ELISHA: On Detection and Analysis of Anomalous Dynamics
|
|
|
- Lynn Spencer
- 5 years ago
- Views:
Transcription
1 Cyber DEfense Technology Experimental Research (DETER) Network Evaluation Methods for Internet Security Technology (EMIST) USC Information Sciences Institute University of California, Berkeley University of California, Davis Penn State University Purdue University International Computer Science Institute Stanford Research Institute (SRI) Network Associates SPARTA ELISHA: On Detection and Analysis of Anomalous Dynamics S. Felix Wu Computer Science Department University of California, Davis
2 Autonomous Systems (ASes) UCDavis: /16 AS6192 AS11423 (UC) AS11537 (CENIC) AS513 an AS Path: / /03/2004 UMIACS 2
3 The Internet as June 7, Autonomous Systems IP Address Prefixes announced 11/03/2004 UMIACS 3
4 The Dynamics of Internet Link/node failures Software malfunctions Implementation related Policy configuration Topology changes Other interesting dynamics (that we can not explain well yet ) 11/03/2004 UMIACS 4
5 Routing Dynamics in 2001 a color dot = an AS Path being used # of BGP updates over a fixed period of time (e.g., 2 hours) 11/03/2004 UMIACS 5
6 DNS Root-A Server : : : : : : : : : : :9.33 Withdraw : : :9.40 Withdraw :10: :10: /03/2004 UMIACS 6
7 The Dynamics of Internet 11/03/2004 UMIACS 7
8 11/03/2004 UMIACS 8
9 Examining BGP anomalies is an expensive process even with the right tools! Given an ocean of BGP updates events: Can we identify, maybe in a probabilistic sense, a much smaller subset (or the most important subset) of these events for the network operators to investigate? 11/03/2004 UMIACS 9
10 Signature and Statistics Signature-based detection Pre-define the signatures of anomalies Pattern matching Convert our limited/partial understanding/modeling about BGP into detection heuristics (i.e., 6 signatures) Statistics-based detection Build statistics profile for expected behaviors Compare testing behaviors with expected behaviors Significant deviation Based on our experience, select a set of features (5 features in this paper) that will likely to distinguish expected from unexpected BGP behavior. 11/03/2004 UMIACS 10
11 K = 4, T = /03/2004 UMIACS 11
12 K = 2, T = /03/2004 UMIACS 12
13 Anomalies in Statistics But, which feature(s) to profile?? raw events function F long term profile quantify the anomalies threshold control alarm generation 11/03/2004 UMIACS 13
14 5 Features/Measures Intensity Measures BGP Update Message Arrival Frequency Number of AS paths Categorical Measures BGP Updates Types AS path Occurrence Frequency Counting Measure AS path Difference 11/03/2004 UMIACS 14
15 BGP Update Messages For each sample of the statistic measure, X (0, 1] (1, 3] (3, 15] (15, + ) 40% 30% 20% 10% qi q i+ 1 11/03/2004 UMIACS 15
16 AS path Occurrence Frequency (M4) ID AS PATH Probability e /03/2004 UMIACS 16
17 Q Distributions Jan-02 Sep /03/2004 UMIACS 17
18 AS3257 versus AS3333 (Q distri. on M1 in 2002 for /16) AS3333 Q Di s t r i but i on Q Pr obabi l i t y Probability Bi n Q di st r i but i on Q pr obabi l i t y AS3257 Probability Bi n 11/03/2004 UMIACS 18
19 SQL Worm Attacks (January 25, 2003) Different prefixes manifests different behaviors Prefixes Observation point AS3333 AS2914 AS7018 Popular prefixes Yahoo Normal Normal Normal Real-networks Normal Normal Normal Root_A /24 Normal Normal Normal DoD prefix /20 Warning Warning Warning Korean s prefix /24 Warning Warning Warning China s prefix /16 Warning Warning Warning 11/03/2004 UMIACS 19
20 T 2 Value of Tsinghua University 2 T 09/01/ /31/ /03/2004 UMIACS 20
