Understanding BGP Misconfiguration

Transcription

1 Understanding BGP Misconfigration Ratl Mahajan David Wetherall Tom Anderson University of Washington

2 Motivation BGP instabilities have widespread impact Misconfigrations can be a leading case of nreliability BGP is complex to configre Known major incidents Little is known abot misconfigration in BGP Only anecdotal evidence Use or experience to avoid ftre mishaps ratl sigcomm '02 nderstanding bgp misconfigration 2

3 Understanding BGP misconfigration A systematic stdy to nderstand the problem How common are misconfigrations? What is their impact on connectivity and roting load? Why do they happen? How can we stop them? Approach Leverage global visibility of BGP actions to detect misconfigs Data from 23 BGP speakers in the backbone Obtain operator feedback throgh an srvey ratl sigcomm '02 nderstanding bgp misconfigration 3

4 Border Gateway Protocol (BGP) P, {2,1} AS5 AS6 Rote exports depend on policy AS2 P, {1} AS3 P, {1} AS1 P, {4,1} P, {1} P, {4,1} AS4 The selected rote depends on policy ASes export rotes to other ASes P: /16 Each AS annonces the networks it is connected to ratl sigcomm '02 nderstanding bgp misconfigration 4

5 BGP Misconfigration No niversally accepted list of Dos & Don'ts Defined as behavior nintended by the operator Incldes both slips (inadvertent errors) and mistakes (erroneos plan) We stdy two broad classes of globally visible falts Origin misconfigration Export misconfigration ratl sigcomm '02 nderstanding bgp misconfigration 5

6 BGP Misconfigration (2) AS2 AS5 R, {5, } AS1 R, {3,5, } AS3 R, {6,3,5, } Q, {1} AS6 AS4 AS7 Q, {6,4,1} Global visibility Q, {4,1} Export Misconfigration IfAS3 spolicyistonot export this rote to AS6 P: /16 Origin Misconfigration If Q is annonced nintentionally ratl sigcomm '02 nderstanding bgp misconfigration 6

7 Methodology Analyze pdates from 23 BGP speakers for 21 days [rote-views] Rich view of backbone roting Ability to observe even very short-lived events Identifying misconfigration IRRs are inaccrate or otdated Instead se signatre of misconfigs in the pdate stream Policy changes have similar signatre bt bigger timescales ratl sigcomm '02 nderstanding bgp misconfigration 7

8 Methodology (2) 1. Identify short-lived (< 24hrs) changes as potential misconfigs Origin misconfigration Short-lived new rote new prefix or new origin for a prefix Export misconfigration Short-lived AS-path that violates policy Infer AS relationships sing Gao s heristics 2. verification throgh operators Was it a misconfig? Connectivity disrpted? What cased it? 3. Use responses to discover nderlying cases Test connectivity sing pblic tracerote servers Coarse independent verification of responses ratl sigcomm '02 nderstanding bgp misconfigration 8

9 Reslts: Origin misconfigration Potential misconfigs per day responses (% of potential) Misconfigs (% of ) Connectivity (% of misconfigs) Prefixes (58%) 339 (96%) 13 (4%) Incidents (29%) 45 (86%) 6 (13%) Misconfigration detection accracy is high Large nmber of misconfigrations Extrapolated estimate is 580 (605 * 0.96) prefixes per day 3 in 4 new rotes seen in a day reslt from misconfigs Most misconfigrations don t disrpt connectivity ratl sigcomm '02 nderstanding bgp misconfigration 9

10 Reslts: Export misconfigration Potential misconfigs per day responses (% of potential) Misconfigs (% of ) Connectivity Paths (66%) 61 (96%) - Incidents (36%) 10 (86%) - Misconfigration detection accracy is high Almost no impact on connectivity Bt congestion experienced ratl sigcomm '02 nderstanding bgp misconfigration 10

11 Roting load Defined as fraction of pdates de to misconfigs = (bad pdates) / (total pdates) Fraction of intervals with < x% load Rotingload%(15-minaveraging) Some misconfigs case extreme short-term roting load ratl sigcomm '02 nderstanding bgp misconfigration 11

12 Cases: Origin misconfigration Falty redistribtion (32% prefixes/ 5% incidents) Errors in propagating IGP rotes into BGP Initialization bg (22% / 5% ) Leaking rotes temporarily dring boot-p or maintenance Reliance on pstream filtering (14% / 46% ) Annoncing rotes assming pstream wold filter them Hijacks (1% / 6% ) Annoncing somebody else s address space Old configration (1% / 4% ) Reactivation of stale configration ratl sigcomm '02 nderstanding bgp misconfigration 12

13 Prefix based (mis)configration Prefix based configration was responsible for 22% of the export misconfig incidents P1 A C P2 Intended policy at A: Provide transit of C throgh link A-C Configration: Export all prefixes originated by C to P1 and P2 The misconfigration is exposed when the link A-C fails ratl sigcomm '02 nderstanding bgp misconfigration 13

14 Fixes (largely speclative) User interfaces Basic principles need to be followed High-level configration tools bilt into the roters Configration checker Atomated verification Expose errors Appropriate configration semantics Consistent databases and pdated registries ratl sigcomm '02 nderstanding bgp misconfigration 14

15 Conclsions Misconfigrations are commonplace Connectivity is srprisingly robst to most misconfigs bt roting load can be significant The cases of misconfigrations are diverse Mch needs to be done to improve the operational reliability of the Internet ratl sigcomm '02 nderstanding bgp misconfigration 15

16 On srveys Don t worry. That was a configration error of or pstream ISP. Yes, we know this is not a recommended way of doing things; bt the packet monster of the internet mst be fed. I am writing to thank yo for yor letter and say that I am glad that someone apart from me is interested in or BGP annoncements. Hope yo enjoy living in Seattle; it s a beatifl city. ratl sigcomm '02 nderstanding bgp misconfigration 16