1 Isolating Wide-Area Network Faults with Baywatch Colin Scott With Professor Ethan Katz-Bassett, Dave Choffnes, Italo Cunha, Arvind Krishnamurthy, and Tom Anderson

2 A Quick Survey Raise your hand if you used the Internet / …since you got to this room? …in the last hour? …today?

3 3 We Need the Internet to Be Reliable We increasingly depend on the Internet: – Yesterday: , web browsing, e-commerce – Today: Skype, Google Docs, NetFlix – Tomorrow: Thin clients + cloud, traffic control, outpatient medical monitoring,… So, we expect it to operate reliably: – High availability – Good performance Does it achieve these goals?

4 Outages happen. They’re expensive, embarrassing and annoying They take a long time to fix – Alert – Troubleshoot – Repair Lack of good tools for wide-area isolation

5 Many outages and most are partial Number of VPs Approx 90% are partial

6 And can be surprisingly long-lasting Approx 10% last 10 minutes or longer

7 But where are the outages? Can’t fix a problem if you don’t know where State of the art: traceroute – Only tells part of the story – Even with control of source and destination – Especially without control of destination

8 Example confusion (12/16/10) User 1 1 Wireless_Broadband_Router.home [ ] 2 L100.BLTMMD-VFTTP-40.verizon-gni.net [ ] 3 G BLTMMD-LCR-04.verizon-gni.net [ ] 4 so PHIL-BB-RTR2.verizon-gni.net [ ] 5 so RES-BB-RTR2.verizon-gni.net [ ] 6 0.ae2.BR2.IAD8.ALTER.NET [ ] 7 ae7.edge1.washingtondc4.level3.net [ ] 8 vlan80.csw3.Washington1.Level3.net [ ] 9 ae ebr2.Washington1.Level3.net [ ] 10 * * * Request timed out.L100.BLTMMD-VFTTP-40.verizon-gni.netG BLTMMD-LCR-04.verizon-gni.netso PHIL-BB-RTR2.verizon-gni.netso RES-BB-RTR2.verizon-gni.net0.ae2.BR2.IAD8.ALTER.NETae7.edge1.washingtondc4.level3.netvlan80.csw3.Washington1.Level3.netae ebr2.Washington1.Level3.net “It seems traffic attempting to pass through Level3's network in the Washington, DC area is getting lost in the abyss. Here's a trace from VZ residential FIOS to – Outages.org listwww.level3.com User 1: Broken link is in DC

9 Example confusion (12/16/10) “It seems traffic attempting to pass through Level3's network in the Washington, DC area is getting lost in the abyss. Here's a trace from VZ residential FIOS to – Outages.org listwww.level3.com Is this even the same problem? What if it’s on the reverse path? (and paths aren’t symmetric) User 1: Broken link is in DC User 2: It’s in Denver? User ( ) 2 l100.washdc-vfttp-47.verizon-gni.net ( ) l100.washdc-vfttp-47.verizon-gni.net 3 g washdc-lcr-07.verizon-gni.net ( )g washdc-lcr-07.verizon-gni.net 4 so lcc1-res-bb-rtr1-re1.verizon-gni.net ( )so lcc1-res-bb-rtr1-re1.verizon-gni.net 5 0.ae1.br1.iad8.alter.net ( )0.ae1.br1.iad8.alter.net 6 ae6.edge1.washingtondc4.level3.net ( ) ae6.edge1.washingtondc4.level3.net 7 vlan90.csw4.washington1.level3.net ( ) vlan90.csw4.washington1.level3.net 8 ae ebr1.washington1.level3.net ( ) ae ebr1.washington1.level3.net 9 ae-8-8.ebr1.washington12.level3.net ( )ae-8-8.ebr1.washington12.level3.net 10 ae ebr2.washington12.level3.net ( )ae ebr2.washington12.level3.net 11 ae-6-6.ebr2.chicago2.level3.net ( ) ae-6-6.ebr2.chicago2.level3.net 12 ae ebr1.chicago2.level3.net ( )ae ebr1.chicago2.level3.net 13 ae-3-3.ebr2.denver1.level3.net ( ) ae-3-3.ebr2.denver1.level3.net 14 ge-9-1.hsa1.denver1.level3.net ( ) ge-9-1.hsa1.denver1.level3.net ( ) ( ) 17 * * *

