hyperglass by cloudimg
بواسطة cloudimg
hyperglass, the modern open source network looking glass, with abuse controls on by default
hyperglass on Ubuntu 24.04 LTS
A looking glass is the public web page a network operator publishes so that peers, customers and downstream networks can answer their own routing questions. hyperglass is the modern open source implementation: it runs read only diagnostic queries against the operator's own routers on behalf of anonymous visitors and presents the results through a genuinely polished interface, rather than the hand rolled CGI script this category is known for. It supports BGP Route, BGP Community, BGP AS Path, Ping and Traceroute across Cisco IOS, IOS XR, NX-OS, Juniper, Arista EOS, BIRD, FRR, Huawei, MikroTik, Nokia SR OS, OpenBGPD, TNSR and VyOS.
Ready the moment it boots
The image installs hyperglass 2.0.4 into a dedicated Python virtual environment, with Redis as its state store and query cache and nginx as the single public listener. All three run under systemd and start automatically. Adding your own routers is one configuration file and one command; branding is a second file. Because hyperglass derives its interface from your configuration, a helper command rebuilds and restarts everything and waits until the site is answering again, so you are never left looking at a gateway error wondering whether your change broke it.
Built for being public, because that is the point
A looking glass is deliberately exposed to the internet, and it executes commands on your routers for callers you will never authenticate. That makes it an abuse surface, so this image ships its protections switched on rather than leaving them as an exercise. Query submission is rate limited per source address. Identical queries are served from cache instead of being re run against your routers. Queries aimed at private, loopback, link local, multicast or reserved address space are refused before your router is ever contacted, so nobody can use your looking glass to map your internal network. The application and Redis listen only on loopback; nginx alone faces the network.
No credential in the image
No router address, router username, router password or key ships in the image, only clearly labelled placeholders from the IETF documentation range. The looking glass itself is anonymous by design, and the appliance administration page is not: its credentials are generated uniquely on each VM's first boot and written to a file only root can read, so no two deployments share a secret and nothing is baked in.
What you get
- hyperglass 2.0.4 with the full query set, behind nginx, managed by systemd
- Redis as the state store and query result cache, bound to loopback
- Per source rate limiting, query result caching and a non public target policy, all enabled by default
- A per VM operator password generated on first boot, with no default login
- A fully patched Ubuntu 24.04 LTS base with unattended security upgrades enabled, and 24/7 cloudimg support
Licensing
hyperglass is distributed under the BSD 3 Clause Clear licence, which is permissive and free to redistribute, with no per core fee and no separate licence to buy. The cloudimg charge ($0.04 per vCPU/hour) covers packaging, security patching, image maintenance and 24/7 expert support.