cleanbgp: verifying the consistency of bgp dataeugeneng/inm08/presentations/flavel.pdfrecorded data...
TRANSCRIPT
![Page 1: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/1.jpg)
Ashley Flavel Olaf Maennel
Belinda Chiera Matthew Roughan
Nigel Bean
CleanBGP: Verifying the Consistency of BGP Data
![Page 2: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/2.jpg)
Why is BGP Data Important?
Route Monitor
![Page 3: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/3.jpg)
Why is BGP Data Important?
Route Monitor
![Page 4: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/4.jpg)
Why is BGP Data Important?
Route Monitor
![Page 5: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/5.jpg)
Why is Accurate BGP Data Important?
Route Monitor
![Page 6: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/6.jpg)
How Can We Check the Accuracy?
Route Monitor
![Page 7: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/7.jpg)
CleanBGP
Route Monitor
![Page 8: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/8.jpg)
Data Sources • Tables
– Current route of monitored router to all possible destinations (prefixes)
– Periodically written to disk • RIPE (8 hours) • RouteViews (2 hours)
• Updates – BGP is incremental protocol
• No periodic retransmission of routes • Generally small fraction of routes in table updated in a short
interval – Except when a BGP session is first being established
![Page 9: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/9.jpg)
The Border Gateway Protocol
0
1
2
3
4
5
6 [0]
[1 0]
[2 0]
[3 0]
[4 1 0]
[5 3 0]
[6 4 1 0]
[6 4 1 0]
![Page 10: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/10.jpg)
BGP Session Failures
0
1
2
3
4
5
6 [0]
[1 0]
[2 0]
[3 0]
[4 1 0]
[5 3 0]
[6 4 1 0]
[6 4 1 0]
![Page 11: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/11.jpg)
BGP Session Failures
0
1
2
3
4
5
6 [0]
[1 2 0]
[2 0]
[3 0]
[4 1 0]
[5 3 0]
[6 4 1 0]
[6 4 1 0]
![Page 12: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/12.jpg)
BGP Session Failures
0
1
2
3
4
5
6 [0]
[1 2 0]
[2 0]
[3 0]
[4 2 0]
[5 3 0]
[6 4 1 0]
1 2 0
[6 4 1 0]
![Page 13: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/13.jpg)
BGP Session Failures
0
1
2
3
4
5
6 [0]
[1 2 0]
[2 0]
[3 0]
[4 2 0]
[5 3 0]
[6 4 1 0]
4 2 0
4 2 0
[6 4 1 0]
![Page 14: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/14.jpg)
BGP Session Failures
0
1
2
3
4
5
6 [0]
[1 2 0]
[2 0]
[3 0]
[4 2 0]
[5 3 0]
[6 5 3 0]
[6 4 1 0]
![Page 15: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/15.jpg)
BGP Session Failures
0
1
2
3
4
5
6 [0]
[1 2 0]
[2 0]
[3 0]
[4 2 0]
[5 3 0]
[6 5 3 0]
6 5 3 0
6 5 3 0
[6 5 3 0]
![Page 16: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/16.jpg)
Recorded Data
Data Consistency • The BGP table is the construction of the last update for each
prefix. – A table at t1 plus updates in the interval [t1,t2] is equivalent to the
table at t2. • In the recorded data this is not always the case!
time t1 t2
Constructed Table
![Page 17: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/17.jpg)
Measurement Artifact 1
0
1
2
3
4
5
6 [0]
[1 0]
[2 0]
[3 0]
[4 1 0]
[5 3 0]
[6 4 1 0]
6 4 1 0
6 4 1 0
![Page 18: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/18.jpg)
Measurement Artifact 1
0
1
2
3
4
5
6 [0]
[1 0]
[2 0]
[3 0]
[4 1 0]
[5 3 0]
[6 4 1 0]
6 4 1 0
[? ?]
