BGP: Introduction and Issues

1. BGP: Introduction and Issues Advanced Networks

2. What Is BGP? • Border Gateway Protocol BGP-4 • The de-facto interdomain routing protocol • BGP includes specifications: • Which information gets advertised and how • BGP includes a routing protocol: • Establishes and uses a routing table • Internal Gateway Protocol (I-BGP in the book) Advanced Networks

3. Why Is There Such Fuss about BGP? • BGP dictates routing at the AS level • Absence of understanding: poor performance • BGP is complicated • Designed to be flexible • Involves multiple fields • Understanding BGP behavior is not intuitive • Implementation and business policies • The routing of the Internet relies on BGP Advanced Networks

4. Some Open Questions • How well does BGP work now? • How can I manage a BGP network? • How secure and robust is BGP? • Cyber-terrorism • How would we re-design BGP now? • How well will BGP scale for our future needs? Advanced Networks

5. Roadmap • Introduction to BGP • Highlights of BGP issues • Goal: instigate interest in BGP Advanced Networks

6. Some Basic Numbers • 17,000 Autonomous Systems approx. • Corporate Networks • ISP Internal Networks • National Service Providers • Identified by ASN a 16 bit value • Assigned by IANA • Superlinear growth (Huston, Siganos et al.) Advanced Networks

7. How A BGP graph Looks Like AS 2 AS 5 • Each AS has designated BGP routers • BGP routers of an AS communicate internally with another protocol (IGP) AS 4 AS 3 AS 1 Advanced Networks

8. IP Addresses and Prefixes • IP addresses have 32 bits: 4 octets of bits (IPv4) • A prefix is a group of IP addresses • 128.32.101.5 is an IP address (32 bits) • 128.32.0.0/16 is a prefix of the 16 first bits: • 128.32.0.0 – 128.32.255.255 (2^16 addresses) • 128.32.4.0/24 is a prefix of the 24 first bits - longer Advanced Networks

9. Routing is Based on Prefixes • A BGP Routing table has prefixes for entries • For a IP address of a packet, find longest match • Example: packet IP 128.32.101.1 • 128.1.1.4 matches the first 8 bits – no match! • 128.32.0.0/16 match for 16 bits • 128.32.101.0/24 is a longer match Advanced Networks

10. Prefix Matching in More Detail • For a IP address of a packet, find longest match • Example: Compare • packet IP 128.32.101.1 • With 128.32.0.0/16 • IP : 01000000. 001000000. 01100101 .00000001 • Mask : 11111111. 111111111. 00000000 .00000000 • AND : 01000000. 001000000. 00000000 .00000000 • Prefix : 01000000. 001000000. 00000000. 00000000 • Equal? Yes Advanced Networks

11. Advertising Routing Information • Each AS advertises what it can reach from each BGP router • Policies I: filter what you advertise • Policies II: filter from what you hear advertised • Build up a BGP routing table • Remember which prefix you hear from which link Advanced Networks

12. What Does a Routing Table Look Like? • Origin AS “owns” the address • Routing tables can have peculiarities Advanced Networks

13. Route Advertising • Distance Vector style protocol • Hear advertisements: IP prefix, AS-path • Filter if desired (i.e. ignore) • Append yourself: IP prefix, myAS+AS-path • Forward to appropriate ASs Advanced Networks

14. Basic AS relationships • Customer – Provider • Customer pays Provider for service • The Customer is always right • Peer to Peer: mutual cooperation • Ex. MCI and AT&T • Sibling-Sibling • Ex. AT&T research and AT&T wireless Advanced Networks

15. Provider Customer Peer Peer The Internet as a Directed Graph • Every edge is bidirectional • Business relationships are represented Advanced Networks

16. The Initial Idea • Data flows between customers-providers • Top level providers are peers • They exchange information to ensure connectivity • What can possibly go wrong? Advanced Networks

17. And then came the rain… • Thousands of ASs • Complicated relationships • Multiple providers for one AS!! • Multihoming • Traffic engineering • I want to use multiple paths and load balance Advanced Networks

18. Provider Customer Peer Peer Example: The Intended Use Advanced Networks

19. BGP Graph and Routing Policies • Up then down: 1, 10, 100, 200, 13, 4 • No valleys, no up-down-up, no more than 1 peer-peer 200 100 10 11 12 13 1 4 3 2 Advanced Networks

20. The Rules of BGP Routing • Transit traffic: traffic that does not go to my customers (or their customers) • A provider carries any traffic to, from customer • Peers exchange traffic only if between their customers Advanced Networks