21 AS2914 versus AS3333 (two different peer ASes) AS2914 in 2001 AS3333 in /03/2004 UMIACS 21
22 Comparison of 3 Prefixes Prefixes\Measure /16 S1 S2 S3 S4 S T / / Large S3 comes from withdrawal messages Large S2 indicates arrival of new AS path Large S5 is because the new path is significantly different with the primary path 11/03/2004 UMIACS 22
23 (Networking 2004) 01/10/ seconds The BGP Path to Beijing The primary path: (via SPRINT) A new path: last for approximately 500sec AS3356: L3 Network AS12013 : Florida Atlantic University AS3681: Florida International University AS20080: Florida International University AS11537: Abilene Network(Abilene) AS9405: TPS-CN-AS (Tsinghua University, Beijing) AS4538: China Education and Research Network Center 11/03/2004 UMIACS 23
24 Response from AS11537 From: Brent Sweeny now to what the logs show me, after examining them for the whole day of Jan : the biggest change that day, taking place at about 10amEST on all of our routers, was a change made to finally disable OSPF (ISIS had been turned up some time earlier and was preferred; this last step was to remove OSPF entirely). even though OSPF wasn't preferred, the change to the rib could conceivably have caused shimmies through the routers' routing processes and forwarding tables as they rearranged themselves for a short time--i don't think we were aware of anything like what you've seen at the time, but it could have happened and we might not have noticed. other things going on during the day were: - what appears to be some more futzing with OSPF EST - some interface debugging work EST - removing some BGP neighbors EST and EST 11/03/2004 UMIACS 24
25 BGP Anomalies Detection and Analysis of Anomalies Elisha, a tool: integration of visualization, signatures, and statistics interactive investigation explanation-based analysis/learning 11/03/2004 UMIACS 25
26 Origin AS in an AS Path UCDavis (AS-6192) owns /16 and AS-6192 is the origin AS AS Path: /03/2004 UMIACS
27 / AS2152 AS CSU-53 California State University CSU-53 California State University 11/03/2004 UMIACS 27
28 Origin AS Changes (OASC) Ownership: UCDavis (AS-6192) owns /16 and AS-6192 is the origin AS Current AS Path: for prefix: /16 New AS Path: even worse: /24 Which route path to use? Normal or Abnormal?? / /16 11/03/2004 UMIACS 28
29 BGP MOAS/OASC Events (IMW 2001, Explanation DSOM 2003) Max: (9177 from a single AS) year Median number increase rate #BGP table entries increase rate % % % % % % 11/03/2004 UMIACS 29
30 Real-Time OASC Detection Low level events: BGP Route Updates High level events: OASC per day and max per day per 3-minutes window in real-time demo IP address blocks Origin AS in BGP Update Messages Different Types of OASC Events 11/03/2004 UMIACS 30
31 Qua-Tree Representation of IP Address Prefixes AS# / /16 11/03/2004 UMIACS 31
32 AS-6192 AS-7777 AS# Representation AS# AS-81 AS AS /03/2004 UMIACS 32
33 AS81 punched a hole on /16 yesterday AS-6192 victim yesterday /16 today AS-81 offender today / /24 11/03/2004 UMIACS 33
34 OASC Event Types Using different colors to represent types of OASC events C type: CSS, CSM, CMS, CMM H type: H B type: B O type: OS, OM 11/03/2004 UMIACS 34
35 SPRINT (AS-1239) (on December 3, 2000, B events) 11/03/2004 UMIACS 35
36 Normal 11/03/2004 UMIACS 36
37 AS15412 in April, /03/2004 UMIACS 37
38 April 6, 2001 AS15412 caused 40K+ MOAS/OASC events within 2 weeks 11/03/2004 UMIACS 38
39 April 7-10, /07/2001 all 04/07/ /08/2001 all 04/08/ /09/2001 all 04/09/ /10/2001 all 04/10/ /03/2004 UMIACS 39
40 April 11-14, /11/2001 all 04/11/ /12/2001 all 04/12/ /13/2001 all 04/13/ /14/2001 all 04/14/ /03/2004 UMIACS 40
