Isolario: the real-time Internet routing observatory Alessandro Improta Luca Sani alessandro.improta@iit.cnr.it luca.sani@iit.cnr.it 1/40
What we aim to do Research field Internet inter-domain measurement and analysis Why? - 1969 - ARPANET - 1985 - NSFNET - 1995 - Commercial Internet Since then, its real structure became hidden, as well as its potential structural weaknesses 2/40
Why is it important to reveal the Internet structure? To understand how packets are routed in the Internet Identify routes involving non-national ISPs Identify the importance of each AS in the ecosystem Understand the effects of catastrophic events (or malicious attacks) To create economy-based models of the global Internet growth Study the effectiveness of p2p connections Build more realistic topology generators to simulate the Internet To properly select peers and diversify upstream providers based on their connectivity Increase network robustness Select data centers for server replicas ... 3/40
Why is it important to reveal the Internet structure? ... plan an optimal inter-domain network configuration to maintain an acceptable level of service in case of malicious or unintentional faults 4/40
The AS-level abstraction Example of ASes Interconnected ASes AS 137 GARR AS 2598 Isolario AS 15169 Google AS 16667 MGM Resorts Intl AS 21115 Nestl´ e Italia AS 38474 AU Government (Antarctic Division) Why the AS-level? The AS-level Internet ecosystem is a gold mine of problems whose solutions can provide a deep understanding of critical issues (e.g., resilience, behavior under real-world threats, future evolution) [1] [1] M. Roughan et al., 10 Lessons from 10 Years of Measuring and Modeling the Internet’s Autonomous Systems , JSAC 2012 5/40
Classic BGP route collector concept A Route Collector (RC) is a device which collects BGP routing data from co-operating ASes RCs only collect routing information and not user traffic 6/40
BGP route collector projects University of Oregon Route Views Project Route Views was originally conceived as a tool for Internet operators to obtain real-time information about the global routing system from the perspectives of several different backbones and locations around the Internet. It collects BGP packets since 1997, in MRT format since 1997 http://www.routeviews.org RIPE NCC Routing Information Service (RIS) The RIPE NCC collects and stores Internet routing data from several locations around the globe, using RIS. It collects BGP packets in MRT format since 1999 https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris Packet Clearing House (PCH) PCH is the international organization responsible for providing operational support and security to critical Internet infrastructure, including Internet exchange points and the core of the domain name system. It operates route collectors at more than 100 IXPs around the world and its data is made available in MRT format since 2011 https://www.pch.net/resources/Raw Routing Data 7/40
BGP Route Collector Status (Oct 2016) Total N. of RC 19 17 123 159 N. of v4 feeders 281 358 1887 2526 N. of v6 feeders 197 228 1148 1573 8/40
Feeder Contribution (v4) 1 0.8 0.6 P(X>x) 0.4 RouteViews 0.2 RIS PCH 0 10 0 10 1 10 2 10 3 10 4 10 5 10 6 10 7 10 8 10 9 10 10 x = Number of IP addresses Only 343 IPv4 feeders announce to the RCs their full routing table 9/40
Feeder Contribution (v6) 1 0.8 0.6 P(X>x) 0.4 RouteViews 0.2 RIS PCH 0 10 0 10 5 10 10 10 15 10 20 10 25 10 30 10 35 x = Number of IP addresses Only 267 IPv6 feeders announce to the RCs their full routing table 10/40
Full feeder geographical distribution Data collected represent mostly the Internet as viewed from Europe and North America than the real Internet 11/40
Feeder characterization About 80% of full feeders have a degree higher than 100 12/40
Conclusions on data analysis Conclusions Several p2p-connectivity is hidden from RC sight Several Internet regions are basically uncovered The typical profile of an ideal feeder is a multi-homed stub AS Questions Why there is a scarcity of participation to classical route collector projects? How to attract new participants? Is it just a case poor “marketing”? 13/40
Isolario project Objective: push more ASes to join The more the ASes, the more the completeness of public BGP data Isolario - The Book of Islands ”where we discuss about all islands of the world, with their ancient and modern names, histories, tales and way of living...” Benedetto Bordone (Italian cartographer) Approach: Do-ut-des Participants open a BGP session with Isolario providing the BGP full routing table and its evolution over time In change, Isolario offers real-time and historic analysis applications based on the aggregation of every routing information collected 14/40
Data we plan to provide to research community MRT data (same format as RIPE RIS, Route Views, · · · ) 1 RIB feeder snapshots every 2 hours 2 UPDATE collections every 5 minutes https://isolario.it/Isolario_MRT_data/ Periodic analyses (daily, weekly, monthly, · · · ) 1 AS-level Topologies (Global and Geographic) 2 AS characteristics 3 Feeder contribution 4 Total coverage of RCs 15/40
Enhanced BGP Route Collector Incoming flows are duplicated as soon as they arrive and feed both the Interactive Collecting Engine (ICE) and service modules As usual, RCs only collect routing information and not user traffic 16/40
Isolario system overview Incoming BGP flows are used as real-time streams for services dedicated to participants Results are provided to users via WebSockets 17/40
Isolario free services for feeders Every feeder has free access to a set of services tailored to monitor and analyse BGP data coming into Isolario system Historic services Real-time services Routing table viewer BGP flow viewer Subnet reachability Routing table viewer Diagnostic services Website reachability Alerting system Subnet reachability Daily report 18/40
Real-time services Real-time services allow to monitor BGP data flowing into Isolario system 19/40
Routing table viewer Allows to analyse in real-time the routes that a feeder is currently announcing to Isolario to reach a portion of the IP space 20/40
BGP flow view Allows to monitor the flow of BGP UPDATE packets arriving to Isolario Reports in real-time flapping events occuring on any subnet advertised into the flow 21/40
Subnet reachability Allows to analyse in real-time the routes that every Isolario feeder is announcing to Isolario to reach a portion of the IP space The more the feeders, the more SR is useful! 22/40
Isolario real-time visualisation with BGPlay BGPlay is an open-source tool for the visualisation of BGP routing Thanks to the close collaboration with Massimo Candela (RIPE NCC) we integrated in Isolario the BGPlay real-time version ( http://bgplay.massimocandela.com ) BGPlay is currently integrated in SR 23/40
BGPlay real-time http://bgplay.massimocandela.com 24/40
Diagnostic services Diagnostic services exploit incoming BGP flows and/or historic data to report anomalies of the inter-domain routing status 25/40
Alerting system Alerting system BGP attributes: BGP UPDATEs matching attributes of interest Flap events: a prefix UPDATE rate is larger than a threshold Hijack attempts: BGP UPDATEs hijacking a feeder subnet Prefix reachability: (un)reachability of prefixes of interest 26/40
Daily report Summary about the feeder inter-domain routing status as perceived by the Isolario system For example... Routing statistics #Announce, #Withdrawn Most (un)stable prefixes Reachability statistics Inbound reachability BGP attributes statistics AS path anomalies 27/40
Daily report: Summary of statistics 28/40
Historic services Historic services exploit every BGP data available (Route Views, RIPE NCC RIS, Isolario) to show how routes evolved in the past 29/40
Historic services Applications Routing table viewer: Allows to analyse portion(s) of the routing table that each feeder announced to Isolario Subnet reachability: Allows to analyse the reachability of the IP space portions from every feeder available in the past 30/40
Summary: how to use Isolario? Real-time services Historic services Something is happening Something happened How is my RIB(s) evolving? How was my RIB(s) evolving? How is my reachability affected? How was my reachability affected? Alerting System Something is happening NOW! Check real-time services! Do something! (if needed) Daily report Did something happen yesterday? Check historic services! Do something! (if needed) 31/40
Summary: how to use Isolario? Real-time services Historic services Something is happening Something happened How is my RIB(s) evolving? How was my RIB(s) evolving? How is my reachability affected? How was my reachability affected? Alerting System Please, try Isolario real-time services! Something is happening NOW! Check real-time services! https://www.isolario.it Username: guest Do something! (if needed) Password: guest Daily report Did something happen yesterday? Check historic services! Do something! (if needed) 32/40
Recommend
More recommend
