R outing S tate D istance: A Path-based Metric for Network Analysis

1. Routing State Distance:A Path-based Metric forNetwork Analysis NataliRuchansky GoncaGürsun, EvimariaTerzi, and Mark Crovella

2. Distance Metrics for Analyzing Routing Shortest Path Distance Similarly Routed

3. A New Metric Based on this distance intuition we develop a newmetric based on pathsand show it is good for: • Visualizationof networks and routes • Characterizingroutes • Detecting significant patterns • Gaining insightabout routing

4. We call this path-based distance metric: Routing State Distance

5. Conceptually… • Imagine capturing the entire interdomain routing state of the internet in a matrix the next hop on path from to • Each rowis the routing table of a single AS • Now consider the columns… Destinations Sources

6. Routing State Distance We define between two prefixes and as the numberof entries that differ in their columns of • i.e. the number of ASes • that disagree about the next-hop to and .

7. More Formally Givena universe of prefixes define: A next-hop matrix : the next-hop on the path to As well as :

8. RSD to BGP In order to apply to measured BGP pathswe define to have ASeson rows and prefixeson columns. the next-hop from AS to prefix • A few issues arise… • Missing Values • Multiple next hops • Solution Key: • is defined on a set • of paths NOT a graph

9. Our Data From 48 million AS paths consisting of: 359 unique monitors 450K destination prefixes We end up with: 243 sources ASes 130K prefixes Thus our is

10. Why is appealing? Let’s take a look at its properties…

11. RSD versus Hop Distance No relation between RSD and hop distance

12. Finer Grained Measure Varies smoothlyand has a gradualslope. Allows fine granularity Increase of 1 encompasses many prefixes

13. Highly structured Allows 2D visualization From compute, our distance matrix where:

14. Wow! Highly structured This happens with anyrandomsample  Internet-wide

15. Yeah, but a cluster of what!?! First think matrix-wise (): • A cluster corresponds to a set of columns • Columns being close in means they are similar in some positions • is highly coherent Now in routingterms: • Any row in must have the same next hop in nearly each cell • The set of ASes make similar routing decisions w.r.t destinations • We call such a pair a local atom

16. Small cluster “C” Large Cluster Small cluster “C” Large cluster

17. A local atom is a set of prefixes that are routed similarly in some region of the internet. So the smaller cluster is a local atom of certain prefixes that are routed similarly by a large set of ASes

18. Why these specific prefixes? For this investigate … • Prefer a specific AS for transit to these prefixes. Hurricane Electric (HE) • If anypath passes through HE : • Source ASes prefer that path • Prefix appears in the smaller cluster . Hurricane Electric Level3 Sprint

19. But why do sources alwaysroute through HE if the option exists? ….HE has a relatively unique peering policy. Offer peering to ANYAS with presence in the same exchange point. HE’s peers prefer using HE for ANYcustomer of HE And hence consists of networks that peer with HE, and consists of HE’s customers

20. Can We Find More Clusters? Analysis with uncovered a macroscopic atom Can we formulate a systematic study to uncover other smaller atoms? Intuitivelywe would like a partitioning of the prefixes such that : • In the same group is minimized • Between different groups is maximized

21. RS-Clustering Problem Intuition: A partitioning of the prefixes such that : • In the same group is minimized • Between different groups is maximized For a partition : Key Advantage: Parameter Free!

22. Optimal is Hard Finding the optimal solution to the Problem is NP-hard We propose two approaches: Pivot Clustering Overlap Clustering

23. Pivot Clustering Algorithm Given a set of prefixes , their values, and a threshold parameter : • Start from a random prefix (the pivot) • Find all that fall within distance to and form a cluster • Remove cluster from and repeat Advantages: • The algorithm is fast : O(|E|) • Provable approximation guarantee

24. 5 largest clusters Clusters show a clear separation Each cluster corresponds to a local atom

25. Interpreting Clusters

26. We ask ourselves if • apartitionis really best? To address this we propose a formalism called Overlap Clustering and show that it is capable of extracting such clusters. Seek a clustering that captures overlap

27. Related Work • Reported that BGPtables provide an incomplete view of the AS graph. [Roughanet. al. ‘11] • Visualizationbased on AS degree and geo-location. [Huffakerandk. claffy‘10] • Small scale visualizationthrough BGPlay and bgpviz • Clusteringon the inferred AS graph. [Gkantsidiset. al. ‘03] • Grouping prefixes that share the same BGP paths into policy atoms. [Broidoandk. claffy‘01] • Methods for calculating policy atoms and characteristics. [Afeket. al. ‘02]

28. Take-Away Analysis with typical distance metrics is hard We introduce a new one -- Routing State Distance – that is simpleand based only on paths Overcome BGP hurdles and show it can be used for: • In-depth analysisof BGP • Capturing closenessuseful for visualization • Uncovering surprising patterns • General setting Developed a new set of tools for extracting insight from BGP measurements

29. Code, data, and more informationis available on our website at: csr.bu.edu/rsd Code • Pivot Clustering • Overlap Clustering • RSD Computation Data • Prefix List • Pairwise RSD

30. Thank you!! NataliRuchansky GoncaGürsun, EvimariaTerzi, and Mark Crovella