41 April 18-19, 2001 Again?? 04/18/2001 all 04/18/ /19/2001 all 04/19/ /03/2004 UMIACS 41
42 AS7777 in 08/14/2000 the Pink in 02/19/ /03/2004 UMIACS 42
43 August 14, 2000 AS-7777 punched hundreds of holes. 11/03/2004 UMIACS 43
44 EBL-based Analysis Which types of screens are more interesting and why? Why was AS15412 picked for further special examination? Under this context, why were we only focusing on April 6-12 and April 18-19? Or, why is April 16 irrelevant? Why are April 12 and 18 similar? What is the difference between these two instances in April of 2001? 11/03/2004 UMIACS 44
45 Example #1: AS7332 & AS3669 Can you investigate the relationship between AS and AS3669? (BTW, who are they?) And, they have a lot of interesting OASC interactions in Both AS3669 and AS7332 belongs to iquest.net. 11/03/2004 UMIACS 45
46 Example #2: AS CSMs 06/18/ CMSs 07/01/ CMSs 10/18/ CSMs 10/19/ CSMs 10/20/ CMSs 10/22/ /03/2004 UMIACS 46
47 Learning via Anomaly Explanation Model about BGP Anomaly Detection Anomaly Analysis and Explanation EBL 11/03/2004 UMIACS 47
48 Route Flap Damping (RFC 2439) 11/03/2004 UMIACS 48
49 Different Behaviors SSFNet Zebra Cisco 11/03/2004 UMIACS 49
50 Remarks Elisha OASC Program/Data(00~04)/Documents: Just like many other large-scale complex dynamic systems, BGP Anomaly Analysis is indeed very challenging: Data/Knowledge Information Modeling & Correlation Visual and Interactive Interface Data Mining Techniques Experiments and Simulation 11/03/2004 UMIACS 50
51 Collecting the Results show IP BGP 1 peer (SPRINT) Full Routing Table (9MB compressed) BGP Updates (2 hours KB) ~29 MB uncompressed routing table snapshot per router per 3 minutes 11/03/2004 UMIACS 51
52 Real-Time OASC Attack Movie (per 3-minutes check) / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /25 messages / /25 per /25 second / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /24 attack /24 messages / / /24 on / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /24 randomly / /24 selected / /24 prefixes / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /25 (1000/136515, / / /24 ~1%) / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /25 11/03/2004 UMIACS / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /24
53 Acknowledgements DARPA FNIISC (UCLA, USC-ISI, NCSU, UCDavis) Lixia Zhang, Allison Mankin, Dan Massey and others NSF/DHS DETER/EMIST Chen-Nee Chuah, Ke Zhang, Shih-Ming Tseng, Soon-Tee Teoh (UC Davis), Sandra Murphy (SPARTA), Sonia Fahmy (Purdue), Patrick McDaniel (Penn. State Univ.) NIST BGP-SSFNet Many others. 11/03/2004 UMIACS 53
54 11/03/2004 UMIACS 54
CE Advanced Network Security Routing Security II
CE 817 - Advanced Network Security Routing Security II Lecture 21 Mehdi Kharrazi Department of Computer Engineering Sharif University of Technology Acknowledgments: Some of the slides are fully or partially
On Reverse Engineering the Management Actions from Observed BGP Data
On Reverse Engineering the Management Actions from Observed BGP Data Shih Ming Tseng, S. Felix Wu University of California, Davis Email: {smtseng,sfwu}@ucdavis.edu Xiaoliang Zhao Verizon Communications
On Detection of Anomalous Routing Dynamics in BGP
On Detection of Anomalous Routing Dynamics in BGP Ke Zhang1, Amy Yen 1, Xiaoliang Zhao3, Dan Massey 3, S. Felix Wu1, and Lixia Zhang 4 1 University of California, Davis, CA, U.S.A {kezhang,ahyen,sfwu}@ucdavis.edu
Visual-based Anomaly Detection for BGP Origin AS Change (OASC) Events
Visual-based Anomaly Detection for BGP Origin AS Change (OASC) Events S.T. Teoh, K.L. Ma, S.F. Wu Computer Science Department University of California, Davis Davis, USA {teoh, ma, wu}@cs.ucdavis.edu D.
Timer Interaction in Route Flap Damping
Timer Interaction in Route Flap Damping Beichuan Zhang, Dan Pei, Lixia Zhang #UCLA$ Daniel Massey #Colorado State$ June, 2005 1 This Talk Route Flap Damping is a key mechanism in BGP to maintain global
On Detection of Anomalous Routing Dynamics in BGP
On Detection of Anomalous Routing Dynamics in BGP 1 Ke Zhang, Amy Yen, S.Felix Wu Department of Computer Science University of California Davis, CA, U.S.A Xiaoliang Zhao, Dan Massey USC/ISI Arlington,
Measurement of Highly Active Prefixes in BGP
1 Measurement of Highly Active Prefixes in BGP Ricardo V. Oliveira, Rafit Izhak-Ratzin, Beichuan Zhang, Lixia Zhang Abstract We conduct a systematic study on the pervasiveness and persistency of one specific
Understanding BGP Behavior through a Study of DoD Prefixes Λ
Understanding BGP Behavior through a Study of DoD Prefixes Λ Xiaoliang Zhao, Dan Massey y USC/ISI S. Felix Wu z UC Davis Mohit Lad, Dan Pei, Lan Wang, Lixia Zhang x UCLA Abstract BGP is the de-facto inter-domain
Routing Security* CSE598K/CSE545 - Advanced Network Security Prof. McDaniel - Spring * Thanks to Steve Bellovin for slide source material.
Routing Security* CSE598K/CSE545 - Advanced Network Security Prof. McDaniel - Spring 2008 * Thanks to Steve Bellovin for slide source material. 1 Routing 101 Network routing exists to provide hosts desirable
Destination Reachability and BGP Convergence Time. Beichuan Zhang (UCLA) Dan Massey (Colorado State) Lixia Zhang (UCLA)
Destination Reachability and BGP Convergence Time Beichuan Zhang (UCLA) Dan Massey (Colorado State) Lixia Zhang (UCLA) Packet Delivery and Routing Dynamics The primary goal of routing is to deliver packets.
Module: Routing Security. Professor Patrick McDaniel Spring CMPSC443 - Introduction to Computer and Network Security
CMPSC443 - Introduction to Computer and Network Security Module: Routing Security Professor Patrick McDaniel Spring 2009 1 Routing 101 Network routing exists to provide hosts desirable paths from the source
BGP Anomaly Detection. Bahaa Al-Musawi PhD candidate Supervisors: Dr. Philip Branch and Prof. Grenville Armitage.
BGP Anomaly Detection Bahaa Al-Musawi PhD candidate Supervisors: Dr. Philip Branch and Prof. Grenville Armitage balmusawi@swin.edu.au Centre for Advanced Internet Architectures (CAIA) Swinburne University
Protecting DNS from Routing Attacks -Two Alternative Anycast Implementations
Protecting DNS from Routing Attacks -Two Alternative Anycast Implementations Boran Qian StudentID 317715 Abstract The Domain Names System (DNS) is an important role of internet infrastructure and supporting
Cyber Defense Technology Experimental Research (DETER) and Evaluation Methods for Internet Security Technology (EMIST)
Cyber Defense Technology Experimental Research (DETER) and Evaluation Methods for Internet Security Technology (EMIST) Vision... to provide the scientific knowledge required to enable the development of
Taming BGP. An incremental approach to improving the dynamic properties of BGP. Geoff Huston. CAIA Seminar 18 August
Taming BGP An incremental approach to improving the dynamic properties of BGP Geoff Huston BGP is The inter-domain routing protocol for the Internet An instance of a Distance Vector Protocol with explicit
The DETER Testbed: Overview 25 August 2004
The DETER Testbed: Overview 25 August 2004 1. INTRODUCTION The DETER (Cyber Defense Technology Experimental Research testbed is a computer facility to support experiments in a broad range of cyber-security
Investigating occurrence of duplicate updates in BGP announcements
Investigating occurrence of duplicate updates in BGP announcements Jong Han Park 1, Dan Jen 1, Mohit Lad 2, Shane Amante 3, Danny McPherson 4, and Lixia Zhang 1 1 University of California, Los Angeles
BGP Path Exploration Damping (PED)
BGP Path Exploration Damping (PED) Mattia Rossi mrossi@swin.edu.au Centre for Advanced Internet Architectures (CAIA) Swinburne University of Technology Outline Introduction Motivation Path Exploration
Introduction to IP Routing. Geoff Huston
Introduction to IP Routing Geoff Huston Routing How do packets get from A to B in the Internet? A Internet B Connectionless Forwarding Each router (switch) makes a LOCAL decision to forward the packet
Investigating occurrence of duplicate updates in BGP announcements
Investigating occurrence of duplicate updates in BGP announcements Jonathan Park, Dan Jen, Mohit Lab, Shane Amante, Danny McPherson, Lixia Zhang GROW @ IETF75 July 27, 2009 Why This Work All BGP update
Detection of Invalid Routing Announcement in the Internet Λ
Detection of Invalid Routing Announcement in the Internet Λ Xiaoliang Zhao, Dan Pei, Lan Wang, Dan Massey, Allison Mankin, S. Felix Wu,Lixia Zhang y Abstract Network measurement has shown that a specific
Detecting inconsistencies in INRDB data
Detecting inconsistencies in INRDB data to identify MOAS cases and possible illegitimate Internet resource usage Peter Ruissen System and Network Engineering University of Amsterdam December 11, 2007 1
Advanced Multihoming. BGP Traffic Engineering
Advanced Multihoming BGP Traffic Engineering 1 Service Provider Multihoming Previous examples dealt with loadsharing inbound traffic Of primary concern at Internet edge What about outbound traffic? Transit
FAQ. Version: Copyright ImageStream Internet Solutions, Inc., All rights Reserved.
