1. Inferring AS Relationships

2. The Problem  One view  AS relationships  BGP route tables  The other view  BGP route tables  AS relationships  Available Internet route logs  Oregon Routeviews project  European RIPE project  One view  AS relationships  BGP route tables  The other view  BGP route tables  AS relationships  Available Internet route logs  Oregon Routeviews project  European RIPE project

3. Why Inference?  Connectivity does not imply reachability  End-to-end performance cannot be inferred from AS (connectivity) graph  Contractual agreements between ISPs are proprietary  Connectivity does not imply reachability  End-to-end performance cannot be inferred from AS (connectivity) graph  Contractual agreements between ISPs are proprietary ISP A ISP B ISP C customer

4. Annotated AS Graph Provider-to-customer Peer-to-peer Sibling-to-sibling

5. Selective Export Rule  Consider AS u and AS v  provider(u)  peer(u)  For each best route r of u, if r is a provider / peer route of u, then export(v,u)[{r}] = {}  Consider AS u and AS v  customer(u)  sibling(u)  There is a best route r of u s.t. r is a provider / peer route of u, and export(v,u)[{r}]  {}  Consider AS u and AS v  provider(u)  peer(u)  For each best route r of u, if r is a provider / peer route of u, then export(v,u)[{r}] = {}  Consider AS u and AS v  customer(u)  sibling(u)  There is a best route r of u s.t. r is a provider / peer route of u, and export(v,u)[{r}]  {}

6. Transit Implications  ASes u and v are peers iff neither u transits traffic for v nor v transits traffic for u  AS u is provider of v iff u transits traffic for v and v does not transit traffic for u  ASes u and v have a sibling relationship iff both u transits traffic for v and v transits traffic for u  ASes u and v are peers iff neither u transits traffic for v nor v transits traffic for u  AS u is provider of v iff u transits traffic for v and v does not transit traffic for u  ASes u and v have a sibling relationship iff both u transits traffic for v and v transits traffic for u

7. Routing Table Entry Information  If u 0 ’s BGP table contains route e, where e.as_path = (u 1, …, u n ), then  u i selects route with as_path (u i+1, … u n ) as best route to prefix  u i exports its best route to u i-1  If u 0 ’s BGP table contains route e, where e.as_path = (u 1, …, u n ), then  u i selects route with as_path (u i+1, … u n ) as best route to prefix  u i exports its best route to u i-1

8. Valley-free Property  AS path of BGP routing table entry has following valley-free property  A provider-customer edge can be followed by only provider-customer or sibling-sibling edges  A peer-peer edge can be followed only by provider-customer or sibling-sibling edges  AS path of BGP routing table entry has following valley-free property  A provider-customer edge can be followed by only provider-customer or sibling-sibling edges  A peer-peer edge can be followed only by provider-customer or sibling-sibling edges

9. Example Paths 2 54 3 6 1 Valley-free: (1,2,3) (1,2,6,3) Non valley-free: (1,4,3) (1,4,5,3)

10. More Routing Entry Patterns  Downhill path: a sequence of edges that are either provider-customer or sibling-sibling  Maximal downhill path: longest such path  Uphill path: a sequence of edges that are either customer-provider or sibling-sibling  Maximal uphill path: longest such path  Downhill path: a sequence of edges that are either provider-customer or sibling-sibling  Maximal downhill path: longest such path  Uphill path: a sequence of edges that are either customer-provider or sibling-sibling  Maximal uphill path: longest such path

11. BGP Path Patterns  An uphill path  A downhill path  An uphill path followed by a downhill path  An uphill path followed by a peer-peer edge  A peer-peer edge followed by a downhill path  An uphill path followed by a peer-peer edge, which is followed by a downhill path  An uphill path  A downhill path  An uphill path followed by a downhill path  An uphill path followed by a peer-peer edge  A peer-peer edge followed by a downhill path  An uphill path followed by a peer-peer edge, which is followed by a downhill path

