1. Measuring the Adoption of Route Origin Validation and Filtering
Andreas Reuter
Joint work with Randy Bush, Ethan Katz-Bassett,
Italo Cunha, Thomas C. Schmidt, and Matthias Wählisch
PEERING
The BGP Testbed

2. A Problem with BGP…
AS B
AS D P P P
AS C
AS A

3. A Problem with BGP… AS B AS D ??? AS A AS C P P P Legitimate Origin
Attacker

4. …and the (partial) solution: RPKI
AS B
AS D P P P
AS C
AS A

5. …and the (partial) solution: RPKI
AS B
AS D P P P
AS C
Prefix: P
Legitimate Origin: AS A
AS A
Owner of P

6. …and the (partial) solution: RPKI
AS B
AS D P P P
AS C
Prefix: P
Legitimate Origin: AS A
Owner of P
AS A

7. …and the (partial) solution: RPKI
AS B
AS D P
Drop Invalid! P P
AS C
Prefix: P
Legitimate Origin: AS A
Owner of P
AS A

8. Route Origin Authorization (ROA)
ROA and ROV
Route Origin Authorization (ROA)
Prefix owner authorizes AS to originate a set of prefixes

9. Route Origin Authorization (ROA)
ROA and ROV
Route Origin Authorization (ROA)
Prefix owner authorizes AS to originate a set of prefixes
Route Origin
Validation (ROV)
BGP router validates received
routes using ROA information

10. Motivation & Research Problem
Goal: Which ASes use ROV-based filtering policies?

11. Motivation & Research Problem
Goal: Which ASes use ROV-based filtering policies?
Assess impact of defense mechanisms
Track deployment over time
Create an incentive to deploy

12. Motivation & Research Problem
Goal: Which ASes use ROV-based filtering policies?
Assess impact of defense mechanisms
Track deployment over time
Create an incentive to deploy
Challenge: Private router configurations must be inferred

13. Route Collectors & Vantage Points
Vantage Point (VP)
BGP Router that exports BGP Updates to a Route Collector
AS A
AS B P P
Route Collector (RC)
BGP Router that dumps received BGP Updates
Route Collector

14. Measuring ROV: Approaches
Description
Property

15. Measuring ROV: Approaches
Uncontrolled
Analyzing existing BGP data and ROAs, trying to infer who is filtering
Description
Relies on existing data
Property
[NDSS ‘17]

16. Measuring ROV: Approaches
Uncontrolled
Controlled
Actively inject routes and dynamically create ROAs
Analyze resulting data to infer who is filtering
Analyzing existing BGP data and ROAs, trying to infer who is filtering
Description
Relies on existing data
Needs own AS & Prefixes
Property
[NDSS ‘17]
[CCR ‘18]

17. Uncontrolled Experiments: The Basic Idea
Leverage divergence between AS paths of invalid and
non-invalid routes to infer if an AS is filtering

18. Uncontrolled Experiments: The Basic Idea
Leverage divergence between AS paths of invalid and
non-invalid routes to infer if an AS is filtering
AS A originates P1 (valid) and P2 (invalid)
AS B P1 P1
AS C
AS A
Mention that we do in fact see this kind of situation, an AS originating an invalid and non-invalid, on the Internet P2 P2
AS D
Vantage point selects divergent AS paths

19. Uncontrolled Experiments: The Basic Idea
Filtering invalid routes?
AS A originates P1 (valid) and P2 (invalid)
AS B P1 P1
AS C
AS A
The existing work ASSUMES that AS C wants a route for P1, and that it prefers routes from AS B to routes from AS D. So the fact that P2 is routed through AS D is taken as an indicator that AS B is filtering.
EXPLAIN ”POSSIBLY FILTERING”, “FILTERING”, and “NOT FILTERING”. P2 P2
AS D
Vantage point selects divergent AS paths

20. Uncontrolled Experiments: Problems

21. Uncontrolled Experiments: Problems
Limited Control
1. Don’t know origin AS policy

22. Uncontrolled Experiments: Limited Control
Origin Policy
AS B P1
AS C
AS A P2
AS D
Vantage Point

23. Uncontrolled Experiments: Limited Control
Filtering invalids or traffic engineering?
AS B
/22
AS C
AS A
/24
AS D
Vantage Point

