Use case · BGP assurance
When traffic silently shifts to a backup provider, the cause is almost always a BGP attribute change. Phantom captures both directions of every session with the full attribute set and history.
How Phantom does it
A customer's traffic suddenly egresses via the backup ISP. Phantom shows the local-pref on the primary path dropped and the AS-path lengthened after a peer reset — pinpointing the attribute change and its timestamp in minutes.