1. Dongkee LEE (dklee@an.kaist.ac.kr) 1 An Analysis of BGP Multiple Origin AS (MOAS) Conflicts Xiaoliang Zhao, et al.

2. Dongkee LEE (dklee@an.kaist.ac.kr)2Overview.  Motivation  Classifications of MOAS conflicts.  Results  Possible explanations for MOAS.

3. Dongkee LEE (dklee@an.kaist.ac.kr)3Motivation  The last AS in an AS path should be the origin of the BGP routes. Suppose prefix ‘d’ is associated with AS paths, asp1 = (p 1, p 2, … p n ), asp2 = (p 1, p 2, … p m ) If p n != q m : MOAS conflict occurs.  MOAS could be the result of a ‘fault’ or an ‘attack’.  What are the reason for MOAS conflicts and What are the impacts ?”

4. Dongkee LEE (dklee@an.kaist.ac.kr)4 Classification of MOAS  prefix ‘d’, asp1 = (p 1, p 2, … p n ), asp2 = (p 1, p 2, … p m )  OrigTranAS: p n = q j (j < m) AS P n announces itself as the origin AS and as a transit AS.  SplitView: p i = q j (i < n, j < m) AS P i announces different routes to different neighbors.  DistinctPaths: p n = q j (for all i in [1..n], j in [1..m] ) There are two totally different routes for the prefix ‘d’.

5. Dongkee LEE (dklee@an.kaist.ac.kr)5Results  Oregon RouteViews data.  Total Number of MOAS Conflicts. Overall 38225 conflicts were observed over 1279 days.  Duration of MOAS Conflicts. 10177 conflicts

6. Dongkee LEE (dklee@an.kaist.ac.kr)6Results  Distribution of MOAS Conflicts

7. Dongkee LEE (dklee@an.kaist.ac.kr)7Results  Distribution of MOAS classes

8. Dongkee LEE (dklee@an.kaist.ac.kr)8 Causes of MOAS conflicts – (1)  Exchange Point Addresses.  Prefix associated with an exchange point is directly reachable from all the ASes, at the exchange point.  30 out of 38225 prefixes.  Multi-homing without BGP.

9. Dongkee LEE (dklee@an.kaist.ac.kr)9 Causes of MOAS conflicts – (2)  Multi-homing with Private AS Numbers.  AS number Substitution on Egress (ASE).  Anycast addresses.  Anycast address is intended to originate from multiple ASes.  Faulty or Malicious Configurations.

10. Dongkee LEE (dklee@an.kaist.ac.kr)10  The END