R-BGP: Staying Connected in a Connected World Nate Kushman Srikanth Kandula, Dina Katabi, and Bruce Maggs

BGP Convergence Causes Packet Loss When a route changes, up to 30% packet loss for more than 2 minutes [Labovitz00] Even domains dual homed to tier 1 providers see many loss bursts on a route change [Wang06] Even popular prefixes experience losses due to BGP convergence [Wang05] 50% of VoIP disruptions are highly correlated with BGP updates [Kushman06] The Problem:

Goal: Ensure ASes stay connected as long as the physical network is connected Links, Links Everywhere But Not a Path to Forward!

We Focus on Forwarding Don’t worry about BGP’s routing Ensure forwarding works by forwarding packets on pre-computed failover paths

Why Focus on Forwarding? Convergence is unlikely to be fast enough Strict timing constraints limit innovation

No BGP caused packet loss Guarantee: Our Contribution Just like BGP, each AS advertises at most one path to each neighbor Low Overhead: On link failure, we reduce disconnected ASes from 22% to Zero

What Causes Transient Disconnection?  Nobody offers Hari an alternate path MIT AT&T Pete r Hari Sprint All of Hari’s providers use him to get to MIT BGP Rule: An AS advertises only its current forwarding path

What Causes Transient Disconnection? Pete r Hari MIT AT&T Sprint Link Down Hari knows no path to MIT Hari drops Peter and AT&T’s packets in addition to his own X LOSS!

What Causes Transient Disconnection? MIT AT&T Hari Sprint Hari withdraws path Pete r AT&T and Peter move to alternate paths X

MIT AT&T Hari Sprint AT&T announces the Sprint path to Hari  Traffic flows Transient Packet Loss Pete r Hari withdraws path What Causes Transient Disconnection? AT&T and Peter move to alternate paths X

An AS advertises only its current path. It advertises an alternate only after a link fails BGP: Advertises an alternate, i.e. failover path, before a link fails R-BGP: How do failover paths solve the problem?

AT&T advertises to Hari “AT&T  Sprint  MIT” as a failover path Link Fails  Hari immediately sends traffic on failover path MIT AT&T Pete r Hari Sprint No Loss ! Failover Paths X

Two Challenges Challenge 1: Challenge 2: Minimize the number of failover paths, while ensuring an AS always has a usable path Transition from usable path to converged path without creating forwarding loops

Challenge 1: Minimize number of failover paths Claim: Just like BGP, advertise one path per neighbor, either current or failover AT&T Hari Sprint Pete r Current path Failover Path MI T Insight: Replace path advertised to downstream AS with a failover path

Lemma: Advertising Most Disjoint is equivalent to advertising all paths. Dest AT&T John Bob x Joe Which failover path should it advertise? Most Disjoint Path

When a link fails: Theorem 1: The AS upstream of down link knows a failover path if it will know a path at convergence When a link fails: Theorem 1: The AS upstream of down link knows a failover path if it will know a path at convergence Advertise to downstream AS as a failover path the path most disjoint from the current path R-BGP Rule: Challenge 1: Minimize number of failover paths

MIT AT&T Hari Sprint Hari withdraws path Pete r Challenge 2: Transition without loops X

AT&T may choose to route through Peter Peter may choose to route through AT&T Forwarding Loop! MIT AT&T Hari Sprint Pete r Challenge 2: Transition without loops LOOP! X Hari withdraws path

Hari includes Root Cause Information with the withdrawal It routes through Sprint instead Solution 2: Root Cause Information MIT AT&T Hari Sprint Pete r Hari->MIT Link down Theorem 2 : No forwarding loops will form Theorem 2 : No forwarding loops will form Challenge 2: Transition without loops AT&T recognizes the Peter->Hari->MIT path is down X

R-BGP Solution 1:Advertise most disjoint path to downstream AS Solution 2: Include Root Cause Information Final Theorem: No AS will see BGP caused packet loss if it will have a path at convergence Final Theorem: No AS will see BGP caused packet loss if it will have a path at convergence

Experimental Results

Setup AS-Level Simulation over the full Internet AS-graph with 24,142 ASes from Routeviews BGP Data Use inference algorithm to annotate links with customer-provider or peer relationships

Dual-homed AS loses one link Find percentage of ASs that see transient disconnection to the destination Run for all dual homed ASes Single Link Failure Results Destination X

Single Link Failure Results Percentage of ASes transiently disconnected 22% - BGP Zero - R-BGP R-BGP Eliminates all Transient Disconnection

Most disjoint path may not be compliant with BGP routing policies Still an AS may want to advertise it: o To protect its own traffic o Because it is temporary What if we choose most-disjoint among policy compliant paths? Cost of Policy Compliance

Percentage of ASes transiently disconnected 22% - BGP Zero - R-BGP

Policy compliant failover paths may be sufficient Cost of Policy Compliance Percentage of ASes transiently disconnected 22% - BGP Zero - R-BGP 1.4% - R-BGP: policy compliant

All proofs are for single link failure Randomly choose a second link Multiple Link Failure Results Destination X

Multiple link failures are unlikely to interact Percentage of ASes transiently disconnected 22% - BGP 0% - R-BGP 1.4% - R-BGP: policy compliant Multiple Link Failure Results

Fail link on current path Fail link on corresponding failover path Worst Case Scenario Destination Hari X X

Multiple Link Failure Results Percentage of ASes transiently disconnected 33% - BGP

Multiple Link Failure Results Percentage of ASes transiently disconnected 33% - BGP 12% - R-BGP: policy compliant

Eliminates 80% of disconnection even in the worst case of link failures on both current and failover Worst case Scenario Percentage of ASes transiently disconnected 33% - BGP 7% - R-BGP 12% - R-BGP: policy compliant

Conclusion BGP loses connectivity even when the physical network is connected R-BGP uses a few failover paths to ensure forwarding works throughout convergence o Guarantees no packet loss o Just like BGP, one path per neighbor o Reduces disconnected ASes from 22% to zero Working with Cisco on prototype feasibility

The End