Version: 3434 Copyright 2007-2010 ImageStream Internet Solutions, Inc., All rights Reserved. Table of Contents BGP/FAQ...1 What is BGP?...1 What implementation of BGP do ImageStream routers use?...1 What
On the Impact of Filters on Analyzing Prefix Reachability in the Internet. Ravish Khosla, Sonia Fahmy, Y. Charlie Hu Purdue University ICCCN 2009
On the Impact of Filters on Analyzing Prefix Reachability in the Internet Ravish Khosla, Sonia Fahmy, Y. Charlie Hu Purdue University ICCCN 2009 Background Border Gateway Protocol (BGP) Inter-domain policy
How does a router know where to send a packet next?
How does a router know where to send a packet next? The Problem Which path should packets take from A to B? A B R2 R R4 R3 C D 2 The Internet forwards packets hop-by-hop Data IP Address Next-hop A R B
BGP Security via Enhancements of Existing Practices
IEEE International Conference on Communications 2009 1 BGP Security via Enhancements of Existing Practices Xiaoliang Zhao, David T. Kao * Abstract Border Gateway Protocol (BGP) is the de-facto inter-domain
Identifying BGP Routing Table Transfer. !Machu Picchu!
Identifying BGP Routing Table Transfer Beichuan Zhang (Univ. Of Arizona) Vamsi Kambhampati (Colorado State Univ.) Daniel Massey (Colorado State Univ.) Mohit Lad (Univ. Of California, LA) Lixia Zhang (Univ.
PHAS: A Prefix Hijack Alert System
PHAS: A Prefix Hijack Alert System Mohit Lad mohit@cs.ucla.edu Yiguo Wu yiguowu@cs.ucla.edu Dan Massey massey@cs.colostate.edu Beichuan Zhang bzhang@cs.arizona.edu Dan Pei peidan@research.att.com Lixia
On Design and Evaluation of Intention-Driven ICMP Traceback
On Design and Evaluation of Intention-Driven ICMP Traceback Allison Mankin, Dan Massey USC/ISI Chien-Lung Wu NCSU S. Felix Wu UCDavis Lixia Zhang UCLA (* alphabetic order of author s last names *) ABSTRACTION
Link State Routing & Inter-Domain Routing
Link State Routing & Inter-Domain Routing CS640, 2015-02-26 Announcements Assignment #2 is due Tuesday Overview Link state routing Internet structure Border Gateway Protocol (BGP) Path vector routing Inter
Service Provider Multihoming
Service Provider Multihoming ISP Workshops These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/) Last
COMP/ELEC 429 Introduction to Computer Networks
COMP/ELEC 429 Introduction to Computer Networks Lecture 11: Inter-domain routing Slides used with permissions from Edward W. Knightly, T. S. Eugene Ng, Ion Stoica, Hui Zhang T. S. Eugene Ng eugeneng at
Routing Concepts. IPv4 Routing Forwarding Some definitions Policy options Routing Protocols
Routing Basics 1 Routing Concepts IPv4 Routing Forwarding Some definitions Policy options Routing Protocols 2 IPv4 Internet uses IPv4 Addresses are 32 bits long Range from 1.0.0.0 to 223.255.255.255 0.0.0.0
Service Provider Multihoming
Service Provider Multihoming ISP Workshops Last updated 18 September 2013 1 Service Provider Multihoming p Previous examples dealt with loadsharing inbound traffic n Of primary concern at Internet edge
Distributed Denial of Service (DDoS)
Distributed Denial of Service (DDoS) Defending against Flooding-Based DDoS Attacks: A Tutorial Rocky K. C. Chang Presented by Adwait Belsare (adwait@wpi.edu) Suvesh Pratapa (suveshp@wpi.edu) Modified by
CS4700/CS5700 Fundamentals of Computer Networks
CS4700/CS5700 Fundamentals of Computer Networks Lecture 12: Inter-domain routing Slides used with permissions from Edward W. Knightly, T. S. Eugene Ng, Ion Stoica, Hui Zhang Alan Mislove amislove at ccs.neu.edu
