1. bgpmon BGP Monitoring System Dave Matthews Yan Chen He Yan Dan Massey Colorado State University

2. 25 June 2006NANOG40 - bgpmon BGP Monitoring Objectives Software Dedicated to BGP Monitoring −Establish peering session −Receive updates −Maintain RIB-IN tables −Provide easy real-time access to data But this software exists….. −Zebra and Quagga are widely used

3. 35 June 2006NANOG40 - bgpmon So Yet Another BGP Package? Didn’t Add BGP Complexity To Code −No route selection, no policy, no forwarding, etc. −Resulting code is extensible Did Add Monitoring Related Features −Periodic route refresh to keep monitor in sync −Objective labels to the data Can peer with very large number of routers Did Focus on Scaling −Chain bgpmon to monitor 100’s of peers User interface can still appears as single BGPmon −Can chain bgpmon to provide robust protection against failures Did Add New XML Log Format

4. 45 June 2006NANOG40 - bgpmon BGPMon Architecture

5. 55 June 2006NANOG40 - bgpmon Chaining Together BGPMons

6. 65 June 2006NANOG40 - bgpmon Scaling Features and Chaining BGPmon stores one RIB-IN for each peer −Updates are transient and written to logs/clients −RIB-IN dominates memory and limits scaling BGPmon chains distribute RIB-Ins −Each BGPmon provides update flow from each peer −Each BGPmon appears to provide RIB-IN for each peer In fact only stores RIB-IN for directly connected peers When user requests RIB-IN from a BGPmon, it acts as a proxy and fetches the RIB-IN from the appropriate BGPmon in chain

7. 75 June 2006NANOG40 - bgpmon Chaining Together BGPMons No RIB-IN stored here! Can instead focus resources on client requests

8. 85 June 2006NANOG40 - bgpmon Log Format Issues Started with MRT format −Following RIPE, RouteViews, etc. −But encountered some issues…. ASCII or Binary? −Binary is compact, but clearly not human readable −MRT->ASCII adds extra step and may lose some information Hard to extend format −Add flag to indicate if peering session encrypted? −Add some annotations the data to indicate duplicates? −Natively support new attributes?

9. 95 June 2006NANOG40 - bgpmon XML 2007-03-22T19:00:07Z 65001 129.82.138.4 65009 129.82.47.109 65001 14041 3356 22351 129.82.138.4 82.206.163 /message>

10. 105 June 2006NANOG40 - bgpmon XML Format Human Readable Also Feeds Into Many Applications Trivial to extend using new tags Choice of tags allow bit for bit reconstruction of update if desired Unknown attributes simply displayed in hex. Can automatically annotate to mark events −BGPmon can mark duplicate updates, AS path changes, etc. But clearly pay a storage cost −Compact binary message is expanded into ASCII with Tags!

11. 115 June 2006NANOG40 - bgpmon XML Storage Costs FormatRaw (Bytes) /MRT sizeCompres sed /MRT size XML15,606,61 6 7.7243,4051.46 bgpdump5,742,0392.8243,1071.46 MRT2,024,6141.0167,0501.00

12. 125 June 2006NANOG40 - bgpmon Status Versions running since December −monitor several routers −serviced 20 simulanteous clients Got Peers? −Interested in testing with additional feeds −Contact Dan Massey (massey@cs.colostate.edu)massey@cs.colostate.edu Software release for late summer −Want to complete more testing with larger feeds −http://netsec.colostate.eduhttp://netsec.colostate.edu XML Log Format Specification in Progress

13. 135 June 2006NANOG40 - bgpmon Questions?

14. 145 June 2006NANOG40 - bgpmon Key Features real-time feed for clients scalability (peers and clients) XML

15. 155 June 2006NANOG40 - bgpmon Clients bgpmon architecture MonitorRIBXMLClients Message Log Table Dump Rib In Tables

16. 165 June 2006NANOG40 - bgpmon multi-bgpmon architecture bgpmon