AI Insights

### "What Changed?" Analysis
- ML-powered root cause analysis for traffic anomalies
- Automatically identifies top contributing dimensions to any anomaly:
  - Which ASN contributed the most change?
  - Which source/destination prefix?
  - Which application/port?
  - Which device/interface?
- Reduces mean time to identify (MTTI) from hours to seconds

### Natural Language Queries
- AI-powered conversational interface for flow data
- Example: "Show me top talkers to AWS from the New York site in the last hour"
- Translates to optimized flow queries behind the scenes
- Accessible from dashboard and API

### Saved Queries and Dashboards
- Save complex queries as reusable views
- Custom dashboards with drag-and-drop query widgets
- Alerting thresholds on any saved query
- Scheduled reports (PDF, email)

## Synthetic Monitoring

- Built-in active probing capability (added alongside flow analytics)
- HTTP, TCP, ICMP synthetic tests
- Agent-based (deploy Kentik agents at sites)
- Correlate synthetic results with flow analytics
- Measure: latency, jitter, packet loss, availability

## API

### REST API
- Base URL: `https://api.kentik.com/api/v5/`
- Authentication: API token in `X-CH-Auth-Email` and `X-CH-Auth-API-Token` headers

### Key Endpoints
```
GET  /devices              # List monitored devices
POST /query/topXdata       # Ad-hoc flow query
GET  /alerting/policies    # List alert policies
POST /alerting/policies    # Create alert policy
GET  /bgp/routes           # BGP route data
GET  /synthetics/tests     # Synthetic test list
POST /tags                 # Manage custom tags
```

### Query API
The query API is the core power of Kentik:
```json
POST /query/topXdata
{
  "queries": [{
    "query": {
      "metric": "bytes",
      "dimension": ["src_ip", "dst_ip"],
      "filters": {
        "connector": "All",
        "filterGroups": [{
          "connector": "All",
          "filters": [{
            "filterField": "dst_port",
            "operator": "=",
            "filterValue": "443"
          }]
        }]
      },
      "lookback_seconds": 3600,
      "topx": 20
    }
  }]
}
```

### Terraform Provider
- `kentik/kentik` provider on Terraform Registry
- Manage: devices, tags, alert policies, synthetic tests
- State-based management for IaC workflows

### Python SDK
- `kentik-api` package on PyPI
- Wraps REST API with Python objects
- Use cases: automated device onboarding, custom reporting, alert integration

## Common Pitfalls

1. **Flow sampling rate too aggressive** -- High sampling (1:10000) loses visibility into small flows. Balance sampling rate against device CPU. Start with 1:1000 for core routers.

2. **Missing BGP feed** -- Flow data without BGP context lacks AS path enrichment. Configure BGP peering from core routers to Kentik for full enrichment.

3. **Custom tags not applied** -- Tags must be explicitly configured for enrichment. Without tags, queries lack business context (customer, site, application).

4. **DDoS thresholds too tight** -- Initial baseline period needs 2+ weeks of data. Tight thresholds during learning cause false positives.

5. **Not using "What Changed?"** -- Manual query iteration is slow. Use AI Insights first to identify the dominant dimension, then drill down.

6. **VPC Flow Log gaps** -- Cloud flow logs may have sampling, delay, or missing fields depending on provider. Verify completeness before relying for billing or security.

7. **Ignoring RPKI validation** -- RPKI alerts are increasingly important. Configure RPKI ROA validation to detect routing security issues early.