12. Heuristic Inference Alogrithm  Provider typically has a larger size than its customer  Size of AS is typically proportional to its degree in AS graph  The uphill (downhill) top provider of an AS path should be the AS with highest degree among all ASes in its maximal uphill (downhill) path  Top provider is the AS with higher degree between the uphill and downhill top providers  Provider typically has a larger size than its customer  Size of AS is typically proportional to its degree in AS graph  The uphill (downhill) top provider of an AS path should be the AS with highest degree among all ASes in its maximal uphill (downhill) path  Top provider is the AS with higher degree between the uphill and downhill top providers

13. Inference Algorithm (cont’d)  Consecutive AS pairs that appear before the top provider in the AS path are customer- provider or sibling-sibling edges  Consecutive pairs that appear after the top provider in the AS path are provider- customer or sibling-sibling edges  Pairs of top provider and top provider’s neighbor are the peer-peer edges  Consecutive AS pairs that appear before the top provider in the AS path are customer- provider or sibling-sibling edges  Consecutive pairs that appear after the top provider in the AS path are provider- customer or sibling-sibling edges  Pairs of top provider and top provider’s neighbor are the peer-peer edges

14. Provider-customer and Sibling Relationships  Given AS path, find top provider  Consecutive AS pairs before top provider are customer- provier or sibling-sibling edges  If (u 1,u 2 ) appears, then u 2 provides transit for u 1  Consecutive pairs after top provider are provider- customer or sibling-sibling  If (u 1,u 2 ) appears, then u 1 provides transit for u 2  u 1 is provider of u 2 iff u 1 provides transit for u 2 but u 2 does not provide transit for u 1  AS pair have sibling relationship if they provide transit for each other  Given AS path, find top provider  Consecutive AS pairs before top provider are customer- provier or sibling-sibling edges  If (u 1,u 2 ) appears, then u 2 provides transit for u 1  Consecutive pairs after top provider are provider- customer or sibling-sibling  If (u 1,u 2 ) appears, then u 1 provides transit for u 2  u 1 is provider of u 2 iff u 1 provides transit for u 2 but u 2 does not provide transit for u 1  AS pair have sibling relationship if they provide transit for each other

15. Basic Algorithm  Given BGP routing tables, run in three phases  Phase 1: compute the degree for each AS  Phase 2: parse AS path to initialize consecutive AS pair’s transit relationship  Phase 3: assign relationships to AS pairs based on transit results  Given BGP routing tables, run in three phases  Phase 1: compute the degree for each AS  Phase 2: parse AS path to initialize consecutive AS pair’s transit relationship  Phase 3: assign relationships to AS pairs based on transit results

16. Refined Algorithm  Basic algorithm may misclassify if some BGP speakers are misconfigured  E.g., configured to provide transit between two providers  Assume that the fraction of misconfigured BGP speakers is small  Count the number of routing table entries that infer a transit relationship  Confirm transit only of number exceeds threshold L  Basic algorithm may misclassify if some BGP speakers are misconfigured  E.g., configured to provide transit between two providers  Assume that the fraction of misconfigured BGP speakers is small  Count the number of routing table entries that infer a transit relationship  Confirm transit only of number exceeds threshold L

17. Peering Relationships  At most one peer-to-peer link on each path  Top provider either peers with its left neighbor or right neigbor in the path  Three phases  Phase 1: classify the provider-customer and sibling relationships  Phase 2: identify AS pairs that may have a peering relationship  Neighbor of top provider in an AS path, not a sibling of the provider, and has higher degree than the other neighbor if neither neighbor of the top provider is a sibling  Phase 3: confirm candidate AS pairs by checking for “similar” degrees of the two ASes in a pair  At most one peer-to-peer link on each path  Top provider either peers with its left neighbor or right neigbor in the path  Three phases  Phase 1: classify the provider-customer and sibling relationships  Phase 2: identify AS pairs that may have a peering relationship  Neighbor of top provider in an AS path, not a sibling of the provider, and has higher degree than the other neighbor if neither neighbor of the top provider is a sibling  Phase 3: confirm candidate AS pairs by checking for “similar” degrees of the two ASes in a pair