Flap Monitor

The Flap Monitor surfaces subscribers with excessive PPPoE auth churn — accounts that repeatedly authenticate (connect / drop / reconnect) inside a short window. A flapping subscriber is usually a hardware or line problem: a dying CPE, bad power, low fiber optical power, an MTU/MRU mismatch, or two routers sharing one set of PPPoE credentials.

The page is a read-only view over the flap_events table. The rows are produced by the background FlapMonitorService; no admin action creates or clears them — you watch the table and act on the underlying cause.

How to get here

Sidebar → Flap Monitor. Direct URL: /flaps.

Requires flaps.view. Both endpoints behind the page (/flaps/open and /flaps/recent) are gated by that one permission.

Layout

The page has two tabs plus a manual Refresh button.

Element	Behavior
Open flaps tab	Currently-open flap events (resolved_at IS NULL), newest first. Shows a red count badge. Auto-refreshes every 30 seconds.
History (last 100) tab	The 100 most recent events, open and resolved. Auto-refreshes every 60 seconds (only while the tab is active).
Refresh button	Forces an immediate reload of the active tab.
Include ghost flaps checkbox	History tab only — toggles whether ghost rows are shown.

The Open tab returns up to 200 rows; History returns up to 100.

Columns

Column	Source	Notes
Subscriber	username	Links to the Subscriber Detail page via subscriber_id.
Auth events	auth_count	Number of auth attempts counted in the 5-minute window.
Duration	first_seen → last_seen	How long the flapping has been going on, formatted (s / min / h).
MAC	mac_address	The CPE MAC, when known.
Last seen	last_seen	Relative time (“2 min ago”, “3 h ago”).
State	Derived	GHOST, RESOLVED, or OPEN — see below.

State values

State	Meaning
OPEN (red)	resolved_at is null — the subscriber is still flapping.
RESOLVED (green)	resolved_at is set — flapping stopped and the event closed.
GHOST (grey)	The ghost flag is set — see below. Ghost rows render dimmed.

What counts as a flap

A flap event is opened when a subscriber accumulates excessive PPPoE auth attempts inside the last 5 minutes. auth_count is that rolling count, and the “in 5 min” label on the column reflects the window. When the churn stops, the FlapMonitorService closes the event by setting resolved_at, which moves it from the Open tab to RESOLVED in History.

Ghost flaps

A “ghost” flap is a soft-deleted subscriber whose CPE is still trying to authenticate — the account is gone from the panel but the router on the customer end keeps dialing. These rows are flagged ghost and:

• Are hidden from History by default.
• Appear only when you tick Include ghost flaps on the History tab.
• Are rendered dimmed and badged GHOST.

Note

Ghost flaps point at a device that should no longer be connecting at all. If you see them, the customer’s CPE still has stale PPPoE credentials configured, or a router was never decommissioned after the account was removed.

When there is nothing wrong

If the active tab has no rows, the page shows a green check with a friendly message — “No active flaps / Every subscriber is authenticating normally” on the Open tab, or “No history” on the History tab. An empty Open tab is the healthy steady state.

Acting on a real flap

When the Open tab has rows, the page shows an amber checklist of likely physical causes. Work through them on the flagged subscriber:

1. Dying CPE or a bad power brick.
2. Fiber optical power, if the customer is on GPON.
3. Two PPPoE clients on the same credentials (daisy-chained routers both dialing).
4. MTU/MRU mismatch causing LCP drops.
5. The customer’s CPE rebooting in a loop.

Click the subscriber name to open their detail page, then cross-reference the Sessions page to watch the connect/disconnect pattern and the last acct_terminate_cause in real time.

Common workflows

Triage who is flapping right now

1. Open Flap Monitor (defaults to the Open tab).
2. Sort your attention by Auth events (highest churn) and Duration (longest-running).
3. Click the worst offender’s name to jump to their detail page and check the MAC and last sessions.

Confirm a fix held

1. After replacing a CPE or fixing the line, leave the subscriber online.
2. Watch the Open tab (auto-refresh every 30 s). When churn stops, the event closes.
3. Switch to History to confirm the event now shows RESOLVED.

Hunt stale credentials

1. Open History and tick Include ghost flaps.
2. Ghost rows are deleted accounts whose CPE still dials. Track down the device and clear or reconfigure its PPPoE login.

Permissions

Permission	Effect
flaps.view	Loads the page and both the Open and History data feeds.

The page is read-only — there are no per-row actions, so flaps.view is the only permission involved.

Related pages

• Sessions — live PPPoE session table; watch the connect/disconnect pattern and terminate causes behind a flap.
• Subscriber Detail — opened by clicking a subscriber name; check MAC binding, service, and recent sessions.
• Diagnostic Tools — Ping / Traceroute the subscriber’s IP to probe a suspected line problem.