Visualization of Temporal Difference of BGP Routing Information Ryo SAKIYAMA Koji OKAMURA Youngseok LEE Graduate School of Information Science and Electrical Engineering, Kyushu University Computing and Communications Center, Kyushu University Dept. of Computer Science and Engineering, Faculty of Electrical and Computer Engineering, Chungnam National University My name is Ryo Sakiyama, I'm student of graduate school of Information Science and Electrical Engineering, Kyushu University in Japan. The presantation title is “Visualization of Temporal Difference of BGP Routing Information” 2019/4/20

Contents Background Purpose Research Conclusion Routing Information How to visualize Introducing ABEL2 Example Analysis Future Works Conclusion 2019/4/20

Background (1/2) AS (Autonomous System) is a set of routers under a single technical administration. There are two kinds of routing protocols: Intra-AS routing protocol : IGP (Interior Gateway Protocol) Inter-AS routing protocol : EGP (Exterior Gateway Protocol) BGP (border Gateway Protocol) always selects the stable routes. AS 3 BGP BGP BGP BGP BGP Router AS 1 AS 2 2019/4/20

Background (2/2) BGP is used to exchange routing information for the Internet. When the network failures occur, the alternative routes are selected dynamically according to the BGP routing policy. These policies are usually very complex because there are a lot of ASes. AS 3 AS 4 AS 3 AS 4 AS 2 AS 2 AS 6 AS 7 AS 6 AS 7 AS 1 AS 1 Normal Route Route at network failure 2019/4/20

Purpose Network operators design the alternative routing policy as the backup route. Understand that what alternative route is selected according to BGP routing policy. Changes of routes could be easily understood with a graphical visualization tool of BGP routing tables. Develop a visualization tool of Temporal Difference of BGP Routing Information 2019/4/20

Related Work CAIDA (Cooperative Associate for Internet Data Analysis) Visualization of IPv4 Internet Each AS is plotted as a point in the circle, and ASes are connected with lines. Core ASes at the center of the network are important, because the global connectiviy could be lost. Too complex to understand the changes of route. Emphasize the changes of route with a simple BGP routing table visualization tool. 2019/4/20

Routing Information 2497 7018 80 3.0.0.0 BGP Routing Information Recorded at AS 2523 (QGPOP)． Saved at a file hard every ten minutes. Path 2497 7018 80 Network 3.0.0.0 Routing tables 9270 APAN KR List of ASes which relay packets to the destination AS in order. We can analyze relationship between target AS and other ASes. Network Next Hop Metric LocPrf Weight Path *>i3.0.0.0 210.138.15.145 300 0 2497 7018 80 i *>i4.0.0.0 210.138.15.145 300 0 2497 3356 i *>i4.19.16.0/23 210.138.15.145 300 0 2497 701 6167 6167 6167 i *>i4.21.80.0/22 210.138.15.145 300 0 2497 4200 16559 i *>i4.21.82.0/24 210.138.15.145 300 0 2497 4200 16559 i *>i4.21.252.0/23 210.138.15.145 300 0 2497 701 6389 8063 19198 i *>i4.23.180.0/24 210.138.15.145 300 0 2497 2914 3561 6128 30576 i *>i4.36.200.0/21 210.138.15.145 300 0 2497 701 14742 11854 14135 i *>i4.67.64.0/22 210.138.15.145 300 0 2497 11608 19281 i *>i4.78.32.0/21 203.178.136.137 300 0 2500 6461 29748 i *>i6.1.0.0/16 210.138.15.145 300 0 2497 701 668 I *>i6.5.0.0/19 210.138.15.145 300 0 2497 701 668 i … 7660 APAN JP 2523 QGPOP 2907 SINET … 2497 IIJ 2508 Kyushu-u 2500 WIDE 2019/4/20

