BGP Multiple Origin AS (MOAS) Conflict Analysis Xiaoliang Zhao, NCSU S. Felix Wu, UC Davis Allison Mankin, Dan Massey, USC/ISI Dan Pei, Lan Wang, Lixia Zhang, UCLA NANOG-23, October 23, 2001

NANOG 23 - Oakland210/23/2001 Definition of MOAS n BGP routes include a prefix and AS path –Example: /16, Path: 4513, 11422, 11422, 52 n Origin AS: the last AS in the path –In the above example: AS 52 originated the path advertisement for prefix /16 n Multiple Origin AS (MOAS): the same prefix announced by more than one origin AS

NANOG 23 - Oakland310/23/2001 Example MOAS Conflicts /16 Path: /16 nets AS 4 AS /16 Path: /16 Path: X, 4 AS X AS Y /16 Path: Z, 226 AS Z MOAS conflict ! Static or IGP learned route to 128.9/16 Valid MOAS case: 128.9/16 reachable either way Invalid MOAS case: 128.9/16 reachable one way but not the other

NANOG 23 - Oakland410/23/2001 Talk Outline n Measurement data shows that MOAS exists n Some MOAS cases caused by faults n Some MOAS cases due to operational need n Important to distinguish the two –proposed solutions

NANOG 23 - Oakland510/23/2001 Measurement Data Collection n Data collected from the Oregon Route Views –Peers with >50 routers from >40 different ASes. –Our analysis uses data [11/08/97  07/18/01] (1279 days total) n More than MOAS conflicts observed during this time period At a given moment, –The Route Views server observed 1364 MOAS conflicts –The views from 3 individual ISPs showed 30, 12 and 228 MOAS conflicts

NANOG 23 - Oakland610/23/2001 MOAS Conflicts Do Exist Max: (11357 from a single AS) Max: (9177 from a single AS)

NANOG 23 - Oakland710/23/2001 Histogram of MOAS Conflict Lifetime Total # of days a prefix experienced MOAS conflict # of MOAS conflicts

NANOG 23 - Oakland810/23/2001 Distribution of MOAS Conflicts over Prefix Lengths ratio of # MOAS entries over total routing entries for the same prefix length

NANOG 23 - Oakland910/23/2001 Multi-homing without BGPPrivate AS number Substitution Valid Causes of MOAS Conflicts 128.9/16 Path: 11422, /16 Path: /16 Path: /16 Path: X /16 Path:Y 128.9/ /16 AS AS Y AS X AS 4 AS AS 226 Static route or IGP route 128.9/16 Path: 4

NANOG 23 - Oakland1010/23/2001 Invalid Causes of MOAS Conflicts n Operational faults led to large spikes of MOAS conflicts –04/07/1998: one AS originated prefixes, out of which were MOAS conflicts –04/10/2001: another AS originated 9180 prefixes, out of which 9177 were MOAS conflicts n Falsely originated routes –Errors –Intentional traffic hijacking

NANOG 23 - Oakland1110/23/2001 Handling MOAS Conflicts n RFC 1930 recommends each prefix be originated from a single AS n Today’s routing practice leads to MOAS in normal operations n We must tell valid MOAS cases from invalid ones –Proposal 1: using BGP community attribute –Proposal 2: DNS-based solution

NANOG 23 - Oakland1210/23/2001 BGP-Based Solution Define a new community attribute –Listing all the ASes allowed to originate a prefix n Attach this MOAS community-attribute to BGP route announcement n Enable BGP routers to detect faults and attacks –At least in most cases, we hope!

NANOG 23 - Oakland1310/23/2001 Comm. Attribute Implementation Example router bgp 59 neighbor remote-as 52 neighbor send-community neighbor route-map setcommunity out route-map setcommunity match ip address /8 set community 59:MOAS 58:MOAS additive Example configuration: AS58 18/8, PATH, MOAS{4,58,59} AS /8 18/8, PATH, MOAS{58,59} 18/8, PATH, MOAS{52, 58} AS52

NANOG 23 - Oakland1410/23/2001 Implementation Considerations n Quickly and incrementally deployable –Generating MOAS community attribute: configuration changes only –Detecting un-validated MOAS or a MOAS-CA conflict: Short term: observable from monitoring platforms Longer term: adding into BGP update processing n But community attributes may be dropped by a transit AS due to local configurations or policies –time to fix the handling of community attributes?

NANOG 23 - Oakland1510/23/2001 Another Proposal: DNS-based Solution n Put the MOAS list in a new DNS Resource Record ftp://psg.com/pub/dnsind/draft-bates-bgp4-nlri-orig-verif-00.txt by Bates, Li, Rekhter, Bush, 1998 $ORIGIN 18.bpg.in-addr.arpa.... AS 58 8 AS Example configuration (zone file for 18.bgp.in-addr.arpa): Query 18.bgp.in-addr.arpa: origin AS? Response 18.bgp.in-addr.arpa AS 58 8 AS 59 8 Enhanced DNS service MOAS detected for 18/8, query DNS to verify

NANOG 23 - Oakland1610/23/2001 Issues to Consider for the DNS Solution n Provides a general prefix to origin AS mapping database n Complementary to Community-attribute Approach –Check with DNS when community tag indicates a potential problem –DNSSEC, once available, authenticates the MOAS list nBut requires changes to DNS and BGP nDNS may be vulnerable without DNSSEC –When would DNSSEC be ready? nRouting system querying naming system: circular dependency?

NANOG 23 - Oakland1710/23/2001 Summary n MOAS conflicts exist today –Some due to operational need; some due to faults n Blind acceptance of MOAS could be dangerous –An open door for traffic hijacking n We plan to finalize the solution and bring to IETF Send all questions to For more info about FNIISC project: