6.898 Advanced Topics in Service Provider Networking. Final Paper. Durga Prasad Pandey May 14, Instructor: Dr Bruce Davie

Transcription

1 6.898 Advanced Topics in Service Provider Networking Final Paper Durga Prasad Pandey May 14, 2007 Instructor: Dr Bruce Davie

2 Paper 1: Defending Against BGP Prefix Hijacking 1. Summary BGP Prefix Hijacking is a serious problem when a router, either intentionally or unwittingly, originates a route to an IP prefix not owned by it. Malicious BGP routers could do this for reasons such as using the stolen identities to launch spam and DDoS attacks without getting identified, or disrupting the reachability of the hosts legitimately numbered with those set of IP addresses. There is at least one instance (reference [9] in paper) of a network operator s BGP router originating routes to prefixes it didn t own without having intended to, apparently because of some fault in the router. Irrespective of the cause of prefix hijack, it is a serious problem and needs immediate redressal. Mao et al (reference [18] in paper) have made a good start in this area by developing practical techniques to detecting prefix hijacking attacks in real time. This paper is a logical next step to Mao s work and nicely complements it. It proposes an approach to mitigating the effect of prefix hijacking using two novel techniques: Route purging/promotion based mitigation, and NoSub-based subprefix hijack prevention. Route purging derives its power by purging bogus routes from Lifesaver ASes on detecting a prefix hijack, which are a predetermined set of Tier-1 ISPs so they have a high degree of connectivity and are closer to most other ASes. This is followed by the selection of a promoter AS from the lifesaver ASes that promotes a legitimate route to the victim. The promoter AS makes the new route more attractive by essentially shortening it, using an AS set for route aggregation. This is the direct opposite of appending one s AS to a route several times, which is a common practice among ASes to make a route low priority. The selection of the promotion AS is done after a hijack is detected, and can be based on different strategies such as the nearest distance to the attacker AS, or the farthest from the victim AS or random, or the random selection from a tier-2 lifesaver, if any The second technique deals with subprefix hijacking, where attackers hijack subprefixes, which is a deadlier attack because of the practice of choosing BGP routes using longest prefix matching. The authors present a technique that involves tagging prefix route announcements as NoSub, if there are no legitimate route announcements for subprefixes of those prefixes. So when a route announcement is received from an AS for such an illegitimate subprefix, the hijack is detected, and the AS purges the bogus route and lowers the priority of prefix announcements from that neighbor which might have been used to propagate the attack.

3 This paper sheds light on how DDoS attackers might hijack prefixes to launch attacks while concealing their identity, as was discussed in class using Barford et al s work on Botnets, and Mao et al s work on analyzing large DDoS attacks. 2. Strengths: What struck me as neat about the paper are the following: - The combined strategy for hijack mitigation using route purging + promotion. Route purging by itself significantly reduces pollution, but promotion boosts up the effect by offering an attractive alternative to the polluted route. The analysis of various ways of selecting promoters also fascinated me, and it was insightful to see the results of the tradeoff between maximizing connectivity for purge and resilience for promotion. - The approach is simple and has no reliance on strong cryptography, unlike some other work in this area, thus avoiding the problem of computational overhead. - The comparison between the pure and profit driven models is striking, though it was a little disappointing to see that the profit driven model is actually less resilient. The real world is profit driven however, and hence its inclusion and analysis is appropriate. The paper also presents results on what strategy works best in each model. - The idea of NoSub tagging is a clever one, and the insight that covering-prefix hijacks won t sabotage NoSub tagging because valid routes are always present before the bogus covering-prefix is announced, is important. 3. Weaknesses The results of this paper are promising. However one is left wondering how much grounded it is in reality given that no accurate AS topology model of the Internet has been made so far. The authors have clearly anticipated this limitation, but the issue remains to be addressed. It would be interesting if the authors actually found a way to test this system in a real life setting that would make the results far more credible. Perhaps testing it on a network testbed such as PlanetLab(with 40 ASes) would be one way? 4. Your evaluation of the novelty of the paper - a score from 1 (low) to 5 (high) with a few sentences of explanation Score: 5

4 The combination of purge and promotion, and the idea of NoSub tagging introduced in this paper are novel and substantial. As seen from the simulations, they promise to potentially tackle prefix hijacking in a powerful way, using simple ideas. 5. Detailed critique and suggestions The paper is recommended for acceptance. It presents new ideas in dealing with prefix hijacks, and a detailed theoretical analysis with supporting simulations and explanation. In the introduction, the paper mentions that with 20 participating ASes, the number of polluted ASes reduces to 15%. However it fails to mention that the reduction happens from an initial pollution value of about 55%. Section IV doesn t describe the implications of the comparison between predicted and observed value of Length Match and Exact Match. The comparison between pure and profit driven makes sense, but its not clear if the numbers themselves lend any insight to this work. In section V.F.3, there is a confusing use of the word resilience. Initially resilience was used to refer to tier-2 ASes with highest number of providers. However in this section, the highest degree ASes are called the most resilient ASes. Finally, the comparison with customer route filtering adds credibility to the paper. Route purge turns out to be superior to route filtering, and the authors correctly intuit the reason for this: route filtering is helpless against bogus routes originated from the customer cone. Also, it doesn t perform filtering on routes originated from its peer or provider. 6. A numerical evaluation of the paper's overall contribution and relevance to the service provider networking area - again 1 is low, 5 is high. Score: 5