![Page 19: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/19.jpg)
Measurement Artifact 1 • Monitoring Session Reset
– During downtime, no updates recorded – After session reset all routes currently in the table are re-advertised
Recorded Data
DOWNTIME time t1 t2
Actual Activity
![Page 20: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/20.jpg)
Measurement Artifact 1 • Monitoring Session Reset
– During downtime, no updates recorded – After session reset all routes currently in the table are re-advertised
Recorded Data
Constructed Table
time t1 t2
Actual Activity
![Page 21: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/21.jpg)
Measurement Artifact 2
0
1
2
3
4
5
6 [0]
[1 0]
[2 0]
[3 0]
[4 1 0]
[5 3 0]
[6 4 1 0]
6 4 1 0
6 4 1 0
[6 4 1 0]
[? ?]
![Page 22: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/22.jpg)
Measurement Artifact 2 • Update Re-ordering
– ‘Almost simultaneous’ updates either • recorded in incorrect order; or
time t1 t2
Recorded Data
Actual Activity
![Page 23: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/23.jpg)
Measurement Artifact 2 • Update Re-ordering
– ‘Almost simultaneous’ updates either • recorded in incorrect order; or • applied to table in the incorrect order
– Serious consequences when software router used as operational router – Invalid state!
time t1 t2
Recorded Data
Actual Activity
![Page 24: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/24.jpg)
Other Measurement Artifacts • Missing Updates
– Hardware issues prevent all updates being written to data warehouse
• Incomplete Table – The table is not written completely to data warehouse
time t1 t2
Recorded Data
Actual Activity
![Page 25: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/25.jpg)
Evidence of Measurement Artifact • What do we see in the data?
– Constructed table differences – Almost simultaneous updates – No routing activity for extended period – Burst of routing announcements – State Information
• Some data sources have session UP/DOWN meta-data. – Oldest prefix in table
• During a session re-establishment ALL prefixes are re-announced. • When a session reset definitely did not occur • When a session reset may have occurred
• Predict the cause of an inconsistency based on evidence
![Page 26: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/26.jpg)
Detection of Measurement Artifact • Inconsistency in Constructed and Recorded
Table – A session reset may not cause an inconsistency!
• No withdrawals may occur during downtime • Still an artifact
– Re-establishment phase updates
• Sliding window on update timeseries – Threshold of duplicates or unique prefixes – Downtime
• Hold-time a good threshold when `keep-alives’ recorded
![Page 27: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/27.jpg)
Localization of Measurement Artifact • Update timeseries split into bins • Find group of suspicious bins around detected time
– Include single ‘normal’ bins – Detected time one bin either side of group – Captures multiple resets in one interval
• A bin is suspicious if – No updates – Large number of unique prefixes – Large number of duplicates
• Conservative detection/localization provides confidence in data!
S S S S S S S S S time
Measurement Artifact Interval
![Page 28: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/28.jpg)
Cleaning Data • Exclusion
– Exclude the data affected from further analysis – Recommended
• Estimation – What actually happened?
• Remove duplicates during measurement artifact interval • Place updates where appropriate
– Table provides some help here – Mark the updates which we introduce/remove
![Page 29: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/29.jpg)
What Did We Find? • Analyzed several RIPE monitors for several
months – Inconsistent data in about 5% of tables – 81% of inconsistencies caused by re-ordered
updates! – Session resets contributed 10% of inconsistencies
• Much more frequent detection when no inconsistency • State information for validation
– Almost an hour on Jan 21, 2007 where no updates are recorded
• Not caused by a session reset
![Page 30: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/30.jpg)
Summary • Important to validate your data! • Cross-checking provides an increased
level of confidence in data • Developing a tool based on these results
– Including automatic threshold setting
![Page 31: CleanBGP: Verifying the Consistency of BGP Dataeugeneng/inm08/presentations/Flavel.pdfRecorded Data Data Consistency • The BGP table is the construction of the last update for each](https://reader034.vdocument.in/reader034/viewer/2022051814/6039a02df960573cd7359223/html5/thumbnails/31.jpg)
Summary • Important to validate your data! • Cross-checking provides an increased
level of confidence in data • Developing a tool based on these results
– Including automatic threshold setting • I’m looking for a job