1. Dongkee LEE (dklee@an.kaist.ac.kr) 1 BorderGuard: Detecting Cold Potatoes from Peers Nick Feamster, et al.

2. Dongkee LEE (dklee@an.kaist.ac.kr)2Overview.  Hot/Cold Potatoes.  BoarderGuard.  Results.

3. Dongkee LEE (dklee@an.kaist.ac.kr)3 Hot potato routing  Peering contracts typically require the peer to provide consistent routes at all interconnection points. AS B can direct traffic through peering point 3.

4. Dongkee LEE (dklee@an.kaist.ac.kr)4 What’s the best route?  BGP decision process. 1.Highest local preference. 2.Lowest AS path length. 3.Lowest origin type. 4.Lowest MED (with same next-hop AS). 5.eBGP-learned over iBGP-learned. 6.Lowest intradomain path cost to egress point. 7.Lowest router ID of BGP speaker.

5. Dongkee LEE (dklee@an.kaist.ac.kr)5 Using eBGP Feeds  A network has m peer ASes, p = 1 … m and n p eBGP sessions with peer p.  r p,u – route for the prefix d determined by update message on session u, where u in [ 1, n p ]

6. Dongkee LEE (dklee@an.kaist.ac.kr)6 Using eBGP Feeds  Upon receiving an update messages on session u, Compare λ(r p,u ) to λ(r p,v ) for v in [1, n p ], where λ() is a route ranking function.

7. Dongkee LEE (dklee@an.kaist.ac.kr)7 Using iBGP Feeds  Routers(p) - set of n p routers in the AS that peer with p.  For each border router i, Import policy I i is applied to r p,i Select the best route b i = I i (r p,i ) for a destination. Distributes the route b i to other routers in the AS via iBGP.  Limitations,

8. Dongkee LEE (dklee@an.kaist.ac.kr)8 Using iBGP Feeds - Limitations  Import policy can make consistent routes appear inconsistent.  Inability to distinguish inconsistent routes from a missing route. λ(r p, 1 )= λ(r p, 2 ) I i (r p, 1 )is not I i (r p, 2 ) b1 = I i (r q,1 )

9. Dongkee LEE (dklee@an.kaist.ac.kr)9 Using iBGP Feeds  Upon receiving an update messages on session u, for each border router i, i in [1, k] : for each router j in Routers( peer(b i )) : compare λ(b j ) to λ(I j ( I -1 i (b i ) )) λ(r p, u )= λ(r p, v ) λ (I -1 u (b i )) = λ(r p, v ) λ (I j (I -1 u (b i ))) = λ (I i (r p, v ))

10. Dongkee LEE (dklee@an.kaist.ac.kr)10Results  AT&T’s commercial IP backbone.  AnalyzeeBGP from one of AT&T’s peers. iBGP from the border routers in AT&T’s net.  Assumes that AT&T’s import policies and peering sessions did not change during this period.

11. Dongkee LEE (dklee@an.kaist.ac.kr)11 How bad routes can come …  How bad routes can come from good peers ?

12. Dongkee LEE (dklee@an.kaist.ac.kr)12  The END