5 Paper 2: Consistent BGP: A Domain Divided Against Itself Cannot Stand 1. Summary The issue of improving BGP convergence time has been an unsolved problem for long, with marginal improvements. While intra-as routing protocols are moving close to sub second convergence, BGP s convergence times are still outrageously high(up to 2 minutes). This paper proposes an approach that promises to substantially cut down the convergence time by making information about various external routes consistently available in a network. To accomplish this, this paper proposes adding an extra bit called the Potentially offer Primary or POP bit to BGP route withdrawals, which indicates that an alternative route is present at the sender. Any withdrawal with the POP bit set, is called a POP withdrawal. The paper also introduces three mechanisms to ensure that C-BGP works in different situations: - When sending ibgp withdrawals, the POP bit is set if the sender still knows a valid external path - If the routers primary path is through an internal peer, and it has an available external path, then all packets received over the internal tunnels are forwarded along the best external path - Routers send a POP withdrawal to all peers when using an internal path and an external path becomes available. Routers move to POP withdrawal paths from non-pop withdrawal paths if available. The first mechanism ensures that disconnectivity does not happen when a new route comes up. When a new route is announced, the current path is withdrawn and this creates a race condition. If a router on the network receives the route withdrawal before the new route announcement, disconnectivity occurs. C-BGP ensures that routers keeps forwarding their packets to the POP withdrawn router since it still knows a path, until the other routers get the route announcement for the new path. The second mechanism ensures that loops do not form between border routers that are connected to the same provider at different places, when the provider announces a new, potentially longer route that some other customer has advertised. In such a situation, routers might start forwarding data back and forth between each other. C-BGP prevents this by forwarding data received from a primary internal path to its best external path.

6 The third mechanism ensures that information about external path availability is broadcast using POP withdrawal to all routers in the AS. Thus if an existing link comes down, routers immediately switch to the external path that was advertised using the POP withdrawal. This results in consistency across the AS: routers are being informed of external routes as soon as one is discovered using POP withdrawals. So data is not lost because of ignorance about existing external routes. 2. Strengths This paper has various strengths: - A key result of this paper is the sharp reduction in BGP convergence time. While there have been various attempts to reduce convergence time, this paper has achieved in maximizing the reduction of convergence time very substantially. Only running intra-domain C-BGP across all ASes with no coordination across the ASes reduces the convergence time by 85%. Coordination across domains brings it down to 0%. This is a remarkable result. - The inference that intradomain inconsistency is still the major contributor to BGP convergence delay, compared to interdomain consistency is a keen insight. - The modification that this paper seeks to route announcements just one bi, is simple yet powerful. - The technique presented in the paper is incrementally deployable, with immediate benefits. - The comparison with R-BGP is appropriate and interesting. It is encouraging to see that running C-BGP within an ASes performs better than running R-BGP across domains. 3. Weaknesses One weakness of the paper is that the success of C-BGP depends on routers being POP aware. This implies that C-BGP would not be able to work on legacy routers. Also, the paper falls short of its promise of using just one bit when trying to avoid interdomain loops; it introduces an additional custpop bit to indicate whether they know an alternative external customer path. 4. Your evaluation of the novelty of the paper - a score from 1 (low) to 5 (high) with a few sentences of explanation Score: 4 The idea of just adding one bit that achieves such benefit is definitely elegant. By adding this extra bit and following the three key mechanisms,

7 this C-BGP achieves in providing consistency across an AS about various available external paths. This is an impressive accomplishment. 5. Detailed critique and suggestions This paper is recommended for acceptance. This paper complements R-BGP in a solid way. R-BGP assumes that the AS is a consistent system, like a single router. C-BGP makes this assumption true by ensuring consistency across the AS using its three mechanisms. The combination of these two approaches would potentially reduce transient disconnectivity in ASes substantially. Given the weakness of a lot of BGP modifications that rely on global acceptance to be effective, C-BGP provides strong benefits even when its deployed only partially, thus providing incentives for ASes to deploy it. If no customer path were available, then wouldn t custpop allow routing through non-customer paths, leading potentially to loop formation? This paper also addresses path visibility faults, that Feamster et al discuss in their rcc paper (discussed in class). rcc is a useful tool to detect such faults using static analysis, but C-BGP tries to ensure that paths are visible in real time without the need for an external configuration checker. 6. A numerical evaluation of the paper's overall contribution and relevance to the service provider networking area - again 1 is low, 5 is high. Score: 5