24. Uncontrolled Experiments: Limited Control
Filtering invalids or traffic engineering?
Prefix: /
Legitimate Origin: AS A
Owner of prefix
AS B
/22
AS C
AS A
Explizit sagen: Paper zeigt dass 1-Hop divergence wahrscheinlicher TE ist!
/24
AS D
Vantage Point

25. Uncontrolled Experiments: Problems
Limited Control
1. Don’t know origin AS policy
2. Can’t distinguish between ROV-filtering and other filtering

26. Uncontrolled Experiments: Limited Control
Real World Example
AS3356
AS3130 P1
AS25220
AS47065 P2
AS1239
Vantage Point
AS1299

27. Uncontrolled Experiments: Limited Control
Real World Example
Filtering invalid routes?
AS3356
AS3130 P1
AS25220
AS47065 P2
AS1239
Vantage Point
AS1299

28. Uncontrolled Experiments: Limited Control
Real World Example
Filtering invalid routes? No!
AS3356
AS3130 P1
AS25220
AS47065 P2
AS1239
Vantage point receives routes
for both prefixes from
AS3356 and AS1299,
but uses route age as a tie-breaker!
Vantage Point
AS1299

29. Uncontrolled Experiments: Problems
Limited Control
1. Don’t know origin AS policy
2. Can’t distinguish between ROV-filtering and other filtering

30. Uncontrolled Experiments: Problems
Limited Control
1. Don’t know origin AS policy
2. Can’t distinguish between ROV-filtering and other filtering
Limited Visibility
Incomplete data can lead to misclassification

31. Uncontrolled Experiments: Limited Visibility

32. Uncontrolled Experiments: Limited Visibility
X-Axis includes all
Routeviews & RIPE RIS
vantage points.
Mention: VPs could have all full tables, this is only the stuff they export to the route collector. However, for the existing work it matters only what is exported.

33. Uncontrolled Experiments: Limited Visibility
Analyzing data from different sets of vantage points
can yield contradicting classifications
Filtering invalid routes?
AS B
AS D P1
Vantage Point
AS A
AS C P2

34. Uncontrolled Experiments: Limited Visibility
Analyzing data from different sets of vantage points
can yield contradicting classifications
AS E
Filtering invalid routes?
Probably not!
AS B
AS D
Vantage Point P1 P2
Vantage Point
AS A
AS C

35. Uncontrolled Experiments: Limited Visibility
Relative frequency of false positives
Groesse der Vantage point sets erwaehnen
Vantage Point Sets

36. Uncontrolled Experiments: Limited Visibility
We don’t have a complete view of AS-level Internet.
Inference without considering
missing data
can lead to misclassification!
Relative frequency of false positives
Vantage Point Sets

37. Uncontrolled Experiments: Problems
Limited Control
1. Don’t know origin AS policy
2. Can’t distinguish between ROV-filtering and other filtering
Limited Visibility
Incomplete data can lead to misclassification
Repeatability No

38. Uncontrolled Experiments: Problems
Limited Control
1. Don’t know origin AS policy
2. Can’t distinguish between ROV-filtering and other filtering
Inferring the routing policy of an AS
on the basis of uncontrolled experiments
is prone to misclassification!
Limited Visibility
Incomplete data can lead to misclassification
Reproducibility No

39. Controlled Experiments
Hand-crafted ROAs and BGP Updates

40. Controlled Experiments
Hand-crafted ROAs and BGP Updates
Goal: Find ASes that filter invalid routes
Sagen: ASes welche _irgendwo_ filtern.

41. Controlled Experiments: Setup
Hand-crafted ROAs and BGP Updates
Goal: Find ASes that filter invalid routes
BGP
Announce prefixes PA (Anchor) and PE (Experiment)
Same RIR DB route object
Same prefix length
Announced at the same time
Announced to same peers
Announced from same origin AS

42. Controlled Experiments: Setup
Hand-crafted ROAs and BGP Updates
Goal: Find ASes that filter invalid routes
BGP
RPKI
Announce prefixes PA (Anchor) and PE (Experiment)
Issue ROAs for
both prefixes
Same RIR DB route object
Same prefix length
Announced at the same time
Announced to same peers
Announced from same origin AS
PA announcement is always valid.
Periodically change ROA for PE :
Flips announcement from valid to invalid to valid daily.

