Features
A catalog of every block of the platform — equal sections, no flagships. Each block lives in one panel, builds on shared data and writes the reasons for its decisions to the journal.
Reachability and routes
Probes in your network and in other operators’ networks continuously check your addresses and services: latency, loss, traceroute. A route change is confirmed from several vantage points, and an incident opens only on probe quorum — Telegram gets an event, not noise.
- a live map of probes and targets with real-time telemetry
- quorum incidents, automatic closing, trace history
- route changes with noise filtering (incomplete traces, short flaps) and a daily digest
- reverse traces — from outside your AS towards you — and a probe-to-probe latency matrix
- notifications: Telegram, Web Push in the browser, scheduled digests
Real speed and latency
Probes periodically transfer real data to each other and measure throughput and latency under load — you see what the subscriber feels, not an idle ping.
- charts of real throughput between your network and outside points
- idle and under-load latency (bufferbloat) side by side
- a weekly baseline and a degradation detector with sensible alert repetition
- HTTP/TCP service checks: response code, time, certificate, code changes
The Check tool
Ping or traceroute to any address from any probe — or from all at once, with source-address selection on multi-address probes. The result opens in a window with copy and a link you can share with a colleague or an upstream.
Equipment over SNMP
Borders, switches, upstreams, IX ports: interfaces, utilization, errors, BGP session state and prefix counts from neighbors.
- port down / up alerts, utilization, errors
- anomalies: a sharp change in a neighbor’s prefix count, a traffic dip on an upstream or IX
- per-minute and hourly charts, long retention
Traffic (NetFlow / IPFIX) and peering
A probe receives flow from your routers and builds the traffic picture: top autonomous systems, customers, VLANs, protocols, ports, prefixes, transit, search by IP or prefix.
- stacked charts by AS and direction, edge VLANs and customers
- a traffic spike detector (DDoS signs) with target details
- peering potential: how much traffic goes in transit to ASes you could peer with directly or at a shared IX — a weekly report with candidates, contacts and a draft letter
- flow data quality checks: gaps, divergence from SNMP
BGP
A graph of your AS and neighbors from open sources and probe traces, RPKI status, a looking glass through the probe, prefix watchlists.
- prefix origin changes, mass re-routing and withdrawals
- border session state and the RIB in the panel
- alerts on watch prefixes and invalid routes
Protection at the border
Actions over BGP from the probe on your border: blackhole, FlowSpec, dropping outbound traffic to known botnet control servers and foreign DNS resolvers.
- inbound blocks (RTBH / FlowSpec) with TTL and confirmation
- outbound blocks from an indicator feed: new entries are blocked automatically, removed ones are lifted
- verification that a block actually works, with an explanation when it does not
- never-block safety lists — DNS, CDN, your own infrastructure — and protection against overly wide prefixes
- border filter configuration generation
CGNAT (A10 Thunder / ACOS)
CGNAT health and what happens behind it: subscribers, sessions, NAT ports, pools, CPU, temperature, HA, DDoS counters — and subscribers hitting quotas.
- alerts on mass subscriber drop, port exhaustion, pool filling, DDoS anomalies
- a list of subscribers at quota with the reason: not just “many sessions” but what they actually do
- one-file export of subscriber session snapshots — at quota and in quarantine — for an analyst or external review
Subscribers, infections, indicator feed
A subscriber’s session snapshot becomes a profile: torrent, game, camera, proxy app, VPN, a bot in a DDoS network, contact with a control server, scanner, ad flood. Next to it — a plain-language explanation for support and advice for the subscriber.
- rule-based classification plus AI analysis with a clear split between proven and assumed
- infection memory: suspicion → confirmed → cleaned, relapses, supervision after lifting
- an indicator feed: botnet control servers, proxy infrastructure, relays, suspicious resolvers — with trust tiers, an operator-local layer and external sources
- indicator candidates from the behaviour of several subscribers, attack targets and campaigns, protection against falsely blocking shared services and CDNs
- messages to the support group: what is wrong with the subscriber, what to advise, a button opening the subscriber card in your CRM or billing
Automatic quarantine on CGNAT
An infected subscriber is moved to a limited CGNAT profile step by step: observation → soft limiting → hard. A separate isolation profile is applied manually only.
- entry only on fresh evidence, a veto timer for the operator, apply / cancel buttons in Telegram and the panel
- modes: journal only (“what it would do”), suggestions, full automation — a switch in the panel
- action ceilings, wave protection, a pause on signs of a false positive
- softening after clean windows, return on relapse, a week of memory
- a daily digest: entries by level, effect (sessions before/after), false positives, relapses
- exception lists: “never” and “button only” — for business subscribers
BRAS
Subscriber sessions, DHCPv4/v6, RADIUS, address pools: mass session drops, login storms, RADIUS timeouts and rejects, pool exhaustion, many NAKs — with thresholds that filter out noise.
Reports and digests
The platform produces documents, not only charts — for an upstream, for support, for incident review.
- a network diagnostic report — probes, latencies, traces, route changes, BGP — ready to analyze or forward to an upstream
- daily digests: routes, quarantine, quotas; weekly: infections, peering
- a journal of all decisions and actions with reasons — every notification can be explained
Platform
What makes ArgusNOC a product rather than a set of scripts.
- several organizations in one panel, roles (view / edit / admin), Google sign-in, invitations
- an API with tokens for integrations, Web Push, PWA — the panel works on a phone
- panel interface in Ukrainian, English and Russian
- probes for Windows, Linux and FreeBSD: one installer, auto-updates, signed releases, works behind NAT
- the center deploys on your server; updates with one script and a backup
- a public demo with anonymized data