Routing State Distance:A Path-based Metric for

Network Analysis

Natali Ruchansky

Gonca Gürsun, Evimaria Terzi, and Mark Crovella

Shortest Path Distance

Distance Metrics for Analyzing Routing

2

Similarly Routed

Based on this distance intuition we develop a new metric based on paths and show it is good for:

oVisualization of networks and routesoCharacterizing routesoDetecting significant patternsoGaining insight about routing

A New Metric

3

We call this path-based distance metric:

Routing State Distance

4

Conceptually…

• Imagine capturing the entire interdomain routing state of the internet in a matrix

the next hop on path from to

• Each row is the routing table of a single AS• Now consider the columns…

5

𝑵=[¿¿]SourcesDestination

s

We define between two prefixes and as the number of entries that differ in their

columns of

Routing State Distance

6

i.e. the number of ASesthat disagree about the next-hop to and .

More Formally

Given a universe of prefixes define:

A next-hop matrix : the next-hop on the path to

As well as :

7

RSD to BGP

In order to apply to measured BGP paths we define to have ASes on rows and prefixes on columns.

the next-hop from AS to prefix

8

Solution Key: is defined on a setof paths NOT a graph

A few issues arise…1. Missing Values2. Multiple next hops

Our Data

From 48 million AS paths consisting of:

359 unique monitors450K destination prefixes

We end up with:

243 sources ASes 130K prefixes

Thus our is

9

Why is appealing?Let’s take a look at its properties…

10

RSD versus Hop Distance

11

No relation between RSD and hop distance

Finer Grained Measure

Varies smoothly and has a gradual slope. Allows fine

granularity12

Increase of 1 encompasses many prefixes

1. Highly structured 2. Allows 2D

visualization

13

From compute , our distance matrix where:𝑫 (𝒙𝟏 , 𝒙𝟐)=𝑹𝑺𝑫(𝒙𝟏 ,𝒙𝟐)

Wow!

Highly structured

14

This happens with any random sample Internet-wide

Yeah, but a cluster of what!?!

Now in routing terms:o Any row in must have the

same next hop in nearly each cell

o The set of ASes make similar routing decisions w.r.t destinations

First think matrix-wise ():o A cluster corresponds to a set

of columns o Columns being close in

means they are similar in some positions

o is highly coherent

15

We call such a pair a local atom

16

Small cluster

“C”

Large Cluster

Small cluster “C”

Large cluster

A local atom is a set of prefixes that are routed similarly in some region of

the internet.

So the smaller cluster is a local atom of certain prefixes that are routed similarly

by a large set of ASes

17

For this investigate … • Prefer a specific AS for transit to these

prefixes. Hurricane Electric (HE)• If any path passes through HE :

1. Source ASes prefer that path2. Prefix appears in the smaller cluster

.

Why these specific prefixes?

Level3 Hurricane Electric Sprint

18

But why do sources always route through HE if the option exists?

….HE has a relatively unique peering policy.

Offer peering to ANY AS with presence in the same exchange point.

HE’s peers prefer using HE for ANY customer of HEAnd hence consists of networks that peer with HE,

and consists of HE’s customers

19

Analysis with uncovered a macroscopic atom

Can we formulate a systematic study to uncover other smaller atoms?

Intuitively we would like a partitioning of the prefixes such that :

oIn the same group is minimizedoBetween different groups is

maximized

Can We Find More Clusters?

20

RS-Clustering Problem

Intuition: A partitioning of the prefixes such that :oIn the same group is minimizedoBetween different groups is maximized

For a partition :

Key Advantage: Parameter Free!

21

Optimal is Hard

Finding the optimal solution to the Problem is NP-hard

We propose two approaches:Pivot Clustering

Overlap Clustering

22

Given a set of prefixes , their values, and a threshold parameter :

1. Start from a random prefix (the pivot)2. Find all that fall within distance to and

form a cluster3. Remove cluster from and repeat

Advantages:o The algorithm is fast : O(|E|)o Provable approximation guarantee

Pivot Clustering Algorithm

23

5 largest clusters

• Clusters show a clear

separation

• Each cluster

corresponds to a local

atom

24

25

Size of C Size of S Destinations

C1 150 16 Ukraine 83%Czech. Rep 10%

C2 170 9 Romania 33%Poland 33%

C3 126 7 India 93%US 2%

C4 484 8 Russia 73%Czech rep. 10%

C5 375 15 US 74%Australia 16%

Interpreting Clusters

To address this we propose a formalism called Overlap

Clustering and show that it is capable of extracting such clusters.

We ask ourselves if a partition is really

best?

26

Seek a clustering that captures overlap

Related Work• Reported that BGP tables provide an incomplete view

of the AS graph.[Roughan et. al. ‘11]

• Visualization based on AS degree and geo-location. [Huffaker and k. claffy ‘10]

• Small scale visualization through BGPlay and bgpviz

• Clustering on the inferred AS graph.[Gkantsidis et. al. ‘03]

• Grouping prefixes that share the same BGP paths into policy atoms.[Broido and k. claffy ‘01]

• Methods for calculating policy atoms and characteristics.[Afek et. al. ‘02] 2

7

Take-AwayAnalysis with typical distance metrics is hard

We introduce a new one

-- Routing State Distance – that is simple and based only on paths

Overcome BGP hurdles and show it can be used for:o In-depth analysis of BGPo Capturing closeness useful for visualizationo Uncovering surprising patternso General setting

Developed a new set of tools forextracting insight from BGP measurements

28

Code, data, and more information is available on our website at:

csr.bu.edu/rsd

29

Code• Pivot Clustering• Overlap Clustering• RSD Computation

Data• Prefix List• Pairwise RSD

Natali Ruchansky

Gonca Gürsun, Evimaria Terzi, and Mark Crovella

Thank you!!