43. Controlled Experiments: Advantages
Hand-crafted ROAs and BGP Updates
Control Announcement
Policy
Control origin AS policy, can announce own routes
Can distinguish ROV-filtering by changing route RPKI state

44. Controlled Experiments: Advantages
Hand-crafted ROAs and BGP Updates
Control Announcement
Policy
Control origin AS policy, can announce own routes
Can distinguish ROV-filtering by changing route RPKI state
Limited Visibility
Less of an issue:
Only care about our routes

45. Controlled Experiments: Advantages
Hand-crafted ROAs and BGP Updates
Control Announcement
Policy
Control origin AS policy, can announce own routes
Can distinguish ROV-filtering by changing route RPKI state
Limited Visibility
Less of an issue:
Only care about our routes
Repeatability
Yes

46. Controlled Experiments
Initial Situation: Origin AS and vantage point AS peer directly
AS47065
PEERING*
AS A PA PE
Prefix: PA
ASN: 47065
Owner of PA
ROA
Owner of PE
Prefix: PE
Vantage Point *

47. Controlled Experiments
Initial Situation: Origin AS and vantage point AS peer directly
AS47065
PEERING*
AS A PA PE
Vantage Point *

48. Controlled Experiments
Observation 1: Vantage point exports no route for PE
AS47065
PEERING*
AS A PA
Vantage Point
Prefix: PA
ASN: 47065
Owner of PA
ROA
Owner of PE
Prefix: PE
ASN: 51224 *

49. Controlled Experiments
Observation 1: Vantage point exports no route for PE
AS47065
PEERING*
AS A PA
Vantage Point
Conclusion: Vantage point is using ROV-based filtering *

50. Controlled Experiments
Observation 2: Vantage point exports alternate route for PE
AS47065
PEERING*
AS A PA
AS X PE PE
Vantage Point
Prefix: PA
ASN: 47065
Owner of PA
ROA
Owner of PE
Prefix: PE
ASN: 51224 *

51. Controlled Experiments
Observation 2: Vantage point exports alternate route for PE
AS47065
PEERING*
AS A PA
AS X PE PE
Vantage Point
Conclusion: Vantage point is using ROV-based filtering selectively. *

52. Controlled Experiments
Situation: Origin AS and vantage point AS do not peer directly
AS47065
PEERING* PA
AS A
AS X PA PE PE
Prefix: PA
ASN: 47065
Owner of PA
ROA
Owner of PE
Prefix: PE
Vantage Point *

53. Controlled Experiments
Situation: Origin AS and vantage point AS do not peer directly
AS47065
PEERING* PA
AS A
AS X PA PE PE
Vantage Point *

54. Controlled Experiments
Observation 1: Vantage point exports no route for PE
AS47065
PEERING* PA
AS A
AS X PA
Prefix: PA
ASN: 47065
Owner of PA
ROA
Owner of PE
Prefix: PE
ASN: 51224
Vantage Point *

55. Controlled Experiments
Observation 2: Vantage point exports different route for PE
AS47065
PEERING* PA
AS A
AS X PA PE PE
AS Y
Vantage Point
ROA
ROA
Prefix: PA
ASN: 47065
Prefix: PE
ASN: 51224 *
Owner of PA
Owner of PE

56. Controlled Experiments
Problem
Measuring vantage point AS that is not direct peer introduces ambiguity:
Is the vantage point AS
filtering or an intermediate AS?

57. Controlled Experiments
Problem
Solution
Measuring vantage point AS that is not direct peer introduces ambiguity:
Is the vantage point AS
filtering or an intermediate AS?
Establishing direct peering
with vantage point AS or
Check if intermediate
ASes have vantage points

58. Controlled Experiments Results
Before October 20th 2017: - (At least) Three ASes drop invalid routes October 20th 2017: - AMS-IX Route Server changes ROV based filtering to ‘opt-out’
MINDESTENS 3 AS: Operator confirmed!!!!!!!

59. IXP Route Servers AS C AS D AS B AS A AS E
A Route Server (RS) is a BGP router that simplifies interconnection at IXPs.

60. IXP Route Servers AS C AS D AS B P P P P P AS A AS E
BGP Route Server
AS E
Member AS announce to the RS.
The RS propagates its best routes to the members

61. IXP Route Server: ROV Filtering
AS C
AS B
AS D P P
AS A
BGP Route Server
Underline looks weird, find alternative
AS E
Invalid announcements are only propagated to peers that opt-out of ROV filtering!

