1. 1 Measurement of Highly Active Prefixes in BGP Ricardo V. Oliveira, Rafit Izhak-Ratzin, Beichuan Zhang, Lixia Zhang GLOBECOM’05

2. 2 Motivation and Goals Previous Internet routing measurement studies ([Rexford’02],[Broido’02] and [Wang’02]) observed the existence of a small number of prefixes which contributed a large number of routing updates  However those observations were made at specific ISPs and over short time periods Question: Is this a common phenomenon in the Internet or specific to individual ISPs and limited time periods? We conducted a systematic study of prefix activity by analyzing BGP log data over a 3-year period

3. 3 Internet and Autonomous Systems AS X AS Y AS Z Autonomous System: a set of routers or networks under the same administration Border routers exchange routing updates via Border Gateway Protocol

4. 4 BGP and Network Dynamics C A INTERNET B Prefix P Assuming all destinations use node B to reach A, and Link A-B fails: 1.Node B sends a withdraw to node D 2.Node D sends announcement to C and B and next hop, saying it can reach A through C 3.Nodes B and C start using backup link C-A to reach A D W(P) A(P,[D C A]) One link failure event produced 1 withdraw and 6 announcements A(P,[D C A]) But the 6 announcements are generated by different nodes or sent to diff. nodes. What is the point you try to make here?

5. 5 P A BGP and Network Dynamics C A INTERNET B Prefix P=131.179.0.0/16 1.Link C-A fails 2.Node C sends a withdraw to node D 3.Node D sends announcement to all neighbors except B; to B it sends a withdraw (poison) 4.Node C sends withdraw to node D (poison) D W(P) A(P, [ D B A ]) W(P) P A P C A If link C-A is unstable, multiple updates will be generated...

6. 6 How to capture the unstable prefixes? Divide time in 1-day slots Count the number of updates associated with each BGP prefix in each slot Introduce Activity Function A(d,P): Where: N u (d,P) : number of updates on day d for prefix P T u : activity threshold A prefix P is highly active (HA) in day d if A(d,P)=1

7. 7 How to obtain T u ? Be conservative: take the worst case 99th percentile

8. 8 Prefix Activity (Sprint router) Number of HA prefixes roughly bounded between 100 and 200 per day

9. 9 Routing Table Size RouterTable Size (Oct 2001) Table Size (Aug 2004) Growth (prefix/day) 144.228.241.81 (Sprint) 103,510140,49436 Only a small percentage of prefixes are HA each day (~0.1%) The number of HA prefixes per day remains relatively constant despite the growth of 37% in the routing table size I thought we agreed to remove this slide?

10. 10 Sensitivity Analysis to T u

11. 11 BGP Updates and HA Prefixes

12. 12 Prefix Activity Across Different Monitors 33 monitors, 90% confidence interval

13. 13 Prefix Activity Across Different Monitors (cont’d) 31 days of May 2004, 95% confidence intervals

14. 14 New HA Prefixes Over Time

15. 15 HA Life Time We define Life Time as the total number of days during which a prefix is active: With D = 1040 days

16. 16 Life Time (cont’d)

17. 17 Cause #1: Sporadic link failures In April 13 2004, one of Internet2 routers experienced several outages in a short time period This router had direct connections to some of RouteViews monitors Using LinkRank (http://linkrank.cs.ucla.edu), we discover that one monitor switched paths for aprox. 1,500 prefixes The BGP updates caused by these path changes made these prefixes to appear as HA We believe this case represents most of the HA cases, as more than 75% of HA prefixes have a lifetime of only one day

18. 18 Cause #2: BGP Path Exploration A BGP router may try several backup paths before converging to a stable route (path exploration) How to measure path exploration? Beacon prefixes: periodic announcements and withdraws of prefixes; root cause is known and we know how many updates to expect if there was no path exploration… A(P)W(P) 2 h time A(P)W(P) 2 h... 12 BGP updates/day for each router

19. 19 Beacon 195.80.227.0/24 seen at one monitor: Time(s) TypeAS_PATH 0W 7,114 A 1239 3257 3257 28747 12654 7,144A 1239 8928 25232 12654 14,254A 1239 3356 25232 12654 14,280A 1239 701 6762 12654 14,337A 1239 701 6762 12654 (community change) 14,362A 1239 7018 8220 513 3320 702 13030 12654 14,397A 1239 7018 8220 513 3320 702 13030 12654 14,420W Cause #2: Path Exploration (cont’d) 30 sec Took almost 3 min

20. 20 Cause #3: Router (mis)configurations BGP has two built-in mechanisms to reduce the instability caused by update surges: MRAI and Route Flap Damping Not all routers have these mechanisms configured by default… Juniper routers don’t have MRAI timer configured by default and Cisco routers don’t have Route Flap Damping configured by default A /24 prefix was HA for 12 consecutive days with 6011 updates/day; in one of the days there was 12,000 updates for this prefix; we discover that this router didn’t have the MRAI timer configured

21. 21 Conclusion The existence of HA prefixes is a common phenomenon  Observed everywhere  Observed all the time Causes  Mainly sporadic link failures (75% of the cases)  Slow convergence  Lack of strict adherence to the existing protocol mechanisms (mainly MRAI timer and route dampening) Future work:  Further identification of the causes  Investigation of solutions  Creation of tool for automatic detection of HA prefixes