A Technique for Reducing BGP Update Announcements through Path Exploration Damping
A Technique for Reducing BGP Update Announcements through Path Exploration Damping Geoff Huston, Mattia Rossi, Grenville Armitage mrossi@swin.edu.au Centre for Advanced Internet Architectures (CAIA) Swinburne
Introduction to BGP. ISP Workshops. Last updated 30 October 2013
Introduction to BGP ISP Workshops Last updated 30 October 2013 1 Border Gateway Protocol p A Routing Protocol used to exchange routing information between different networks n Exterior gateway protocol
BGP Routing and BGP Policy. BGP Routing. Agenda. BGP Routing Information Base. L47 - BGP Routing. L47 - BGP Routing
BGP Routing and BGP Policy BGP Routing The BGP Routing Principles and Route Decisions based on AS-Path in a simple topology of AS s routing policy is reduced to a minimal function demonstrated in example
Toward Understanding the Behavior of BGP During Large-Scale Power Outages
Toward Understanding the Behavior of BGP During Large-Scale Power Outages Jun Li, Zhen Wu, and Eric Purpus {lijun, zwu, epurpus}@cs.uoregon.edu Computer and Information Science Department University of
Design and Implementation of an Anycast Efficient QoS Routing on OSPFv3
Design and Implementation of an Anycast Efficient QoS Routing on OSPFv3 Han Zhi-nan Yan Wei Zhang Li Wang Yue Computer Network Laboratory Department of Computer Science & Technology, Peking University
Routing Basics. ISP Workshops. Last updated 10 th December 2015
Routing Basics ISP Workshops Last updated 10 th December 2015 1 Routing Concepts p IPv4 & IPv6 p Routing p Forwarding p Some definitions p Policy options p Routing Protocols 2 IPv4 p Internet still uses
Brent Sweeny Global Research NOC at Indiana University (USA) Terena Network Conference 19 April 2014 (Dublin)
BGP path 'hinting': A New Way to Influence Return Routing Brent Sweeny Global Research NOC at Indiana University (USA) sweeny@iu.edu Terena Network Conference 19 April 2014 (Dublin) Topics Purpose (what's
EULER Project Path-Vector Routing Stability Analysis
EULER Project Path-Vector Routing Stability Analysis Florin Coras, Albert Lopez, Albert Cabellos UPC Dimitri Papadimitriou Alcatel-Lucent Introduction BGP Inter-domain routing protocol used in the Internet
On the Impact of Route Processing and MRAI Timers on BGP Convergence Times
On the Impact of Route Processing and MRAI Timers on BGP Convergence Times Shivani Deshpande and Biplab Sikdar Department of ECSE, Rensselaer Polytechnic Institute, Troy, NY 12180 Abstract Fast convergence
Quantifying Path Exploration in the Internet
Quantifying Path Exploration in the Internet Ricardo Oliveira Beichuan Zhang Dan Pei Lixia Zhang {rveloso,lixia}@cs.ucla.edu bzhang@cs.arizona.edu peidan@research.att.com University of California, Los
IETF RFCs Supported by Cisco NX-OS Unicast Features Release 6.x
IETF Supported by Cisco NX-OS Unicast Features Release 6.x BGP, page 1 First-Hop Redundancy Protocols, page 2 IP Services, page 3 IPv6, page 3 IS-IS, page 4 OSPF, page 5 RIP, page 5 BGP RFC 1997 BGP Communities
Visualizing Internet Routing Changes
1 Visualizing Internet Routing Changes Mohit Lad, Student Member, IEEE, Dan Massey, Senior Member, IEEE and Lixia Zhang, Fellow, IEEE Abstract Today s Internet provides a global data delivery service to
CS519: Computer Networks. Lecture 4, Part 5: Mar 1, 2004 Internet Routing:
: Computer Networks Lecture 4, Part 5: Mar 1, 2004 Internet Routing: AS s, igp, and BGP As we said earlier, the Internet is composed of Autonomous Systems (ASs) Where each AS is a set of routers, links,