21. Implementing BGP Rules • A customer advertises whatever she wants • A provider forwards everything from customer • So that world now where customer IPs are • A provider advertises whatever customer wants to customer • A peer hears but does not advertise further prefixes from a peer • A peer advertises only its customers to a peer Advanced Networks

22. Some Simple Policies: Transitivity ISP 1 ISP 2 • A customer should not be transit for its Providers • For this: ASX should not advertise ISP1 advertisements Not allowed AS X Advanced Networks

23. Basic AS Relationships Provider Customer 200 100 Peer Peer • Customer – Provider: customer pays and is always right • Peer to Peer: Exchange traffic only between their customers • Sibling-Sibling: Exchange traffic at will 10 11 12 13 1 4 3 2 Advanced Networks

24. Routing rules: Provider accept everything Peer only if it is for its customers Path Properties: Up then down No up-down-up, at most 1 peer-peer steps How BGP Policy Restricts Routing Provider Customer Peer 100 Peer 200 10 11 13 12 1 3 4 2 Advanced Networks

25. How Policies Affect Routing Customer 1 • A Provider will get rid of traffic as soon as possible, • But a Provider will carry the traffic for its customer • Did anyone say traffic is asymmetric? ISP1 ISP2 Customer 2 Advanced Networks

26. BGP Path-Length Asymmetry • Consider number of AS traversed by a path • Asymmetry: 46% of pairs differ by at least one AS hop [Siganos 01] Advanced Networks

27. Determining The Logical Graph • The business relationships are critical • How can I find the relationships? • Infer relationships from routing tables • IRR database: manually maintained – error prone Advanced Networks

28. Two Inference Algorithms • Inference algorithm [Gao 00] • Using 1 routing table • Exploit the up-down path property in a routing path, assume highest degree node as peak • Inference using multiple tables [Subramanian02] • Use multiple points of observation to improve results Advanced Networks

29. Things Become Interesting:Traffic Engineering • How can I pick a route? • Local Preference: path attribute • AS2 wants to prefer fast thick link • Advertisement from right router of AS2 has higher Local Preference • Any BGP router in AS2 will prefer the AS 2 LP 100 LP 80 slow 208.1.1.0/24 AS 1 Advanced Networks

30. Load Balancing - Appetizer • I want to share traffic between my two providers • How can I do this? Advanced Networks

31. Load Balancing: Long Prefix Match Takes All! ISP 3 138.39/16 138.39.1/24 ISP 2 ISP 1 138.39.1/24 138.39/16 138.39.1/24 Customer 138.39.1/24 Advanced Networks

32. So How Can I Balance the Load? • Ask my provider to not aggregate my prefix • Will this work? • Split my prefix in two • 138.39.1.0/24 • A: 138.39.1.31/28 • B: 138.39.1.32/28 • Advertise only one part to ISP2 • ISP2 traffic destined for prefixes in A • ISP1 traffic destined for prefixes in B Advanced Networks

33. Summary Up to Now • BGP-4 is the de facto protocol for interdomain routing • BGP was developed to achieve: • Flexible policy implementation • Scalability via route aggregation given CIDR • There are many open issues • BGP is a hot research topic Advanced Networks

34. The Growth of BGP Table Advanced Networks

35. The BGP Growth: The Truth • Growth flattened out • Why? • Better management • Dot-com crash? Advanced Networks

36. Routing Table Variation • Larger ASes have significantly larger tables Advanced Networks

37. Update Activity Per Prefix • Measure rate of announcements + withdrawals + path updates • Compare relative update rate per prefix length to the relative number of prefixes of that length • >1 implies higher than average update rate (less stable) • <1 implies lower than average update rate(more stable) Advanced Networks

38. Measured Update Rate • Bursty! Advanced Networks

39. BGP robustness • Measuring the BGP updates Advanced Networks

40. Analyzing Messages By Content • Aggregated per 30 seconds Advanced Networks

41. Initial Observations • Updates show daily and weekly periodicity • There is no evidence BGP disturbance: • The Baltimore tunnel train 18 July that destroyed Internet lines • Sept 11 attack • There are some spikes at: • 19 July • 18-22 September Advanced Networks

42. BGP Updates Correlations Advanced Networks

43. BGP Under Attack Advanced Networks

44. Router CPU Activity Correlates… Advanced Networks

45. The Attack of The Worm Advanced Networks

46. Classification of Instabilities Advanced Networks

47. Isolating Instability: 1 unstable peer Advanced Networks

48. Detecting abnormal BGP activity Advanced Networks

49. The Worm Activity Advanced Networks

50. The Worm Correlates Again… Advanced Networks