Visualization of Temporal Difference of BGP Routing Information

Visualization of Temporal Difference of BGP Routing Information Ryo SAKIYAMA Koji OKAMURA Youngseok LEE Graduate School of Information Science and Electrical Engineering, Kyushu University Computing and Communications Center, Kyushu University Dept. of Computer Science and Engineering, Faculty of Electrical and Computer Engineering, Chungnam National University 11/25/2020

Contents n n n Background Purpose Research Routing Information u How to visualize u Introducing ABEL 2 u Example Analysis u Future Works u n Conclusion 11/25/2020 1

Background (1/2) n n AS (Autonomous System) is a set of routers under a single technical administration. There are two kinds of routing protocols: u u Intra-AS routing protocol : IGP (Interior Gateway Protocol) Inter-AS routing protocol : EGP (Exterior Gateway Protocol) n BGP (border Gateway Protocol) always selects the stable routes. AS 3 BGP BGP BGP Router AS 1 11/25/2020 AS 2 2

Background (2/2) n BGP is used to exchange routing information for the Internet. When the network failures occur, the alternative routes are selected dynamically according to the BGP routing policy. These policies are usually very complex because there a lot of ASes. u u AS 3 AS 2 AS 1 11/25/2020 AS 3 AS 4 AS 6 Normal Route AS 2 AS 7 AS 1 AS 4 AS 6 AS 7 Route at network failure 3

Purpose n Network operators design the alternative routing policy as the backup route. Understand that what alternative route is selected according to BGP routing policy. n Changes of routes could be easily understood with a graphical visualization tool of BGP routing tables. Develop a visualization tool of Temporal Difference of BGP Routing Information 11/25/2020 4

Related Work n CAIDA (Cooperative Associate for Internet Data Analysis) n Visualization of IPv 4 Internet u u Each AS is plotted as a point in the circle, and ASes are connected with lines. Core ASes at the center of the network are important, because the global connectiviy could be lost. Too complex to understand the changes of route. Emphasize the changes of route with a simple BGP routing table visualization tool. 11/25/2020 5

Routing Information BGP Routing Information n Recorded at AS 2523 (QGPOP)． Network u Saved at a file Path hard every ten minutes. u 3. 0. 0. 0 Network *>i 3. 0. 0. 0 *>i 4. 19. 16. 0/23 *>i 4. 21. 80. 0/22 *>i 4. 21. 82. 0/24 *>i 4. 21. 252. 0/23 *>i 4. 23. 180. 0/24 *>i 4. 36. 200. 0/21 *>i 4. 67. 64. 0/22 *>i 4. 78. 32. 0/21 *>i 6. 1. 0. 0/16 *>i 6. 5. 0. 0/19 … Routing tables Next Hop 210. 138. 15. 145 210. 138. 15. 145 203. 178. 136. 137 210. 138. 15. 145 2497 7018 80 9270 Metric Loc. Prf Weight Path 300 0 2497 7018 80 i 300 0 2497 3356 i 300 0 2497 701 6167 i 300 0 2497 4200 16559 i 300 0 2497 701 6389 8063 19198 i 300 0 2497 2914 3561 6128 30576 i 300 0 2497 701 14742 11854 14135 i 300 0 2497 11608 19281 i 300 0 2500 6461 29748 i 300 0 2497 701 668 I 300 0 2497 701 668 i APAN KR 7660 APAN JP 2523 2907 QGPOP SINET … 2497 IIJ 2508 2500 order. Kyushu-u List of ASes which relay packets to the destination AS in WIDE u We can analyze relationship between target AS and other ASes. u 11/25/2020 6