8 Paper 3: Diagnosing Spatio-Temporal Internet Congestion Properties 1. Summary Active network measurements are usually classified into end-to-end and router-response based approaches. End-to-end approaches send single, pair or multiple packets and measure end to end parameters, while router-response approaches probe intermediate routers and measure link level properties. An example of active measurement is the work by Mao et al on BGP beacons(discussed in class) used in the analysis of convergence delays, route flap damping and update inter-arrival times. This paper presents an integrated approach, combining both these approaches to infer spatio-temporal properties of congestion. In doing so, the authors introduce a number of important concepts and approaches. The paper proposes using multiple probing methods using 4, 3 or 2 packets per node based on the shared congested path segments. The priority of choosing the probing technique is based on the tightness of delay bound, with the 4-packet probe giving the best bound. Probes are scheduled sequentially to various nodes on a link (and repeated every time period I, where I ε [0.5,1] seconds) to increase the accuracy of both spatial and temporal measurements. A switch point approach is used for identifying link segments, which are congestion candidates. The paper introduces a Quality of Measurability(QoM) that uses an exponentially weighted moving average of delay values to continuously monitor which is the best probing mechanism, and hops to that probing technique if its condition is met well. The paper defines measurable pairs as pairs of intermediate nodes for which there are specific relationships between the queuing delays. When this is not the case, measurable points are used instead. Congestion is inferred based on congestion probability on a link, which depends on how the delay range on the link is, compared to a threshold that s self adaptive for different kinds of links. A congestion intensity, CI(x, T) is defined for a path segment x, and time period T to indicate how often the segment is congested over an interval T. The paper defines congestion spikes, which is a duration during which the delay on a link is continuously above a threshold. A congestion spike starts when the congestion intensity exceeds 0.2.

9 Links are divided into core and edge links based on their location. Using 0% for source and 100% for destination, links between 20 to 80 % are considered core links while the rest are considered edge links. 2. Strengths - The paper introduces several important concepts that are outlined in the previous section such as probing methods, intelligent congestion point location with high precision, adaptive tuning of measurement parameters, measure of congestion intensity and path-level congestion analysis. - This work was carried out on a PlanetLab testbed, which though not quite representative of the Internet, is much more credible that simulations. - The paper is well written and observations are well explained - The paper is the first I know of that takes spatial and temporal measurements, using a novel combination of end-to-end and route-response based approaches and proposing and utilizing various innovative techniques. - The paper identifies sources of measurement errors such as route alterations, clock skew/jumps and ICMP queuing, and explains how they are handled. 3. Weaknesses I wasn t totally sure if the rationale for dividing links into core(20% to 80% based on location) and edge links(remaining links) was justified. The authors simply assert that they did this based on their observations but provide no details or justification. Since a number of inferences are then comparisons between core and edge links, it would have been proper to justify the classification and show how it represents reality. Also the rationale for choosing 0.02 as the congestion intensity over which a congestion spike occurs is not provided. The self consistency methodology and results look convincing, but one is left wondering if it d have been better to present results about more than the top 8 links shared by most paths. True, it validates the point that these links were detected to be congested by all the path probes, but perhaps these were overly congested? How good was the technique in detecting less congested links then, which were perhaps traversed by fewer paths? 4. Your evaluation of the novelty of the paper - a score from 1 (low) to 5 (high) with a few sentences of explanation

10 Score: 5 Overall this paper does a great job of combining existing approaches and introducing novel techniques and detailed engineering analysis to understanding congestion in the Internet. Some of the threshold values seem to be chosen without proper explanation, but that doesn t reduce the value of the fundamentally new ideas presented in this work. An impressive element is the high resolution in detecting the location, frequency and duration of congestion, and an adaptive measurement mechanism that self monitors and hops between different probing methods. The results are well analyzed and presented. 5. Detailed critique and suggestions This paper is recommended for acceptance. The inferences on delay bounds for various segments made in various subsections in section 2.1 are not obvious to me; it would make it easier to understand the paper if the steps in this inference are shown perhaps in an appendix. All the figures in this paper are clear except figure 6 that shows the components of Pong. The paper makes a passing reference to this diagram but do not explain it. The diagram also has certain terms whose meaning is not immediately obvious. It is not clear how Pong does the sender-to-receiver pairings and automatically handles conflicts. In section 4.2, paragraph 2, the meaning of the line about congestion samples residing exclusively on physical links is not obvious. While discussing results in section 4.4, the reversal of congestion trends between inter and intra AS inside the core, compared to outside is not explained. The word novel is used a bit too often. Perhaps it might be better to use it sparingly. Reference number [30] is incorrectly spelled. Consistency should be replaced by constancy. 6. A numerical evaluation of the paper's overall contribution and relevance to the service provider networking area - again 1 is low, 5 is high. Score: 4