Theoretical Bounds on Control- Plane Self Monitoring in Routing Protocols Raj Kumar Rajendran Vishal Misra Dan Rubenstein

How do Routing Protocols behave when Errors are present? Routing Protocols are fairly well understood, e.g., –Link State: reacts quickly to connectivity changes, scales well, small packets –Distance Vector (a.k.a. Bellman-Ford): simple, efficient, converges-quickly –BGP (Path-Vector): some problems in convergence when routes change, significant literature for evaluating and understanding Critical Assumption for correctness: Nodes follow the proper protocol procedure Q: What happens when some nodes don’t follow the protocol (maliciously or by error)?

Nodes do make errors The infamous BGP AS 7007 Incident: AS #7007’s Distance …… … Normal Operation paths to 8765

And can be highly disruptive The infamous BGP AS 7007 Incident: AS #7007’s Distance …… … Abnormal Operation paths to 8765

What can we do to detect such errors and prevent disruption? Traditional approach –Modify the protocol to add additional checks May not be practical due to large installed base Not clear what checks we should add Alternative approach –Clues that something is amiss may already exist –We are just not using it Does the information given to me by my neighbors make sense? Our Solution –Protocols have an inherent capacity for self-monitoring –Harness this capacity!

What can be detected without changing the protocol? Node has some information it uses for routing Dest/ Neighbor ABE A0812 B107 C7138 D596 E960 F G492 In the process of executing the protocol each node receives additional information. This is its state State can be thought of as the node’s view of the network –Eg. Distance Vector (Bellman Ford) A node can inspect its state for inconsistencies that indicate errors A B E C G F D DestDistNext Hop C7A D5A F12A G2E E.g. Distance Vector Route Information State

Inspecting one’s State for errors Q: How can a good node inspect its state for indications of errors by other nodes? –What should the node “look for”? –If an inspection is being carried out, is the node detecting everything that it can? –Note: there are (classes of) errors that are undetectable, no matter what the node does. NXY 11 D(X,Y) = 3 NXY 13 An undetectable misconfig at node N:

Prior Work: “Weak” Detection How can a node inspect its state for errors Simple approach: –Identify a property that should hold –Check if the property holds –Declare an error if a property is violated Example: –In an undirected graph, D(X,Y) = D(Y,X) Here, D(A,B) = 1 But D(B,A) = 4 –Error! Dest/ Neighbor ABE A0112 B407 C 138 D596 E964 F G492 So why is symmetry weak?

Weak Detection via Triangle Inequality [DMZ’03] No conflict of D(X,Y) = D(Y,X) Triangle Inequality (Another property) is violated: D(X,Y) + D(Y,Z) ≥ D(X,Z) –D(B,E) = 3 –D(B,A) = 1 –D(A,E) = 1 –D(B,A) + D(A,E) < D(B,E) Dest/ Neighbor ABE A011 B103 C12138 D596 E130 So symmetry is weak –Failed to detect an inconsistency observed by another method (triangle inequality)

Even the Triangle Inequality is “Weak” Suppose graph edge lengths must be 1 (hop-count) Dest/ Neighbor AB A02 B20 C31 D33 d(A,D) ≠ 3!!! How do we know if we’ve checked everything we can? AB C D No violation of symmetry or triangle inequality But still an observable misconfiguration

“Strong” Detection Bird’s Eye view of how it works –Let S n be my state (node n) –C = {N} be the set of valid networks –For each network N Run the protocol on N Resulting in state S n (N) at my node –S N ≠ S Error ! –If for some K є C, S n (K) = S Either no error (K is the actual network) Or undetectable error (no check can tell that K is not the actual network) We propose a solution called Strong Detection Definition: A detection method is “Strong” if it detects all detectable errors What network could have resulted in my state? Those two networks and this bizarre one fit. Either everything’s OK or some bozo is giving me wrong information! There were no networks. Something must be wrong G A B C n E F D G A B C n E F D G A B C n E F D G A B C n E F D G A B C n E F D G A B C n E F D G A B C n E F D G A B C n E F D G A B C n E F D G A B C n E F D G A B C n E F D G A B C n E F D G A B C n E F D G A B C n E F D G A B C n E F D

High-Complexity Strong Detection Problem The proposed Strong detection technique is computationally infeasible –The number of potential networks C={N} to check can be huge! We need to find a way to reduce the number of potential networks to check

How can self-monitoring be practically used Q: Can Strong Detection be achieved with low complexity? A: Sometimes: We show how to do it for –Bellman-Ford (a.k.a. Distance Vector) –Path-Vector

Strong Detection for D.V. Input at node n: –S n : a single node’s state table that reports each neighbor’s (supposed) distance to all nodes –Set C of all allowable networks Dest/ Neighbor ABE A0112 B407 C 138 D5912 E964 F 1513 G492 SnSn

Strong Detection in D.V. at a node, n Take node n’s state, S n Use this state to build the canonical graph, M є C Simulate D.V. on M to generate simulated state S n (M) We prove: –If S n (M) ≠ S n, then error detected –Else, either there is no error, or it is undetectable because M might be the actual network Dest/ Neighbor ABE A0112 B407 C 138 D5912 E964 F 1513 G492 Dest/ Neighbor ABE A0112 B407 C 138 D5912 E964 F 1513 G492 SnSn S n (M) G A B C E F D G A B C n E F D M n

Creating the Canonical Graph, M for an undirected network For every pair of nodes (x,y): –Create edge (x,y) with length e xy = max |d(m,x) – d(m,y)| Note: Is fully connected Dest/ Neighbor ABE A0112 B407 C 138 D5912 E964 F 1513 G492 G A C n E F D e DE =max(|5-9|,|9-6|,|12-4|} = 8 8 e EF =max(|9-12|,|6-15|,|4-13|} = 9 9 B The proof that this canonical graph is all we need to check is in the paper

Experimental Setup Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Five different networks with 50, 100,200,400 and 800 nodes –Constructed by the BRITE topology generator –The networks mimic the topology of the Internet Nodes distributed on the X-Y plane and edge-weights set to be Euclidean distance between them In each experiment a “monitor” and “liar” node were chosen with distance uniformly dist. Liar node publishes incorrect distances –About all routes –Or distance to a “target” node The monitor node attempts to detect this lie –We studied how large the lie had to be before it is detected –How the distances between monitor, liar and target affect detection

Experimental Results Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1 How big does an error have to be before it is detected As a function of the shortest-path between the monitor and liar Detectability decreases with monitor-liar distance

Experimental Results (2) Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 2 How do distances between the different node-types affect detection? –Monitor/Liar –Liar/Target –Monitor/Target Detection sensitivity most affected by Monitor/Liar distance

Path-Vector Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance We also have low complexity solutions for flavors of path- vector protocols –With hop-by-hop distances –Total distance –Incomplete information Eg. Ad-hoc protocols

Conclusion Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance Simulation 1  How big does an error have to be before it is detected?  As function of monitor-liar distance for single and multiple errors Detection is clearly function of distance We provide a technique called “Strong Detection” that detects all detectable errors We provide a practical implementation of this for the Distance Vector protocol Routing Protocols have inherent capacities to self monitor for Errors We show that Errors fall into two classes –Those that can be detected through self- monitoring –Those that cannot (whatever the method)