bgpmon BGP Monitoring System Dave Matthews Yan Chen

bgpmon BGP Monitoring System Dave Matthews Yan Chen He Yan Dan Massey Colorado State University

BGP Monitoring Objectives • Software Dedicated to BGP Monitoring − Establish peering session − Receive updates − Maintain RIB-IN tables − Provide easy real-time access to data • But this software exists…. . − Zebra and Quagga are widely used 2 5 June 2006 NANOG 40 - bgpmon

So Yet Another Package? Didn’t Add BGP Complexity. BGP To • Code − No route selection, no policy, no forwarding, etc. − Resulting code is extensible • Did Add Monitoring Related Features − Periodic route refresh to keep monitor in sync − Objective labels to the data Can peer with very large number of routers • Did Focus on Scaling − Chain bgpmon to monitor 100’s of peers • User interface can still appears as single BGPmon − Can chain bgpmon to provide robust protection against failures • 3 Did Add New XML Log Format 5 June 2006 NANOG 40 - bgpmon

BGPMon Architecture 4 5 June 2006 NANOG 40 - bgpmon

Chaining Together BGPMons 5 5 June 2006 NANOG 40 - bgpmon

Scaling Features and Chaining • BGPmon stores one RIB-IN for each peer − Updates are transient and written to logs/clients − RIB-IN dominates memory and limits scaling • BGPmon chains distribute RIB-Ins − Each BGPmon provides update flow from each peer − Each BGPmon appears to provide RIB-IN for each peer • In fact only stores RIB-IN for directly connected peers • When user requests RIB-IN from a BGPmon, it acts as a proxy and fetches the RIB-IN from the appropriate BGPmon in chain 6 5 June 2006 NANOG 40 - bgpmon

Chaining Together BGPMons No RIB-IN stored here! Can instead focus resources on client requests 7 5 June 2006 NANOG 40 - bgpmon

Log Format Issues • Started with MRT format − Following RIPE, Route. Views, etc. − But encountered some issues…. • ASCII or Binary? − Binary is compact, but clearly not human readable − MRT->ASCII adds extra step and may lose some information • Hard to extend format − Add flag to indicate if peering session encrypted? − Add some annotations the data to indicate duplicates? − Natively support new attributes? 8 5 June 2006 NANOG 40 - bgpmon

XML 9 5 June 2006 <? xml version="1. 0"? > <bgp> <message> <time>2007 -03 -22 T 19: 00: 07 Z</time> <source> <as>65001<as> <ip afi="1">129. 82. 138. 4</ip> </source> <destination> <as>65009</as> <ip afi="1">129. 82. 47. 109</ip> </destination> <update> <path_attributes> <origin order="0"> <transitive/> <igp value='0'/> </origin> <as_path order="1"> <transitive/> <as_sequence>65001 14041 3356 22351 </as_sequence> </as_path> <next_hop order="2"> <transitive/> <ip afi=1>129. 82. 138. 4</ip> </next_hop> </path_attributes> <nlri> <prefix label="NANN" afi="1" safi="1" length="24">82. 206. 163</prefix> </nlri> </update> /message> </bgp> NANOG 40 - bgpmon

XML Format • Human Readable • Also Feeds Into Many Applications Trivial to extend using new tags Choice of tags allow bit for bit reconstruction of update if desired Unknown attributes simply displayed in hex. Can automatically annotate to mark events • • − BGPmon can mark duplicate updates, AS path changes, etc. • But clearly pay a storage cost − Compact binary message is expanded into ASCII with Tags! 10 5 June 2006 NANOG 40 - bgpmon

XML Storage Costs 11 Format Raw (Bytes) /MRT size Compres sed /MRT size XML 15, 606, 6 16 7. 7 243, 405 1. 46 bgpdump 5, 742, 03 9 2. 8 243, 107 1. 46 1. 0 167, 050 1. 00 MRT 2, 024, 61 4 5 June 2006 NANOG 40 - bgpmon

Status • Versions running since December − monitor several routers − serviced 20 simulanteous clients • Got Peers? − Interested in testing with additional feeds − Contact Dan Massey (massey@cs. colostate. edu) • Software release for late summer − Want to complete more testing with larger feeds − http: //netsec. colostate. edu • 12 XML Log Format Specification in Progress 5 June 2006 NANOG 40 - bgpmon

Questions? 13 5 June 2006 NANOG 40 - bgpmon

Key Features • real-time feed for clients • scalability (peers and clients) • XML 14 5 June 2006 NANOG 40 - bgpmon

bgpmon architecture Message Log Monitor RIB Rib In Tables 15 5 June 2006 NANOG 40 - bgpmon XML Clients Table Dump

multi-bgpmon architecture bgpmon 16 5 June 2006 NANOG 40 - bgpmon