1. Part V: BGP Beacons -- A n Infrastructure for BGP Monitoring

2. March 8, 20042 Better understanding of BGP dynamics  Difficulties  Multiple administrative domains  Unknown information (policies, topologies)  Unknown operational practices  Ambiguous protocol specs Proposal: a controlled active measurement infrastructure for continuous BGP monitoring – BGP Beacons.

3. March 8, 20043 What is a BGP Beacon?  An unused, globally visible prefix with known Announce/Withdrawal schedule  For long-term, public use

4. March 8, 20044 Who will benefit from BGP Beacon?  Researchers: study BGP dynamics  To calibrate and interpret BGP updates  To study convergence behavior  To analyze routing and data plane interaction  Network operators  Serve to debug reachability problems  Test effects of configuration changes:  E.g., flap damping setting

5. March 8, 20045 Related work  Differences from Labovitz’s “BGP fault- injector”  Long-term, publicly documented  Varying advertisement schedule  Beacon sequence number (AGG field)  Enabler for many research in routing dynamics  RIPE Ris Beacons  Set up at 9 exchange points

6. March 8, 20046 Active measurement infrastructure Internet BGP Beacon #1 198.133.206.0/24 1:Oregon RouteViews Stub AS Upstream provider Upstream provider ISP Many Observation points: 2. RIPE ISP 6.Berkeley 4. Verio 3.AT&T 5. MIT Send route update

7. March 8, 20047 Deployed PSG Beacons PrefixSrc AS Start date Upstream provider AS Beacon host Beacon location 198.133.206.0/2431308/10/022914, 1239Randy BushWA, US 192.135.183.0/2456379/4/023701, 2914Dave MeyerOR, US 203.10.63.0/2412219/25/021221Geoff HustonAustralia 198.32.7.0/24394410/24/022914, 8001Andrew PartanMD, US 192.83.230.0/24313006/12/032914, 1239Randy BushWA, US

8. March 8, 20048 Deployed PSG Beacons  B1, 2, 3, 5:  Announced and withdrawn with a fixed period  (2 hours) between updates  1st daily ANN: 3:00AM GMT  1st daily WD: 1:00AM GMT  B4: varying period  B5: fail-over experiments  Software available at: http://www.psg.com/~zmao

9. March 8, 20049 Beacon 5 schedule Live host behind the beacon for data analysis Study fail-over Behavior for multi-homed customers

10. March 8, 200410 Beacon terminology  Input signal: Beacon-injected change 3:00:00 GMT: Announce (A0) 5:00:00 GMT: Withdrawal (W) Beacon prefix: 198.133.206.0/24 Beacon AS RouteView AT&T  Output signal: 5:00:10 A1 5:00:40 W 5:01:10 A2 Signal length: number of updates in output signal (3 updates) Signal duration: time between first and last update in the signal (5:00:10 -- 5:01:10, 60 seconds) Inter-arrival time: time between consecutive updates Internet

11. March 8, 200411 Process Beacon data  Identify output signals, ignore external events  Minimize interference between consecutive input signals  Time stamp and sequence number

12. March 8, 200412 Process Beacon data  Identify output signals, ignore external events  Data cleaning  Anchor prefix as reference  Same origin AS as beacon prefix  Statically nailed down  Minimize interference between consecutive input signals  Time stamp and sequence number

13. March 8, 200413 Process Beacon data  Identify output signals, ignore external events  Minimize interference between consecutive input signals  Beacon period is set to 2 hours  Time stamp and sequence number

14. March 8, 200414 Process Beacon data  Identify output signals, ignore external events  Minimize interference between consecutive input signals  Time stamp and sequence number  Attach additional information in the BGP updates  Make use of a transitive attribute: Aggregator fields

15. March 8, 200415 Beacon data cleaning process  Goal  Clearly identify updates associated with injected routing change  Discard beacon events influenced by external routing changes

