1 Validating Replica Streams - - PDF document

1

Advanced Technology Laboratories Advanced Technology Laboratories

1

Detection and Analysis of Routing Loops in Packet Traces

IMW 2002 Urs Hengartner, Sue Moon, Richard Mortier, Christophe Diot

Advanced Technology Laboratories Advanced Technology Laboratories

2

Link Utilization

Routing loop causes traffic increase by 25%! Internet backbone link

Advanced Technology Laboratories Advanced Technology Laboratories

3

Contributions

• Offline algorithm for detecting routing

loops in Internet traffic traces.

• Results of applying algorithm to

backbone traffic traces.

– How often do routing loops occur? – How long do they last? – How many packets do they affect? – Not: Why do they occur?

Advanced Technology Laboratories Advanced Technology Laboratories

4

Loop Detection

• How can we detect routing loops when

looking at packets forwarded by a router?

Look for identical packets with decreasing TTL values! Replica Stream

Advanced Technology Laboratories Advanced Technology Laboratories

5

Loop Detection

Routing loop Merged Replica Stream Replica streams Merged replica stream approximates routing loop! Packets

• ✁

Advanced Technology Laboratories Advanced Technology Laboratories

6

Detecting Replica Streams

• Replica stream:

Single looped packet crossing a link multiple times.

• Packets P and Q are part of the same

replica stream if

– P = Q, except TTL and checksum fields – TTLP – TTLQ ≥ ≥ ≥ ≥ 2.

2

Advanced Technology Laboratories Advanced Technology Laboratories

7

Validating Replica Streams

• Goal: Discard streams not caused by routing

loops.

• Verify that all packets to the same destination

address prefix (/24) create replicas.

• ✁

• ✁

• ✁

Advanced Technology Laboratories Advanced Technology Laboratories

8

Merging Replica Streams

• Goal: Merge replica streams likely to be

due to the same routing loop.

• Merging of replica streams with identical

destination address prefixes

– that overlap in time, or – that occur less than one minute apart (no not-looped packets to same prefix in- between).

Advanced Technology Laboratories Advanced Technology Laboratories

9

Packet Traces

• Traces collected from links in Sprint’s

tier-1 Internet backbone.

• Collection dates:

Nov 8, 2001 and Feb 3, 2002.

• Link capacities:

OC-12 (622 Mbps) links.

• Each link connects two different ASs.

Advanced Technology Laboratories Advanced Technology Laboratories

10

Packet Traces

On average, loops do not affect much traffic, but…

0.026% 1.687% 0.118% 4.839% Packets Looped 1568 1350 11 Backbone 4 1485 20 11 Backbone 3 413 1 677 7.5 Backbone 2 852 50 24 Backbone 1 Loops Total (106)

(hours)

Routing Packets Length Trace

loops occur in bursts and can affect up to 25% of packets!

Advanced Technology Laboratories Advanced Technology Laboratories

11

Loop Size

Loop size corresponds to TTL delta.

Most loops have size of 2

Advanced Technology Laboratories Advanced Technology Laboratories

12

Traffic Types (Backbone 2)

3

Advanced Technology Laboratories Advanced Technology Laboratories

13

Reasons for Increases

• TCP SYN traffic

– End point tries to open connection, sends SYN. – SYN loops and expires, no other packets are sent.

• UDP traffic

– UDP is connectionless, no feedback from receiver. – Sending application is oblivious of loop.

• ICMP traffic

– Caused by “traceroute” and “ping”. – People are exploring loop. Observations confirm presence of loops!

Advanced Technology Laboratories Advanced Technology Laboratories

14

Routing Loop Duration

> 60% of routing loops last less than 10s

Advanced Technology Laboratories Advanced Technology Laboratories

15

Conclusions

• Routing loops can be detected and

analyzed in packet traces.

• On the average, loops affect few

packets.

• Loops are typically 2 hops and persist

for <10 seconds.

• More detailed explanations require

extending data collection techniques to include “complete” routing messages.