SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu Searching for Stability in Interdomain Routing Rahul Sami (University of Michigan) Michael Schapira (Yale/UC Berkeley) Aviv Zohar (Hebrew University)

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu Border Gateway Protocol (BGP) n Path-vector routing n Routing between Autonomous Systems –ASes can apply routing policies 2 AT&T Comcast AkamaiYahoo!

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu Convergence/Oscillation Uncoordinated policies can lead to persistent global route oscillations n [Varadhan, Govindan, Estrin] n [Griffin, Wilfong], [Griffin, Shepherd, Wilfong] –Several sufficient conditions for stable convergence [GR01, GGR01,GJR03,FJB05,..] –open question: can a network have two stable solutions, but no oscillation? 3

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu Our Results n Two stable solutions imply potential BGP oscillations 4

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu Our Results n Two stable solutions imply potential BGP oscillations n If preferences satisfy Gao-Rexford constraints –Convergence of n AS network could require Ω(n) time in the wost case –with α-level hierarchy, BGP converges after at most 2α+2 “phases” 5

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu BGP model: Routes and Preferences n Atomic AS/ representative router n Router state: –Available routes to each destination –Route preference rules –Currently selected route n Abstract away export filters, MEDs, etc. 6 dest route AS1 AS2 AS3;AS1 AS27;AS3;AS1 AS8; AS4;AS1 AS4;AS2 … Prefer AS27 Prefer shorter …

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu BGP model: Dynamics 7 Each AS i actions: select best route from available routes advertise current route to neighbor j Evolution governed by sequence of action events Arbitrary (adversarial) timing, with two restrictions: Fair sequence (no starvation) Messages not delayed in transit (though may be dropped/lost) (for any one destination) i j k

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu State-Transition Graphs n State: profile of all routers’ current routes and beliefs about their available routes n Transition: change following route selection or advertisement 8 *

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu State-Transition Graphs n State: profile of all routers’ current routes and beliefs about their available routes n Transition: change following route selection or advertisement 9 * * Zero state

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu State-Transition Graphs n State: profile of all routers’ current routes and beliefs about their available routes n Transition: change following route selection or advertisement 10 * * Zero state Stable state(s)

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu Main Proof sketch: Regions n Stable states: blue, red, … n Nonstable states: –blue if all paths lead to blue stable state –red if all paths lead to red stable state –purple otherwise 11 *

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu Proof Sketch: Confluence n Key lemma: from any purple state p, there is a (fair) path to another purple state n Proof: –If all paths to red states, p would be red –cannot have paths to both blue and red state: –=> must have path to some purple state p’ 12 a p a a b b ? a,b : different actions

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu Main result: Summary n If there are 2 or more stable states, zero state is purple n From every purple state, fair path to another purple state n Finite number of states=> must cycle sometime => BGP can oscillate on this instance! 13

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu Convergence Time n Gao-Rexford conditions –Assume: longest cust-prov chain length is α n Asynchronous model –“Phase”: each router triggered at least once n Result: reach stable solution in at most 2α+2 phases 14

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu Discussion & Future Work n Main result applies to [GSW] and other models n Average case instead of worst-case? n Compositional theory for safe policies? 15

SCHOOL OF INFORMATION UNIVERSITY OF MICHIGAN si.umich.edu n Thank you n Questions? 16