02/01/2006USC/ISI1 Updates on Routing Experiments Cyber DEfense Technology Experimental Research (DETER) Network Evaluation Methods for Internet Security Technology (EMIST) USC Information Sciences Institute  University of California, Berkeley  University of California, Davis  Penn State University Purdue University  International Computer Science Institute  Stanford Research Institute (SRI)  Network Associates  SPARTA

02/01/2006USC/ISI2 Research Objectives Realistic Internet routing experiments on Dynamics (i.e., faults, failures, & attacks) with configurable parameters Study, analyze, evaluate, & validate hypothesis/principles related to Internet routing and its security

02/01/2006USC/ISI3 Problems in Understanding the Problems Inter-Domain Routing is very hard and complex to understand…

02/01/2006USC/ISI4 The “Internet” as February 1, Autonomous Systems IP Address Prefixes announced

02/01/2006USC/ISI5 Problems in Understanding the Problems Inter-Domain Routing is very hard and complex to understand… It is really not just scalability though… –Policy/configuration –Implementation

02/01/2006USC/ISI6 Simulation versus Emulation Simulation  large-scale but might abstracting away low level characteristics. Emulation  experimenting realistic implementations and observing the “unexpected” –Implementation differences –Analyzing/interpreting the interactions –May help in accomplishing better simulation tasks in BGP.

02/01/2006USC/ISI7 Interactions/Dynamics Failures/faults/attacks Mobility/configuration/policy changes Cross-layer interactions EGP versus IGP

02/01/2006USC/ISI8 Problems in Understanding the Problems Inter-Domain Routing is very hard and complex to understand… It is really not just scalability though… –Policy/configuration –Implementation And, industry is introducing new BGP features..

02/01/2006USC/ISI9 Route Flap Damping (RFC 2439)

02/01/2006USC/ISI10 Differential Damping Penalty CISCO AS65001 CISCO 2600 AS65002 Zebra/Linux AS65006 IBM 2210 AS65003 IBM 2210 AS65004 CISCO 2514 AS65005

02/01/2006USC/ISI11 Penalty: 0 Penalty 1: 0 Penalty 2: 0 Prefix: /16

02/01/2006USC/ISI12 Penalty: ??? Penalty 1: 1000 Penalty 2: 1000 Prefix: /16

02/01/2006USC/ISI13 Penalty: 1000  2000 Penalty 1: 1000 Penalty 2: 1000 Prefix: /16 artificial delay X initial difference

02/01/2006USC/ISI14 Penalty: /+ X > 750 Penalty 1: 1000 Penalty 2: /x < 2000 Prefix: /16

02/01/2006USC/ISI15 Outbound Route Filter (ORF) Internet draft, under implementation in Cisco “ defines a BGP-based mechanism that allows a BGP speaker to send to its BGP peer a set of Outbound Route Filters (ORFs). The peer would then apply these filters, in addition to its locally configured outbound filters (if any), to constrain/filter its outbound routing updates to the speaker. ” If the peer damps a path, sends ORF to the downstream peer. So, the peer won’t receive further updates until the path is reused.

02/01/2006USC/ISI16 Penalty: 1000  2000 Penalty 1: 1000 Penalty 2: 1000 Prefix: /16 ORF

02/01/2006USC/ISI17 A Little Dampening Story SSFNetZebraCisco per prefix + per peerper prefix + per peer + per AS path

02/01/2006USC/ISI18 Penalty: 1000  2000 Penalty 1: 1000 Penalty 2: 1000 Withdraw /16

02/01/2006USC/ISI19 SSFNet Simulator “Bugs” Penalty: 1000  2000 Penalty 1: 1000 Penalty 2: 1000 Withdraw /16 Missing!!

02/01/2006USC/ISI20 SSFNET SSFNET + WD CISCO

02/01/2006USC/ISI21 SSFNET SSFNET + WD CISCO

02/01/2006USC/ISI22 ICDCS’2005 Best Paper Award SSFNET SSFNET + WD CISCO

02/01/2006USC/ISI23 Problems or Issues Damping implementation MRAI timer The Single Router AS Assumption Route Withdraw ORF

02/01/2006USC/ISI24 Collecting the Results in 2005 show IP BGP … selected prefixes per router per 1 second 1 peer (SPRINT) Full Routing Table (9MB compressed) BGP Updates (2 hours KB) updates -- MRT

02/01/2006USC/ISI25 AS-101 AS-112 AS-117 AS-114 AS-113 AS-121

02/01/2006USC/ISI26 AS 101 Multi homing ===================================================== Wed Sep 28 02:26:00 PDT 2005 ===================================================== Paths: (3 available, best #3, table Default-IP-Routing-Table) Advertised to non peer-group peers: from ( ) Origin IGP, localpref 100, valid, external Last update: Wed Sep 28 02:13: from ( ) Origin IGP, localpref 100, valid, external Dampinfo: penalty 543, flapped 1 times in 00:13:05 Last update: Wed Sep 28 02:25: from ( ) Origin IGP, localpref 100, valid, external, best Last update: Wed Sep 28 02:13:

02/01/2006USC/ISI AS-117 announced AS-121 withdrawn OASC

02/01/2006USC/ISI28 Creation and Evolution of BGP modeling SSFNet: Current Understand of The BGP Model DETER All BGP information are available Conflicts  Anomalies

02/01/2006USC/ISI29 Observation Point Data ORV/RIPE –Relatively incomplete in understanding the behavior

02/01/2006USC/ISI30 On Explaining and Model-Building the ModelAnomaly Detection Anomaly Analysis and Explanation

02/01/2006USC/ISI31 Creation and BGP model What are the event ? –Event  changes in BGP table Cause by : –OP Configuration –BGP peers –Other means, OSPF redistribute route –Event results BGP update messages How are the event related ?

02/01/2006USC/ISI32 BGP Behavior BGP Update Redistribute Policy / local pref Y N Operator OSPF Done Update

02/01/2006USC/ISI33 Mapping TIME 2D AS Topology via project to Z=0 Announce Withdraw Time 60 Time 30 Time 0

02/01/2006USC/ISI34 BGP Events: Causality and Correlation Causality Relationship among each individual BGP event (across different routers/ASes) –Critical to simply understand/correlate BGP behavior –Discovery new types of relationships (or filter/correct false causality in experiments) –Important for generating/replaying realistic BGP events Using emulation to verify the causality –Maybe also with commercial routers (e.g., Juniper)

02/01/2006USC/ISI35 Plan for the June 2006 Demo One “very interesting” defense tested.. –in a stealthy mode… Event correlation “realistic” and “comprehensive” BGP model –Many interesting examples and comparisons Still in development (not sure yet) –Using the model to examine real BGP data –What patterns should we expect from the observation points?