Identifying problematic inter-domain routing issues

1
Identifying problematic inter-domain routing
issues
Olaf Maennel, Anja FeldmannSaarland University,
Saarbücken, Germany
2
Motivation

• BGP scalability?!!
• BGP convergence times???
• A lot of open questions, that need
  understanding!
• What happens really in the Internet?

3
TOOL Character

• Data munching
• automatic processing of raw data
• providing an intermediate level
• Characterizing BGP updates
• identification of update events

4
TOOL Character
your function(or "Check" functions)
results
FileFinder - Package
RAW-DATA
5
route change events

• Identification of routing updates
• type of changes, flapping, session resets,
• Processing of updates in the context of
• related (same prefix)
• surrounding (near in time)
• How character works
• Input table dump1 all updates table dump2

6
Output route_btoa
Timestamp
Updated Prefix
1011363829A195.66.224.1123549
80.96.15.0/243549 3300 702 8708
1011387198W195.66.224.1123549 80.96.15.0/24
1011387339A195.66.224.11235
49 80.96.15.0/243549 701 702 8708
1011387369A195.66.224.1123549
80.96.15.0/243549 3300 702 8708
1010976980W195.66.224.112354980.96.150.0/24
1010977007A195.66.224.112354
980.96.150.0/243549 209 1755 15471
AS Path

• All updates like Merits "route_btoa m"

7
Example data sets

• RIPEs RRC00
• Jan 14, 2002 0100 Jan 20, 2002 0110

8
Output route_btoa
Timestamp
Updated Prefix
1011363829A195.66.224.1123549
80.96.15.0/243549 3300 702 8708
1011387198W195.66.224.1123549 80.96.15.0/24
1011387339A195.66.224.11235
49 80.96.15.0/243549 701 702 8708
1011387369A195.66.224.1123549
80.96.15.0/243549 3300 702 8708
1010976980W195.66.224.112354980.96.150.0/24
1010977007A195.66.224.112354
980.96.150.0/243549 209 1755 15471
AS Path

• Classification of each update is appended

9
Output What has changed?
update
change to last update
24.199 AA-DIFFASPath-way
Community35493320-gt33008708origin
25.23369AW-DIFF
26.141
WA-DIFFASPath-way Community35493300-gt701 702
transit 27.30 AA-DIFFASPath-way
Community3549701-gt3300 702 transit 1. -1
AW-DIFF
2. 27 WA-DIFFASPath-way
Community35493300-gt209 1755transit
time since last update
What has changed?
10
Type of changes
11
Output AS Path changes
last stable AS
24.199 AA-DIFFASPath-way
Community35493320-gt33008708origin
25.23369AW-DIFF
26.141
WA-DIFFASPath-way Community35493300-gt701 702
transit 27.30 AA-DIFFASPath-way
Community3549701-gt3300 702 transit 1. -1
AW-DIFF
2. 27 WA-DIFFASPath-way
Community35493300-gt209 1755transit
from where to where?
rejoining AS
12
Output Old AS Path
AS on the old Path
3549__95_ 3320__47_ 5483_15 8708__78_ 2
0. 22.8flapping 3549__95_ 3300__65_
702__61_ 8708_3 5 3. 20.6
3549__95_ 3300__65_ 702__63_ 8708__36_ 5
21.21.1 3549__95_ 701__66_
702__64_ 8708__53_ 3 0. 24.9
3549__96_ 3300__67_ 1755__54_ 15471_21
3549__96_ 3300__67_
1755__54_ 15471__33_
percentage of prefixes still reachable
13
Sets of updates for a prefixwith same attributes
14
Output n-way flapping
distance to last equal update
reconvergence
2 0. 22.8flapping20832685 lt-
(8708)__72_ 5483 5 3. 20.6
8 -1 (8708)__79_ 702 5
21.21.1 8 -2
(8708)__78_ 702 3 0. 24.9
8 flap-323540 (8708)__78_ 702
100
(15471)95 1755
100 (15471)95 1755
percentage of other prefixes by the originating
AS identified as flapping
first and last occurrence in update series
flapping
time to last flap
15
Categorization of changes
16
Probability distribution ofdistance between flaps
17
Time between equal updates
18
Session resets

• peering connection breakdown -a whole table must
  be exchanged
• Update storms are propagated through the
  internet
• How big is the problem?

19
Output possible session resets
AS number
(8708)__72_ 548366 332028 3549___0_ 2
3320 5483 (8708)__79_ 702___5_
3300___3_ 3549___0_
(8708)__78_ 702___5_ 3300___3_ 3549___0_
peak (8708)__78_ 702___5_
701___1_ 3549___0_
peak (15471)95 1755___0_ 3549___0_
3300___0_ 1 15471 (15471)95
1755___0_ 3549___0_ 3300___0_ 1 15471

Percentage of updated vs. all associated prefixes
with an AS.
20
Identification of session resets
All prefixes updated
21
Output possible session resets
number of ASs involved
(8708)__72_ 548366 332028 3549___0_ 2
3320 5483 (8708)__79_ 702___5_
3300___3_ 3549___0_
(8708)__78_ 702___5_ 3300___3_ 3549___0_
peak (8708)__78_ 702___5_
701___1_ 3549___0_
peak (15471)95 1755___0_ 3549___0_
3300___0_ 1 15471 (15471)95
1755___0_ 3549___0_ 3300___0_ 1 15471

ASs involved
22
Updates due to session resets
23
Duration of session resets
24
Output Classification
further changes?
23320 5483 7.0instable ...
5.9instable ...
peak16.2instable ...
peak16.2re-stable change... 115471
1.3instable ... 115471
1.4instable ...
further suggestions?!
update rate per second
peak identification
25
Update burst

• Like packet flows
• Bursts consists of several updates
• same prefix
• short time window

26
Burst duration
27
Updates in burst
28
Output Character

• Classification of updates
• Statistical information
• Missing updates / verification

29
Ongoing work

• RTG a realistic Routing Table (and update)
  Generator
• generation of tables and updates with
  real-world characteristics
• Use RTG to benchmark router performance

30
Conclusion
If you are interested, pleasevisit our
website http//www.net.uni-sb.de/olafm
Thank you !