Problems of Visualization It is difficult for Network operators to understand that alternative route is selected from BGP routing tables. Routing tables are large-scale data. Networks:180,000 ASes: 20,000 File Size: 15MB Network Next Hop Metric LocPrf Weight Path *>i3.0.0.0 210.138.15.145 300 0 2497 7018 80 i *>i4.0.0.0 210.138.15.145 300 0 2497 3356 i *>i4.17.225.0/24 210.138.15.145 300 0 2497 701 11853 6496 6496 6496 6496 i *>i4.17.226.0/23 210.138.15.145 300 0 2497 701 11853 6496 6496 6496 6496 i *>i4.17.251.0/24 210.138.15.145 300 0 2497 701 11853 6496 6496 6496 6496 i *>i4.17.252.0/23 210.138.15.145 300 0 2497 701 11853 6496 6496 6496 6496 i *>i4.19.2.0/23 210.138.15.145 300 0 2497 701 6167 6167 6167 i *>i4.19.16.0/23 210.138.15.145 300 0 2497 701 6167 6167 6167 i *>i4.21.80.0/22 210.138.15.145 300 0 2497 4200 16559 i *>i4.21.82.0/24 210.138.15.145 300 0 2497 4200 16559 i *>i4.21.252.0/23 210.138.15.145 300 0 2497 701 6389 8063 19198 i *>i4.23.180.0/24 210.138.15.145 300 0 2497 2914 3561 6128 30576 i *>i4.36.200.0/21 210.138.15.145 300 0 2497 701 14742 11854 14135 i *>i4.67.64.0/22 210.138.15.145 300 0 2497 11608 19281 i *>i4.78.32.0/21 203.178.136.137 300 0 2500 6461 29748 i *>i6.1.0.0/16 210.138.15.145 300 0 2497 701 668 i *>i6.2.0.0/22 210.138.15.145 300 0 2497 701 668 i *>i6.3.0.0/18 210.138.15.145 300 0 2497 701 668 i *>i6.4.0.0/16 210.138.15.145 300 0 2497 701 668 i *>i6.5.0.0/19 210.138.15.145 300 0 2497 701 668 i *>i6.6.0.0/16 210.138.15.145 300 0 2497 2914 668 i *>i6.8.0.0/20 210.138.15.145 300 0 2497 701 668 I … ？ ？ Example of Routing Table 2019/4/20

How to Visualize Visualization of the entire Internet is very complex to understand the changes of routes. Especially pay attention are changes of routes. Suggest a graphical tool that present only the change of routes to network operators. AS 10 AS 11 AS 3 AS 4 AS 3 AS 4 AS 5 AS 2 AS 2 AS 6 AS 7 AS 6 AS 7 AS 1 AS 8 AS 1 AS 9 Observation Observation Visualization of the whole BGP routing tables Visualization of the Changes of routes 2019/4/20

ABEL2 Named ABEL2 that visualize the routing information for temporal route changes tool. ABEL2 (A routing recording database system based on Bgp for nEtwork management and appLication software version 2). JAVA was used for visualization. ABEL2 consists of two stages for visualization. Convert routing information into data suitable for efficient visualization. Visualize the changes of routes. 2019/4/20

Calculate Changes of routes Record the BGP routing table every ten minutes. Calculate the difference between two BGP routing tables every ten minutes. 2006/07/01 10:00 2006/07/01 10:10 Network … Path 3.0.0.0/8 … 2497 7018 80 4.0.0.0/8 … 2497 701 3356 4.17.225.0/24 … 2497 701 11853 6496 4.19.2.0/23 … 2497 701 6167 … Network … Path 3.0.0.0/8 … 2497 7018 80 4.0.0.0/8 … 2497 2500 3356 4.19.2.0/23 … 2497 701 6167 4.21.80.0/22 … 2497 4200 16559 … Changes of routes Date Time Network AS From To 2006/07/01 10:00 4.0.0.0/8 3356 2497 701 3356 2497 2500 3356 2006/07/01 10:00 4.17.225.0/24 6496 2497 701 11853 6496 none 2006/07/01 10:00 4.20.2.0/23 16559 none 2497 4200 16559 2019/4/20

Weights by Prefix Length (1/3) ABEL2 puts weights on the prefix length in BGP routing information. Influence of the route change can be reflected. Based on IP address Classes (Class A, Class B, and Class C). The edge width denotes the weight of prefix length. Network Path x.x.x.x/24 AS 1 AS 2 AS 3 AS 4 y.y.y.y/23 AS 1 AS 2 AS 3 AS 5 AS 6 z.z.z.z/22 AS 1 AS 2 AS 7 AS 8 AS 4 Prefix Length: 24 > Class C : 1 AS 3 x.x.x.x/24 AS 1 AS 2 AS 5 AS 6 Prefix Length: 23 > Class C : 2 y.y.y.y/23 AS 7 AS 8 Prefix Length: 22 > Class C : 4 z.z.z.z/22 2019/4/20