16. March 8, 200416 Beacon example analysis  BGP implementation impact  Cisco vs. Juniper  Route flap damping analysis  Convergence analysis  Inter-arrival time analysis

17. March 8, 200417 Cumulative Beacon statistics: significant noise  Current observation points:  111 peers: RIPE, Route-View, Berkeley, MIT, MIT-RON nodes, ATT-Research, AT&T, AMS-IXP, Verio Avg expansion: 2*0.2+1*0.8=1.2

18. March 8, 200418 Cumulative Beacon statistics: significant noise  Example response to ANN-beacon at peer p  R1: ASpath= 286 209 1 3130 3927  R2: ASpath= 286 209 2914 3130 3927  100 events: 20: R1 R2, 80: R2 BeaconMax no. transient routes Max ANN- out-signal length Max WD- out-signal length Max ANN-avg expansion Max WD-avg expansion 118611149.711.2 21799157.010.8 311716135.811.4 430718158.816.3 Out-signal length=1No. transient routes=2

19. March 8, 200419 Cisco vs. Juniper update rate-limiting Known last-hop Cisco and Juniper routers from the same AS and location Average signal length: average number of updates observed for a single beacon-injected change

20. March 8, 200420 “Cisco-like” last-hop routers (sec) Linear increase in signal duration wrt signal length Slope=30 second Due to Cisco’s default rate-limiting setting

21. March 8, 200421 (sec) “Juniper-like” last-hop routers Signal duration relatively stable wrt increase in signal length Shorter signal duration compared to “Cisco-like” last-hops

22. March 8, 200422 Route flap damping  A mechanism to punish unstable routes by suppressing them  RFC2439 [Villamizar et al. 1998]  Supported by all major router vendors  Believed to be widely deployed [AT&T, Verio]

23. March 8, 200423 Goals  Reduce router processing load due to instability  Prevent sustained routing oscillations  Do not sacrifice convergence times for well-behaved routes There is conjecture a single announcement can cause route suppression.

24. March 8, 200424 Route flap damping Exponentially decayed  Scope  Inbound external routes  Per neighbor, per destination  Penalty  Flap: route change  Increases for each flap  Decays exponentially 0 1000 2 32 Reuse threshold 750 Time (min) Penalty Cisco default setting 3000 4 Suppress threshold 2000

25. March 8, 200425 Strong evidence for withdrawal- and announcement- triggered suppression. Route flap damping analysis

26. March 8, 200426 Distinguish between announcement and withdrawal Summary : WD-triggered sup more likely than ANN- triggered sup Cisco: overall more likely trigger sup than Juniper (AAAW-pattern) Juniper: more aggressive for AWAW pattern

27. March 8, 200427 Convergence analysis Summary: Withdrawals converge slower than announcements Most beacon events converge within 3 minutes

28. March 8, 200428 Output signal duration 30 6090120

29. March 8, 200429 Beacon 1’s upstream change Single-homed (AS2914) Multi-homed (AS1,2914) Multi-homed (AS1239, 2914)

30. March 8, 200430 Beacon for identifying router behavior Beacon 2 Seen from RouteView data Rate-limiting timer  30 second Different rate-limiting behavior: Cisco vs. Juniper

31. March 8, 200431 Inter-arrival time analysis Cisco-like last-hop routers Complementary cumulative distribution plot

32. March 8, 200432 Inter-arrival time analysis

33. March 8, 200433 Inter-arrival time modeling  Geometric distribution (body):  Update rate-limiting behavior: every 30 sec  Prob(missing update train) independent of how many already missed  Mass at 1:  Discretization of timestamps for times<1  Shifted exponential distribution (tail):  Most likely due to route flap damping

34. March 8, 200434 Summary  Beacons -- a public infrastructure for BGP analysis  Shown examples of Beacon usage  Future direction  Construction of robust and realistic model for BGP dynamics  Correlation with data plane  Analysis of RIPE Beacons http://www.psg.com/~zmao