1 Investigating occurrence of duplicate updates in BGP announcements Jong Han Park 1, Dan Jen 1, Mohit Lad 2, Shane Amante 3, Danny McPherson 4, Lixia Zhang 1 (UCLA 1, Thousand Eyes Network Solutions 2, Level-3 Communications 3, Arbor Networks 4 ) Passive and Active Measurement Conference 2010 Zurich, Switzerland

2 Investigating occurrence of duplicate updates in BGP announcements Jong Han Park 1, Dan Jen 1, Mohit Lad 2, Shane Amante 3, Danny McPherson 4, Lixia Zhang 1 (UCLA 1, Thousand Eyes Network Solutions 2, Level-3 Communications 3, Arbor Networks 4 ) Passive and Active Measurement Conference 2010 Zurich, Switzerland Duplicate!

3 Why this work BGP should never generate duplicates –In reality, duplicates can take up to 86% of the total updates during router’s busiest times Unnecessary overhead in router’s processing time Wasting network bandwidth –No systematic study yet How much duplicates do we observe? What is the impact of duplicates? What is the cause of duplicate generation?

4 Define BGP duplicates BGP is the routing protocol used in the Internet today BGP duplicates –Purely identical update received from the same peer in the same session for a given destination prefix p BGP operates in two modes: eBGP and iBGP –In this work, we study eBGP duplicate announcements

5 Quantifying the amount of duplicates Dataset –BGP data collected all monitors in RouteViews and RIPE With full table Available for the entire measurement period The numbers of monitors from 2002 to 2009: 27, 37, 54, 67, 79, 100, 109, and 90 respectively –We filtered BGP updates caused by session resets Minimum Collection Time (MCT) algorithm ** The reason why we have less monitors in March 2009: - RRC01 was down from March 20-31, RRC13 was down from March 14-31, RRC14 was down from March 24-31, 2009

6 Looking over time Duplicate updates are always observed at different times March 2009, –Duplicate updates fluctuate together with the total number of updates –Duplicate updates are not associated with a particular routing event MIN MAX

7 Duplicates vs. Different types of network Duplicate updates are observed from different types of networks No strong correlation between network type and the amount of duplicates ** BGP data collected from RV and RIPE RIS during March 2009 ** Tier1 ISPs: AS7018, AS3549, AS2914, AS209, AS6453, AS701, AS3561, AS1299 ** # of monitors: Tier1 (8), Transit (55), Stub (27)

8 Duplicates are responsible for most traffic during busiest times “Busiest time”: the times which a monitor generates the most number of updates 20% of the monitors have more than 50% of total updates as duplicates For AS1853, 86.42% of the total updates during the busiest 267 secs are duplicates AS % 17,925 updates in total 17,492 (~97%) are duplicates

9 Narrowing down the problem scope AS1 sends AS2 BGP updates (A/W/A/W/…) This update triggers internal routing dynamics Internal routing dynamics generate duplicates in eBGP AS /23 Reachable /23 Unreachable Duplicate! Case study settings: AS1 and AS2 has a BGP session. In both AS1 and AS2, we have a monitor. AS /23 Reachable

10 Investigating the causes of duplicates Duplicates are due to eBGP-iBGP interactions? Let’s verify –Measurement setting: one router providing both eBGP and iBGP data MRAI timer set to 0

11 Inferring the cause of duplicate generation by matching iBGP and eBGP Match updates using the signature signature (u) = peer || ASN || prefix || AS-PATH || ORIGIN || COMMUNITY || AGG –Moving window of 5 minutes For each duplicate eBGP update –Find the matching iBGP update U n –Look at the previous iBGP update U n-1 to find the difference 5 min U1U1 U2U2 U3U3 U4U4 U5U5 u1u1 u2u2 u3u3 u4u4 u5u5 iBGP eBGP Time 5 min Sig(U 1 ) iBGP eBGP Time Sig(U 2 )Sig(U 3 )Sig(U 4 )Sig(U 5 ) Sig(u 1 )Sig(u 2 )Sig(u 3 )Sig(u 4 )Sig(u 5 ) Duplicates! What is the difference with the previous update? Matching iBGP update

12 The cause(s) Main reason: internal CLUSTER-LIST attribute change Our controlled experiments additionally show –iBGP updates with changes in NEXT-HOP, LOCAL-PREF, and MED generate eBGP duplicates** ** One may have different results depending on router vendor and software version

13 Example of a duplicate update occurrence Path from which the announcement is delivered flaps between RRC2-RR1-RRC1 and RRC2-RR2-RRC1 When sending the update to eBGP peers, CLIST field is striped off by RRC1 More alternative paths within AS  more internal path exploration  more duplicates AS2 prefix p AS1 P AS2 P AS2 C: RR1 P AS1 AS2 RR1 RR2 RRC1 RRC2 P AS2 C: RR2 P AS2 Duplicates! Larger networks can generate more duplicates! From page 7,

14 Duplicates exist in a different form From our large ISP, internal non-transitive attribute (cluster-list) value oscillation is coupled with transitive attribute (community) value changes we conjecture that this is the case for AS2914 and AS3549, where MED and MED+comm are coupled with internal flapping

15 Summary Today, we observe non-trivial amount of eBGP duplicate updates Duplicate updates can be responsible for much of router processing during busiest times Our results suggest that internal dynamics leaks to the outside in the form of duplicate updates There exists other forms of noise in BGP, and our work is the first step to reduce such noise

16 Thank you! Jong Han Park

17 Thank you once again! Jong Han Park Potentially superfluous!