An Analysis of BGP Convergence Properties Fernando Sanchez Florida State University An Analysis of BGP Convergence Properties

BGP Convergence Problem No guarantee of globally reasonable polices As opposed to RIP-like protocols, BGP can diverge due to polices implemented on each AS Two ways to address Dynamically: prevent oscillation on run- time (route flap dampening) Statically: analyze routing polices to guarantee no oscillations

Objectives Explore worst-case complexity of static analysis of BGP routing policies Show complexity of particular problems: Reachability Asymmetry Solvability Single Destination Solvability Uniqueness Robustness

Abstract Model of BGP Simpler abstraction Network addresses are flat space Ignores attributes: MED, ORIGIN, AGGREGATE, etc At most one link between peer AS Ignore iBGP completely No Default route Each destination is generated at a single AS One global default value for LOCAL PREFERENCE

Network Routes Model of undirected graph G = (V, E) V -> AS E -> links between AS Route announcements nlri : network layer reachability information (destination) next_hop : next hop as_path : list of vertices traversed (list of AS) loc_pref : local preference (internal to each AS) Default loc_pref value dlp

Best Route Selection If r1.loc_pref != r2.loc_pref then select ri with highest loc_pref If length(r1.as_path) != length(r2.as_path) then pick the shortest as_path Else, ri with lowest next_hop

Route Record Transformations Two types of transformation Path-vector Transformations PVT(w<-v)[R] Enforces as_path record loc_pref are not passed Vertex v does not accept an as_path which contains v Transformation policies import(v<-w)[R] and export(v->w)[R] List of policy rules Hi => Ai 17 Є as_path => reject as_path = [12, ?, 16] => loc_pref := dlp +1 true => loc_pref := dlp

Evaluation States Cio represents the initial state, r.as_path is empty and next_hop is undefined r1 Є ci0 and r2 Є cj0 r1.nlri != r2.nlri A tuple <c0, c1, ... , cn> where ci is a set of route records that represents the contents of AS i in this state An empty set represents a initial state where any AS i has not learned or accepted any route

Dynamic Behaior A node i Є V is activated when it can compute its best routes based on the routes from neighboors Transition relationships allow to move from one state to another one based on the selection route rules

Evaluation Graph Eval(S) is an directed graph where each vertex represents a state s, and there exist a edge from s to s' if there exists a transition relationship that takes from state s to s' When the system state does not change regardless of any number of Ass that are activated, then it reaches a final state A system S is solvable if there exists at least one final state

BGP Anomalies

BAD GADGET Each AS prefers counter-clockwise route of length 2

BAD GADGET (cont) BAD GADGET does not have a solution

SURPRISE Solvable system but vulnerable on link failures For AS 3:

DISAGREE Has multiple solutions

DISAGREE (cont)

Complexity Show the complexity of various BGP properties: Reachability Asymmetry Solvability Unsolvability Solvability (SD) Unsolvability (SD) Trapped K-Robust Unique Unique (SD) Multiple Multiple (SD)

Complexity (cont) Reduction to 3-SAT ASSIGN BGP system

ASSIGN Each assignment X corresponds to a path from z to w Each path from z to w corresponds to a unique assignment X If xi is in the as_path, xi is not in the path Once a route is chosen, it can be locked in and not change

Reachability Reduction Given a state s, it can be check in polynomial time if it is a final state. We can then check verify that node v has a path to d on state s Build an instance of 3-SAT using ASSIGN

Reachability Reduction (cont) Each Ci = li,1 V li,2 V li,3 for 2 ≤ i ≤ m : import(Ci <- Ci-1) import(C1 <- z)

What does this mean? Simplified model allows to proof the complexity of BGP properties compared to real-world BGP Provide lower bounds for the complexity There are two main problems with static analysis: Policies are not always available among peers Checking for solvability of real-world BGP systems is NP-complete

What does this mean? (cont) Dynamic analysis Flap dampening does not solve the problem Possible solution Modify BGP protocol to carry information to detect policy conflicts, that can identify when oscillations are produced because policies or because link failures Problems: Such an extension should be scalable, robust, and compatible with aggregation Lack of characterization of policy inconsistencies