62. Controlled Experiments Results
Before October 20th 2017: - (At least) Three ASes drop invalid routes October 20th 2017: - AMS-IX Route Server changes ROV based filtering to ‘opt-out’ ASes “drop” invalid routes
Mention: AMSIX isnt the first, there is Costa Rica IX and France IX. We want to be ready for other IXPs starting this, especially major ones. We are already at AMSIX, but unfortunately DE-CIX declined sponsoring PEERING. Gonna look into LINX as well…
JOBs 2 ISPs Experimente erwähnen
Andere IXPs erkennen
Caveat: Technically, using Route Server filtering isn’t “deploying ROV”!

63. ROV Deployment Monitor
Idea
Give the networking community means to assess state of deployment
Launched rov.rpki.net
Implements our measurement methodology.
Table with AS that have deployed ROV.
Updated daily.

64. Next Step: Data Plane Measurements
Idea: Complementary Measurements
Using RIPE Atlas, traceroute towards prefixes PA and PE

65. Next Step: Data Plane Measurements
Idea: Complementary Measurements
Using RIPE Atlas, traceroute towards prefixes PA and PE
Successful traceroute to PA +
Unsuccessful traceroute to PE when routes are invalid

66. Next Step: Data Plane Measurements
Idea: Complementary Measurements
Using RIPE Atlas, traceroute towards prefixes PA and PE
Successful traceroute to PA +
Unsuccessful traceroute to PE when routes are invalid
= Some AS on path is using ROV!

67. Next Step: Data Plane Measurements
Idea: Complementary Measurements
Using RIPE Atlas, traceroute towards prefixes PA and PE
Successful traceroute to PA +
Unsuccessful traceroute to PE when routes are invalid
Mention: “We can explore approaches to identify the presence of default routes, so we can at least identify them and flag instances where they are at play”
= Some AS on path is using ROV!
Note: False negatives are possible because of default routes!

68. Conclusion
Uncontrolled experiments are not suited to infer (RPKI-based filtering) routing policies

69. Conclusion
Uncontrolled experiments are not suited to infer (RPKI-based filtering) routing policies
Controlled experiments are crucial to measuring adoption of ROV- based filtering policies

70. Conclusion
Uncontrolled experiments are not suited to infer (RPKI-based filtering) routing policies
Controlled experiments are crucial to measuring adoption of ROV- based filtering policies
There are ASes that do ROV-based filtering.
Before Oct. 2017: At least 3 AS drop invalids
After Oct. 2017: 50+ AS drop invalids via Route

71. Conclusion
Uncontrolled experiments are not suited to infer (RPKI-based filtering) routing policies
Controlled experiments are crucial to measuring adoption of ROV- based filtering policies
There are ASes that do ROV-based filtering.
Before Oct. 2017: At least 3 AS drop invalids
After Oct. 2017: 50+ AS drop invalids via Route
IXPs offering ROV at Route Servers can boost deployment

72. Questions? ROV Deployment Monitor: rov.rpki.net
Andreas Reuter, Randy Bush, Italo Cunha, Ethan Katz-Bassett, Thomas C. Schmidt & Matthias Wählisch (2018).
Towards a Rigorous Methodology for Measuring Adoption of RPKI Route Validation and Filtering. ACM SIGCOMM Computer Communication Review, 48,
ROV Deployment Monitor: rov.rpki.net

73. Backup

74. Uncontrolled Experiments: Limited Control
Filtering invalids or traffic engineering?
AS B
Can path divergence be explained by traffic engineering at the origin?
/22
AS C
AS A
/24
Vantage Point
AS D

75. Path Divergence
Divergence between AS paths of routes with the same origin
Fraction of path pairs
Divergence point between path pair

76. Path Divergence
Divergence between AS paths of routes with the same origin
Fraction of path pairs
Divergence point between path pair

77. Path Divergence
Divergence between AS paths of routes with the same origin
No significant difference between distributions suggests lack of widespread filtering
Fraction of path pairs
Divergence point between path pair

78. Path Divergence
Divergence between AS paths of routes with the same origin
No significant difference between distributions suggests lack of widespread filtering
Fraction of path pairs
Invalid routes likely have
different AS paths
for non-RPKI related reasons!
Divergence point between path pair

79. Controlled Experiments Setup
Announce prefixes PA (Anchor) and PE (Experiment)
BGP
Same IRR entry
Same origin AS
Announced to same peers
Same prefix length
Announced at same time

80. Uncontrolled Experiments: Limited Visibility
Analyzing data from different sets of vantage points
can yield contradicting classifications
Mit VP vis und False positive plots ersetzen