2015/07/23 23:32 1/8 More ibgp and Basic ebgp
2015/07/23 23:32 1/8 More ibgp and Basic ebgp More ibgp and Basic ebgp Objective: Connect your ISP to a Transit provider and the Internet Exchange Point using a combination of ISIS, internal BGP, and external
Interdomain Routing Reading: Sections K&R EE122: Intro to Communication Networks Fall 2007 (WF 4:00-5:30 in Cory 277)
Interdomain Routing Reading: Sections K&R 4.6.3 EE122: Intro to Communication Networks Fall 2007 (WF 4:00-5:30 in Cory 277) Guest Lecture by Brighten Godfrey Instructor: Vern Paxson TAs: Lisa Fowler, Daniel
A Visual Exploration Process for the Analysis of Internet Routing Data
A Visual Exploration Process for the Analysis of Internet Routing Data Soon Tee Teoh Kwan-Liu Ma S. Felix Wu Department of Computer Science University of California, Davis Abstract The Internet pervades
Internet Routing Protocols Lecture 03 Inter-domain Routing
Internet Routing Protocols Lecture 03 Inter-domain Routing Advanced Systems Topics Lent Term, 2008 Timothy G. Griffin Computer Lab Cambridge UK Autonomous Routing Domains A collection of physical networks
Finding a Needle in a Haystack: Pinpointing Significant BGP Routing Changes in an IP Network
Finding a Needle in a Haystack: Pinpointing Significant BGP Routing Changes in an IP Network Jian Wu (University of Michigan) Z. Morley Mao (University of Michigan) Jennifer Rexford (Princeton University)
Interdomain routing CSCI 466: Networks Keith Vertanen Fall 2011
Interdomain routing CSCI 466: Networks Keith Vertanen Fall 2011 Overview Business relationships between ASes Interdomain routing using BGP Advertisements Routing policy Integration with intradomain routing
L11 : Inter-domain Routing with BGP Lecture14 Michaelmas, 2016
7//06 L : Inter-domain Routing with BGP Lecture4 Michaelmas, 06 Timothy G. Griffin Computer Lab Cambridge UK 7//06 How many ASNs today (7 November, 06)? http://bgp.potaroo.net/ 7//06 How many prefixes
An overview of how packets are routed in the Internet
An overview of how packets are routed in the Internet 1 Dijkstra s shortest path first algorithm (example of a Link State Algorithm ) 1. Exchange link state: A router floods to every other router the state
A Survey of BGP Security: Issues and Solutions
A Survey of BGP Security: Issues and Solutions Butler, Farley, McDaniel, Rexford Kyle Super CIS 800/003 October 3, 2011 Outline Introduction/Motivation Sources of BGP Insecurity BGP Security Today BGP
BGP in the Internet Best Current Practices
BGP in the Internet Best Current Practices 1 Recommended IOS Releases Which IOS?? 2 Which IOS? IOS is a feature rich and highly complex router control system ISPs should choose the IOS variant which is
A Firewall for Routers: Protecting Against Routing Misbehavior
A Firewall for Routers: Protecting Against Routing Misbehavior Ying Zhang Z. Morley Mao Jia Wang University of Michigan AT&T Labs Research Abstract In this work, we present the novel idea of route normalization
Internet Routing Protocols Lecture 01 & 02
Internet Routing Protocols Lecture 01 & 02 Advanced Systems Topics Lent Term, 2010 Timothy G. Griffin Computer Lab Cambridge UK Internet Routing Outline Lecture 1 : Inter-domain routing architecture, the
BGP NSF Awareness. Finding Feature Information
Nonstop Forwarding (NSF) awareness allows a device to assist NSF-capable neighbors to continue forwarding packets during a Stateful Switchover (SSO) operation. The feature allows an NSF-aware device that
