HALOWERK netzwerk

Resolves a prefix to its announcing autonomous systems and puts that answer in context. The current state gives every origin AS seen for the prefix, the number of more specific and less specific prefixes routed alongside it, when the prefix was first and last seen, and the visibility expressed as th

Validates the pair of prefix and origin AS against the RPKI repository and returns the verdict together with every ROA that bears on it: the authorised origin, the prefix it covers and the maximum length it permits. The three outcomes are kept strictly apart because they mean different things and on

Reports the propagation of a prefix as the fraction of RIS observers that see it, separately for IPv4 and IPv6, because the absolute peer count moves with the size of the measurement network and is not comparable across time or between prefixes. The share is graded against stated thresholds, and — t

Collects the observable signs of a route hijack for one prefix and reports which of them are present, with the measurement behind each. Four signs carry different weight. RPKI invalidity is the only hard one: a ROA exists and does not authorise this announcement. An origin AS that appears in the cur

Returns the neighbouring autonomous systems observed next to a given AS in BGP paths, each with the number of observers that saw the adjacency and how often it appeared, which together indicate how solid the observation is rather than how important the relationship is.

Counts BGP updates for a prefix or an autonomous system in a recent window and compares them against a baseline built from a longer preceding period for the same resource. The comparison is deliberately self-referential: an AS with a hundred prefixes has a different normal than one with ten thousand

Combines the registry view and the routing view of a prefix into one answer, keeping them apart because they are not the same thing and their disagreement is the finding. From the registry come the holder, the allocating authority, the registration and last-modified dates and the country as recorded

Looks at every AS path observed for a prefix and reports the ones that do not fit. Four patterns are checked. A path loop, where an AS appears twice with other ASes in between, which prepending does not produce and a leak does. An unusually long path, measured against the median length of all paths

Measures IPv6 adoption for an AS in a way that survives contact with reality. Counting v6 prefixes is close to meaningless on its own, because a single allocation can hold more addresses than the entire v4 internet, so a count of one is not a tenth of a count of ten.

Parses one frame up to 4096 bytes without contacting equipment. Modbus TCP includes MBAP fields and length validation; RTU includes CRC-16 validation; common function codes expose addresses, quantities, register values, bits and exceptions. OPC UA TCP exposes message/chunk headers and HEL/ACK negoti