Problems of Visualization n It is difficult for Network operators to understand that alternative route is selected from BGP routing tables. u Routing tables are large-scale data. Network *>i 3. 0. 0. 0 *>i 4. 17. 225. 0/24 *>i 4. 17. 226. 0/23 *>i 4. 17. 251. 0/24 *>i 4. 17. 252. 0/23 *>i 4. 19. 16. 0/23 *>i 4. 21. 80. 0/22 *>i 4. 21. 82. 0/24 *>i 4. 21. 252. 0/23 *>i 4. 23. 180. 0/24 *>i 4. 36. 200. 0/21 *>i 4. 67. 64. 0/22 *>i 4. 78. 32. 0/21 *>i 6. 1. 0. 0/16 *>i 6. 2. 0. 0/22 *>i 6. 3. 0. 0/18 *>i 6. 4. 0. 0/16 *>i 6. 5. 0. 0/19 *>i 6. 6. 0. 0/16 *>i 6. 8. 0. 0/20 … Next Hop 210. 138. 15. 145 210. 138. 15. 145 203. 178. 136. 137 210. 138. 15. 145 210. 138. 15. 145 Metric Loc. Prf Weight Path 300 0 2497 7018 80 i 300 0 2497 3356 i 300 0 2497 701 11853 6496 6496 6496 300 0 2497 701 6167 6167 i 300 0 2497 4200 16559 i 300 0 2497 701 6389 8063 19198 i 300 0 2497 2914 3561 6128 30576 i 300 0 2497 701 14742 11854 14135 i 300 0 2497 11608 19281 i 300 0 2500 6461 29748 i 300 0 2497 701 668 i 300 0 2497 701 668 i 300 0 2497 2914 668 i 300 0 2497 701 668 I 6496 i i Networks: 180, 000 ASes: 20, 000 File Size: 15 MB ？ ？ Example of Routing Table 11/25/2020 7

How to Visualize n n Visualization of the entire Internet is very complex to understand the changes of routes. Especially pay attention are changes of routes. Suggest a graphical tool that present only the change of routes to network operators. u AS 10 AS 11 AS 3 AS 2 AS 1 Observation AS 4 AS 6 AS 8 AS 2 AS 7 AS 9 Visualization of the whole BGP routing tables 11/25/2020 AS 3 AS 5 AS 4 AS 6 AS 7 AS 1 Observation Visualization of the Changes of routes 8

ABEL 2 n Named ABEL 2 that visualize the routing information for temporal route changes tool. u u n ABEL 2 (A routing recording database system based on Bgp for n. Etwork management and app. Lication software version 2). JAVA was used for visualization. ABEL 2 consists of two stages for visualization. u u 11/25/2020 Convert routing information into data suitable for efficient visualization. Visualize the changes of routes. 9

Calculate Changes of routes n n Record the BGP routing table every ten minutes. Calculate the difference between two BGP routing tables every ten minutes. 2006/07/01 10: 00 Network 3. 0. 0. 0/8 4. 17. 225. 0/24 4. 19. 2. 0/23 … … … Path 2497 2006/07/01 10: 10 7018 80 701 3356 701 11853 6496 701 6167 Network 3. 0. 0. 0/8 4. 19. 2. 0/23 4. 21. 80. 0/22 … … … Path 2497 7018 80 2500 3356 701 6167 4200 16559 Changes of routes Date 2006/07/01 11/25/2020 Time 10: 00 Network 4. 0. 0. 0/8 4. 17. 225. 0/24 4. 20. 2. 0/23 AS 3356 6496 16559 From 2497 701 3356 2497 701 11853 6496 none To 2497 2500 3356 none 2497 4200 16559 10

Weights by Prefix Length (1/3) n n ABEL 2 puts weights on the prefix length in BGP routing information. Influence of the route change can be reflected. Based on IP address Classes (Class A, Class B, and Class C). u n The edge width denotes the weight of prefix length. Network x. x/24 y. y/23 z. z/22 Path AS 1 AS 2 AS 4 AS 3 AS 1 AS 2 AS 3 AS 7 AS 4 AS 5 AS 8 AS 6 Prefix Length: 24 > Class C : 1 x. x/24 AS 5 AS 6 Prefix Length: 23 > Class C : 2 y. y/23 AS 7 AS 8 Prefix Length: 22 > Class C : 4 z. z/22 11/25/2020 11

