1. BGP Multiple Origin AS (MOAS) Conflict Analysis Xiaoliang Zhao, NCSU S. Felix Wu, UC Davis Allison Mankin, Dan Massey, USC/ISI Dan Pei, Lan Wang, Lixia Zhang, UCLA NANOG-23, October 23, 2001

2. NANOG 23 - Oakland210/23/2001 Definition of MOAS n BGP routes include a prefix and AS path –Example: 131.179.0.0/16, Path: 4513, 11422, 11422, 52 n Origin AS: the last AS in the path –In the above example: AS 52 originated the path advertisement for prefix 131.179/16 n Multiple Origin AS (MOAS): the same prefix announced by more than one origin AS

3. NANOG 23 - Oakland310/23/2001 Example MOAS Conflicts 128.9.0.0/16 Path: 226 128.9.0.0/16 nets AS 4 AS 226 128.9.0.0/16 Path: 4 128.9.0.0/16 Path: X, 4 AS X AS Y 128.9.0.0/16 Path: Z, 226 AS Z MOAS conflict ! Static or IGP learned route to 128.9/16 Valid MOAS case: 128.9/16 reachable either way Invalid MOAS case: 128.9/16 reachable one way but not the other

4. NANOG 23 - Oakland410/23/2001 Talk Outline n Measurement data shows that MOAS exists n Some MOAS cases caused by faults n Some MOAS cases due to operational need n Important to distinguish the two –proposed solutions

5. NANOG 23 - Oakland510/23/2001 Measurement Data Collection n Data collected from the Oregon Route Views –Peers with >50 routers from >40 different ASes. –Our analysis uses data [11/08/97  07/18/01] (1279 days total) n More than 38000 MOAS conflicts observed during this time period At a given moment, –The Route Views server observed 1364 MOAS conflicts –The views from 3 individual ISPs showed 30, 12 and 228 MOAS conflicts

6. NANOG 23 - Oakland610/23/2001 MOAS Conflicts Do Exist Max: 11842 (11357 from a single AS) Max: 10226 (9177 from a single AS)

7. NANOG 23 - Oakland710/23/2001 Histogram of MOAS Conflict Lifetime Total # of days a prefix experienced MOAS conflict # of MOAS conflicts

8. NANOG 23 - Oakland810/23/2001 Distribution of MOAS Conflicts over Prefix Lengths ratio of # MOAS entries over total routing entries for the same prefix length

9. NANOG 23 - Oakland910/23/2001 Multi-homing without BGPPrivate AS number Substitution Valid Causes of MOAS Conflicts 128.9/16 Path: 11422,4 128.9/16 Path: 226 131.179/16 Path: 64512 131.179/16 Path: X 131.179/16 Path:Y 128.9/16 131.179/16 AS 64512 AS Y AS X AS 4 AS 11422 AS 226 Static route or IGP route 128.9/16 Path: 4

10. NANOG 23 - Oakland1010/23/2001 Invalid Causes of MOAS Conflicts n Operational faults led to large spikes of MOAS conflicts –04/07/1998: one AS originated 12593 prefixes, out of which 11357 were MOAS conflicts –04/10/2001: another AS originated 9180 prefixes, out of which 9177 were MOAS conflicts n Falsely originated routes –Errors –Intentional traffic hijacking

11. NANOG 23 - Oakland1110/23/2001 Handling MOAS Conflicts n RFC 1930 recommends each prefix be originated from a single AS n Today’s routing practice leads to MOAS in normal operations n We must tell valid MOAS cases from invalid ones –Proposal 1: using BGP community attribute –Proposal 2: DNS-based solution

12. NANOG 23 - Oakland1210/23/2001 BGP-Based Solution Define a new community attribute –Listing all the ASes allowed to originate a prefix n Attach this MOAS community-attribute to BGP route announcement n Enable BGP routers to detect faults and attacks –At least in most cases, we hope!

13. NANOG 23 - Oakland1310/23/2001 Comm. Attribute Implementation Example router bgp 59 neighbor 1.2.3.4 remote-as 52 neighbor 1.2.3.4 send-community neighbor 1.2.3.4 route-map setcommunity out route-map setcommunity match ip address 18.0.0.0/8 set community 59:MOAS 58:MOAS additive Example configuration: AS58 18/8, PATH, MOAS{4,58,59} AS59 18.0.0.0/8 18/8, PATH, MOAS{58,59} 18/8, PATH, MOAS{52, 58} AS52

14. NANOG 23 - Oakland1410/23/2001 Implementation Considerations n Quickly and incrementally deployable –Generating MOAS community attribute: configuration changes only –Detecting un-validated MOAS or a MOAS-CA conflict: Short term: observable from monitoring platforms Longer term: adding into BGP update processing n But community attributes may be dropped by a transit AS due to local configurations or policies –time to fix the handling of community attributes?

15. NANOG 23 - Oakland1510/23/2001 Another Proposal: DNS-based Solution n Put the MOAS list in a new DNS Resource Record ftp://psg.com/pub/dnsind/draft-bates-bgp4-nlri-orig-verif-00.txt by Bates, Li, Rekhter, Bush, 1998 $ORIGIN 18.bpg.in-addr.arpa.... AS 58 8 AS 59 8... Example configuration (zone file for 18.bgp.in-addr.arpa): Query 18.bgp.in-addr.arpa: origin AS? Response 18.bgp.in-addr.arpa AS 58 8 AS 59 8 Enhanced DNS service MOAS detected for 18/8, query DNS to verify

16. NANOG 23 - Oakland1610/23/2001 Issues to Consider for the DNS Solution n Provides a general prefix to origin AS mapping database n Complementary to Community-attribute Approach –Check with DNS when community tag indicates a potential problem –DNSSEC, once available, authenticates the MOAS list nBut requires changes to DNS and BGP nDNS may be vulnerable without DNSSEC –When would DNSSEC be ready? nRouting system querying naming system: circular dependency?

17. NANOG 23 - Oakland1710/23/2001 Summary n MOAS conflicts exist today –Some due to operational need; some due to faults n Blind acceptance of MOAS could be dangerous –An open door for traffic hijacking n We plan to finalize the solution and bring to IETF Send all questions to fniisc@isi.edufniisc@isi.edu For more info about FNIISC project: http://fniisc.nge.isi.edu