81. Uncontrolled Experiments: Limited Visibility
Analyzing data from different sets of vantage points
can yield contradicting classifications
AS E
Filtering invalid routes?
Probably not!
We don’t have a complete view of AS-level Internet.
Inference without considering missing data
can lead to misclassification!
AS B
AS D
Vantage Point P1 P2
Vantage Point
AS C
AS A

82. Controlled Experiments Setup
Announce prefixes PA (Anchor) and PE (Experiment)
BGP
Same IRR entry
Same origin AS
Announced to same peers
Same prefix length
Announced at same time
1. Issue ROAs for PA and PE to make routes valid
RPKI
2. Periodically change ROA for PE to flip route
state between valid and invalid

83. Uncontrolled Experiments
AS B P2 P2
AS E
AS A P1
AS C P1
Vantage Point

84. Uncontrolled Experiments
Does AS C filter P2 because it’s announcement is invalid?
AS B P2 P2
AS E
AS A P1 P1
AS C
Vantage Point E

85. Uncontrolled Experiments
Vantage Point D
AS B
AS D P2 P1 P2
AS A
Probably not! P1
AS C

86. Measuring ROV: Approaches
Uncontrolled
Controlled
Limited Control
Don’t know announcement policy
Can’t distinguish between ROV filtering and other filtering
Limited Visibility
Incomplete data can lead to misclassification
Can’t repeat experiments
Limited Control
Control announcement policy
Can distinguish between ROV filtering and other by issuing ROAs
Limited Visibility
Less of an issue, we only care about routes we control
Can repeat experiments

87. Conclusion
Uncontrolled
Experiments
Unsuited to
infer ROV filtering

88. Conclusion Uncontrolled Experiments Controlled Experiments Unsuited to
infer ROV filtering
Crucial
to infer ROV filtering

89. At least 3 ASes use ROV-based filtering
Conclusion
Uncontrolled
Experiments
Controlled
Experiments
Result Ι
Unsuited to
infer ROV filtering
Crucial
to infer ROV filtering
At least 3 ASes use ROV-based filtering

90. Conclusion Uncontrolled Experiments Controlled Experiments Result Ι
Unsuited to
infer ROV filtering
Crucial
to infer ROV filtering
At least 3 ASes use ROV-based filtering
Over 50 ASes use Route Server ROV filtering

91. Conclusion Latest results at rov.rpki.net Controlled Experiments
Crucial
to infer ROV filtering
At least 3 ASes use ROV-based filtering
Over 50 ASes use Route Server ROV filtering
Latest results at rov.rpki.net

92. Goal: Measure the adoption of ROV-based filtering policies
Research Problem
Goal: Measure the adoption of ROV-based filtering policies

93. Goal: Measure the adoption of ROV-based filtering policies
Research Problem
Goal: Measure the adoption of ROV-based filtering policies

94. Research Problem
Goal: Measure the adoption of ROV-based filtering policies
Why?
Assess the current state of deployment

95. Research Problem
Goal: Measure the adoption of ROV-based filtering policies
Why?
Why?
Assess the current state of deployment
Track increase in deployment over time

96. Research Problem
Goal: Measure the adoption of ROV-based filtering policies
Why?
Why?
Why?
Assess the current state of deployment
Track increase in deployment over time
Create an incentive to deploy

97. Challenge: Private policies must be inferred from measurements
Research Problem
Goal: Measure the adoption of ROV-based filtering policies
Why?
Why?
Why?
Assess the current state of deployment
Track increase in deployment over time
Create an incentive to deploy
Challenge: Private policies must be inferred from measurements

98. Research Problem
Goal: Measure the adoption of ROV-based filtering policies
ROA
Which AS is allowed to announce an IP prefix
Public Repository

99. Research Problem
Goal: Measure the adoption of ROV-based filtering policies
ROA
ROV
Local Policy
Which AS is allowed to announce an IP prefix
Router operation to validate BGP Updates based on ROA data
Decide handling of invalid BGP routes
(Drop?)
(De-preference?)
Public Repository
Private Configuration

100. Research Problem
Goal: Measure the adoption of ROV-based filtering policies
ROA
ROV
Local Policy
Which AS is allowed to announce an IP prefix
Router operation to validate BGP Updates based on ROA data
Decide handling of invalid BGP routes
(Drop?)
(De-preference?)
Public Repository
Private Configuration
Challenge: Private policies must be inferred from measurements