Weights by Prefix Length (2/3) Search for the routes connected between ASes from the routing table. Calculate the number of Class A, Class B or Class C for every route. Routing Table Network … Path 3.0.0.0/8 … 2497 7018 80 4.0.0.0/8 … 2497 3356 4.17.225.0/24 … 2497 701 11853 6496 4.17.226.0/24 … 2497 701 11853 6496 4.19.2.0/23 … 2497 701 6167 4.21.80.0/22 … 2497 4200 16559 4.21.82.0/22 … 2497 4200 16559 … AS 2497 - AS 7018, Class A: 1 AS 7018 - AS 80, Class A: 1 AS 2497 - AS 3356, Class A: 1 AS 2497 - AS 701, Class C: 2 AS 701 - AS 11853 , Class C: 2 AS 11853 - AS 6496 , Class C: 2 2019/4/20

Weights by Prefix Length (3/3) Compare two files that have calculated routing tables. if the number of Class A, Class B or Class C for each route changes, it is thought that the route was changed． 0:00 0:10 Connection Prefix Length 10429 - 22818 A:1, B:2, C:0 11456 - 30683 A:0, B:1, C:5 11537 - 18592 A:0, B:0, C:5 … Connection Prefix Length 10429 – 22818 A:1, B:1, C:0 11456 - 30683 A:0, B:1, C:5 11537 - 18592 A:0, B:0, C:6 … Weights by Prefix Length Time Changed Connection Prefix Length Variation 00:10 10429 - 22818 A:1, B:2, C:0 A:0, B:-1, C:0 00:10 11537 - 18592 A:0, B:0, C:6 A:0, B:0, C:+1 … 2019/4/20

Visualization Connections between ASes in the graph are displayed such that ASes are denoted by nodes and the routes by edges. The node/link layout algorithm is simple. The AS must not overlap with other ASes. The distance between ASes are constant. The edge width denotes the weight of prefix length． Changes of routes 11456 Time Network AS From To 00:10 4.0.0.0/8 17238 10429 11456 17238 11456 17238 … -A:1 10429 Weights by Prefix Length +A:1 Time Connection Prefix Length Variation 00:10 10429 - 22818 A:1, B:0, C:0 A:-1, B:0, C:0 00:10 11456 - 17238 A:0, B:0, C:0 A:+1, B:0, C:0 … -A:1 17238 22818 Observation 2019/4/20

Visualization Example of Visualization country-by-country different color. Deleted Connections AS Number AS Name Country Added Connection 2019/4/20

About ABEL2 http://saki.ok.csce.kyushu-u.ac.jp/abel/ Number of added path Time Information of selected AS Number of Deleted path 2019/4/20

Example Analysis (1/3) Number of changed Paths January 9, 2006. It is observed that the peak of route changes was around 8:20 AM. Changed Paths Number of Paths Deleted Paths Added Paths Time 2019/4/20

Example Analysis (2/3) 2006/01/09 8:20 ISP in Germany 13237 LAMBDANET-AS Hannover, Germany 2019/4/20

Example Analysis (3/3) Route Flapping Observe the phenomenon that the same route changes frequently in a day. January 9, 2006. 20:30 20:40 5:30 2:30 0:00 1:40 2:20 From AS 2523 To AS 12302 2019/4/20

Future works Make a module of generating statistics on the long-term route changes. Since ABEL2 presents the route changes that are calculated from the differences between two routing tables. ABEL2 will be more useful with the analysis of route changes regarding either route flapping or network failure. 2019/4/20

Conclusion Suggest the visualization tool Help network operators understand that alternative route is selected according to BGP routing policy. Visualized the route changes by analyzing of routing tables which are being regularly saved to files. Have developed a graphical tool, ABEL2, that can present the route changes. We believe ABEL2 will be useful for network operators to design the alternative routing policies for the backup route. 2019/4/20

Thank You! 2019/4/20