Weights by Prefix Length (2/3) n n Search for the routes connected between ASes from the routing table. Calculate the number of Class A, Class B or Class C for every route. Routing Table Network 3. 0. 0. 0/8 4. 17. 225. 0/24 4. 17. 226. 0/24 4. 19. 2. 0/23 4. 21. 80. 0/22 4. 21. 82. 0/22 … 11/25/2020 … … … … Path 2497 2497 7018 80 3356 701 11853 6496 701 6167 4200 16559 AS 2497 - AS 7018, Class A: 1 AS 7018 - AS 80, Class A: 1 AS 2497 - AS 3356, Class A: 1 AS 2497 - AS 701, Class C: 2 AS 701 - AS 11853 , Class C: 2 AS 11853 - AS 6496 , Class C: 2 12

Weights by Prefix Length (3/3) n Compare two files that have calculated routing tables. u if the number of Class A, Class B or Class C for each route changes, it is thought that the route was changed． 0: 00 0: 10 Connection 10429 - 22818 11456 - 30683 11537 - 18592 … Prefix Length A: 1, B: 2, C: 0 A: 0, B: 1, C: 5 A: 0, B: 0, C: 5 Connection 10429 – 22818 11456 - 30683 11537 - 18592 … Prefix Length A: 1, B: 1, C: 0 A: 0, B: 1, C: 5 A: 0, B: 0, C: 6 Weights by Prefix Length Time 00: 10 … 11/25/2020 Changed Connection 10429 - 22818 11537 - 18592 Prefix Length A: 1, B: 2, C: 0 A: 0, B: 0, C: 6 Variation A: 0, B: -1, C: 0 A: 0, B: 0, C: +1 13

Visualization n Connections between ASes in the graph are displayed such that ASes are denoted by nodes and the routes by edges. u The node/link layout algorithm is simple. n n u The AS must not overlap with other ASes. The distance between ASes are constant. The edge width denotes the weight of prefix length． Changes of routes Time 00: 10 … Network 4. 0. 0. 0/8 AS 17238 From 10429 11456 17238 To 11456 17238 10429 Weights by Prefix Length Time 00: 10 … Connection 10429 - 22818 11456 - 17238 11/25/2020 Prefix Length A: 1, B: 0, C: 0 A: 0, B: 0, C: 0 Variation A: -1, B: 0, C: 0 A: +1, B: 0, C: 0 11456 -A: 1 22818 +A: 1 17238 Observation 14

Visualization n Example of Visualization u country-by-country different color. Deleted Connections AS Number AS Name Country Added Connection 11/25/2020 15

About ABEL 2 http: //saki. ok. csce. kyushu-u. ac. jp/abel/ Number of added path Time Information of selected AS Number of Deleted path 11/25/2020 16

Example Analysis (1/3) Number of changed Paths January 9, 2006. It is observed that the peak of route changes was around 8: 20 AM. Number of Paths Changed Paths Deleted Paths 11/25/2020 Time Added Paths 17

Example Analysis (2/3) 2006/01/09 8: 20 ISP in Germany 13237 LAMBDANET-AS Hannover, Germany 11/25/2020 18

Example Analysis (3/3) n Route Flapping u Observe the phenomenon that the same route changes frequently in a day. January 9, 2006. 11/25/2020 2: 20 20: 40 20: 30 5: 30 2: 30 1: 40 0: 00 From AS 2523 To AS 12302 19

Future works n Make a module of generating statistics on the long-term route changes. Since ABEL 2 presents the route changes that are calculated from the differences between two routing tables. u ABEL 2 will be more useful with the analysis of route changes regarding either route flapping or network failure. u 11/25/2020 20

Conclusion n Suggest the visualization tool u u n n Help network operators understand that alternative route is selected according to BGP routing policy. Visualized the route changes by analyzing of routing tables which are being regularly saved to files. Have developed a graphical tool, ABEL 2, that can present the route changes. We believe ABEL 2 will be useful for network operators to design the alternative routing policies for the backup route. 11/25/2020 21

Thank You! 11/25/2020