1. An Analysis of BGP Convergence Properties
Fernando Sanchez
Florida State University
An Analysis of BGP Convergence Properties

2. BGP Convergence Problem
No guarantee of globally reasonable polices
As opposed to RIP-like protocols, BGP can diverge due to polices implemented on each AS
Two ways to address
Dynamically: prevent oscillation on run- time (route flap dampening)
Statically: analyze routing polices to guarantee no oscillations

3. Objectives
Explore worst-case complexity of static analysis of BGP routing policies
Show complexity of particular problems:
Reachability
Asymmetry
Solvability
Single Destination Solvability
Uniqueness
Robustness

4. Abstract Model of BGP Simpler abstraction
Network addresses are flat space
Ignores attributes: MED, ORIGIN, AGGREGATE, etc
At most one link between peer AS
Ignore iBGP completely
No Default route
Each destination is generated at a single AS
One global default value for LOCAL PREFERENCE

5. Network Routes Model of undirected graph G = (V, E) V -> AS
E -> links between AS
Route announcements
nlri : network layer reachability information (destination)
next_hop : next hop
as_path : list of vertices traversed (list of AS)
loc_pref : local preference (internal to each AS)
Default loc_pref value dlp

6. Best Route Selection
If r1.loc_pref != r2.loc_pref then select ri with highest loc_pref
If length(r1.as_path) != length(r2.as_path) then pick the shortest as_path
Else, ri with lowest next_hop

7. Route Record Transformations
Two types of transformation
Path-vector Transformations PVT(w<-v)[R]
Enforces
as_path record
loc_pref are not passed
Vertex v does not accept an as_path which contains v
Transformation policies
import(v<-w)[R] and export(v->w)[R]
List of policy rules
Hi => Ai
17 Є as_path => reject
as_path = [12, ?, 16] => loc_pref := dlp +1
true => loc_pref := dlp

8. Evaluation States
Cio represents the initial state, r.as_path is empty and next_hop is undefined
r1 Є ci0 and r2 Є cj0 r1.nlri != r2.nlri
A tuple <c0, c1, ... , cn> where ci is a set of route records that represents the contents of AS i in this state
An empty set represents a initial state where any AS i has not learned or accepted any route

9. Dynamic Behaior
A node i Є V is activated when it can compute its best routes based on the routes from neighboors
Transition relationships allow to move from one state to another one based on the selection route rules

10. Evaluation Graph
Eval(S) is an directed graph where each vertex represents a state s, and there exist a edge from s to s' if there exists a transition relationship that takes from state s to s'
When the system state does not change regardless of any number of Ass that are activated, then it reaches a final state
A system S is solvable if there exists at least one final state

11. BGP Anomalies

12. BAD GADGET
Each AS prefers counter-clockwise route of length 2

13. BAD GADGET (cont)
BAD GADGET does not have a solution

14. SURPRISE
Solvable system but vulnerable on link failures
For AS 3:

15. DISAGREE
Has multiple solutions

16. DISAGREE (cont)

17. Complexity Show the complexity of various BGP properties: Reachability
Asymmetry
Solvability
Unsolvability
Solvability (SD)
Unsolvability (SD)
Trapped
K-Robust
Unique
Unique (SD)
Multiple
Multiple (SD)

18. Complexity (cont)
Reduction to 3-SAT
ASSIGN BGP system

19. ASSIGN Each assignment X corresponds to a path from z to w
Each path from z to w corresponds to a unique assignment X
If xi is in the as_path, xi is not in the path
Once a route is chosen, it can be locked in and not change

20. Reachability Reduction
Given a state s, it can be check in polynomial time if it is a final state. We can then check verify that node v has a path to d on state s
Build an instance of 3-SAT using ASSIGN

21. Reachability Reduction (cont)
Each Ci = li,1 V li,2 V li,3 for 2 ≤ i ≤ m :
import(Ci <- Ci-1)
import(C1 <- z)

22. What does this mean?
Simplified model allows to proof the complexity of BGP properties compared to real-world BGP
Provide lower bounds for the complexity
There are two main problems with static analysis:
Policies are not always available among peers
Checking for solvability of real-world BGP systems is NP-complete

23. What does this mean? (cont)
Dynamic analysis
Flap dampening does not solve the problem
Possible solution
Modify BGP protocol to carry information to detect policy conflicts, that can identify when oscillations are produced because policies or because link failures
Problems:
Such an extension should be scalable, robust, and compatible with aggregation
Lack of characterization of policy inconsistencies