10 System for wide-area failure isolation Goal: Detect and isolate outages online What kind of outages? – Long-lasting: not fixing itself (needs some help) – Avoidable: requires path diversity, no stub ASes – High impact: outages in PoPs affecting many paths What kind of isolation? – IP-link How quickly? – Within seconds or small numbers of minutes

11 What we want out of isolation Direction (forward or reverse) Narrowly determine location (link or ASN) Alternate working paths (facilitates remediation) Online (allows for immediate action) So, how do we accomplish this?

12 Detecting outages with pings Source Target Source Ping?

13 Detecting outages with pings Source Target Source

14 traceroute doesn’t work Target TTL=1 Source

15 traceroute doesn’t work S R1 R1: Time Exceeded Target

16 traceroute doesn’t work S R1 Target TTL=2

17 traceroute doesn’t work S R1 Target R2: Time Exceeded R2

18 traceroute doesn’t work S R1 Target ? TTL=3 traceroute doesn’t work S R1 Target R2

19 Spoofed traceroute ftw S R1 Target S R1 Target S’ R2 R2: Time Exceeded

20 Spoofed traceroute ftw S R1 Target S R1 Target S’ R2 R3: Time Exceeded R3

21 Spoofed traceroute ftw S R1 Target S R1 Target S’ R2 R4: Time Exceeded R3 R4 Target: Pong

22 What now? SS R1 Target S R1 Target S’ R2 R3 R4

23 Measure working reverse paths SS R1 Target S R1 Target S’ R3 R4 OK, somewhere on R3’s reverse path But where? SS R1 Target S R1 Target S’ R2 R3 R4

24 VPs Targets Historical path atlas Each host traceroutes each target

25 VPs Targets Historical path atlas Each host measures reverse paths

26 Ping historical hops SS R1 Target S R1 Target S’ R2 R3 R4

27 Putting it all together Find spoofing VPs that reach target Determine working direction (if any) – Forward: issue spoofed forward traceroute – Reverse: VPs spoof towards target as source, issue spoofed reverse traceroute Failure cases – Forward-only: spoof traceroute – Reverse-only: reverse traceroute from each fwd hop, ping historical hops – Bi-directional: spoof traceroute

28 Results Baywatch has been running for 4 months 12 geographically distributed VPs monitoring: – CloudFront PoPs (16) Correlate with app-layer outages – Popular PoPs wrt # intersecting paths (83) And targets on “other” side of PoPs (185) – PlanetLab hosts (76) Ground-truth isolation

29 Results Location (~2500 total) – PL/Mlab: 1241 – Top 100: 1220 – CloudFront: 38 Duration: Average is 453 seconds Directionality – Forward: 860 – Reverse: 130 – Bi-directional: 439 – The rest were indeterminate (different path, fixed by time of isolation, …)

30 Evaluation Coverage – How much of the network can we monitor? – How precise is isolation? Effectiveness – When affecting CDN, try application layer – Corroborate with NANOG – Post to outages.org

31 Summary System for wide-are failure isolation – Detection at fine granularity – Algorithm for isolation Historical, rapidly refreshed path atlas Spoofed probing to measure during outage Pings to infer reachability

32 Questions?

33

34 Reverse traceroutes Reverse path info generally requires – IP options support along the path – Limited spoofing – A lot of trial and error

35 Simple (real) example Normal traceroute * * * 9. * * * 10. * * * 11. * * * 12. * * * Spoofed traceroute pl2.bit.uoit.ca ( )pl2.bit.uoit.ca( plgmu4.ite.gmu.edu to pl2.bit.uoit.ca