Lab 2 BGP route filtering and advanced features
ISP/IXP Networking Workshop Lab Lab 2 BGP route filtering and advanced features Objective: Using the network concepts of Lab 1, use various configuration methods on BGP peerings to demonstrate neighbour
The Impact of Router Outages on the AS-Level Internet
The Impact of Router Outages on the AS-Level Internet Matthew Luckie* - University of Waikato Robert Beverly - Naval Postgraduate School *work started while at CAIDA, UC San Diego SIGCOMM 2017, August
BGP Route Flap Damping Algorithms
BGP Route Flap Damping Algorithms Steve Shen and Ljiljana Trajković {wshen, ljilja}@cs.sfu.ca Communication Networks Laboratory http://www.ensc.sfu.ca/cnl Simon Fraser University Roadmap Introduction to
Virtual Multi-homing: On the Feasibility of Combining Overlay Routing with BGP Routing
Virtual Multi-homing: On the Feasibility of Combining Overlay Routing with BGP Routing Zhi Li, Prasant Mohapatra, and Chen-Nee Chuah University of California, Davis, CA 95616, USA {lizhi, prasant}@cs.ucdavis.edu,
Routing. Jens A Andersson Communication Systems
Routing Jens A Andersson Communication Systems R1 Choosing an Optimal Path R4 5 R7 5 10 40 R6 6 5 B R2 15 A 20 4 10 10 R8 R3 5 R5 10 Router A router is a type of internetworking device that passes data
BGP Routing: A study at Large Time Scale
BGP Routing: A study at Large Time Scale Georgos Siganos U.C. Riverside Dept. of Comp. Science siganos@cs.ucr.edu Michalis Faloutsos U.C. Riverside Dept. of Comp. Science michalis@cs.ucr.edu Abstract In
ETS110: Internet Protocol Routing Lab Assignment
Dept of Electrical and Information Technology 2009-04-28 Jens A Andersson vers 2.0.5 ETS110: Internet Protocol Routing Lab Assignment 1 Purpose and Goals This lab assignment will give a hands-on experience
APT Incremental Deployment
APT Incremental Deployment Dan Jen, Michael Meisel, Daniel Massey, Lan Wang, Beichuan Zhang, Lixia Zhang http://www.cs.ucla.edu/~meisel/draft-apt-incremental-00.txt 1 Why This Talk Incrememtal deployability
A FRESH LOOK AT SCALABLE FORWARDING THROUGH ROUTER FIB CACHING. Kaustubh Gadkari, Dan Massey and Christos Papadopoulos
A FRESH LOOK AT SCALABLE FORWARDING THROUGH ROUTER FIB CACHING Kaustubh Gadkari, Dan Massey and Christos Papadopoulos Problem: RIB/FIB Growth Global RIB directly affects FIB size FIB growth is a big concern:
Distributed Packet-Level Simulation for BGP Networks under Genesis
Distributed Packet-Level Simulation for BGP Networks under Genesis Yu Liu and Boleslaw K. Szymanski Department of Computer Science, RPI, Troy, NY 12180, USA {liuy6, szymansk}@cs.rpi.edu Abstract The complexity
Module 6 More ibgp, and Basic ebgp Configuration
ISP Workshop Lab Module 6 More ibgp, and Basic ebgp Configuration Objective: Simulate four different interconnected ISP backbones using a combination of ISIS, internal BGP, and external BGP. Prerequisites:
ANALYSIS AND EVALUATION OF DISTRIBUTED DENIAL OF SERVICE ATTACKS IDENTIFICATION METHODS
ANALYSIS AND EVALUATION OF DISTRIBUTED DENIAL OF SERVICE ATTACKS IDENTIFICATION METHODS Saulius Grusnys, Ingrida Lagzdinyte Kaunas University of Technology, Department of Computer Networks, Studentu 50,
Implementation of BGP in a Network Simulator
Implementation of BGP in a Network Simulator Tony Dongliang Feng Rob Ballantyne Ljiljana Trajković Communication Networks Laboratory http://www.ensc.sfu.ca/cnl Simon Fraser University Road map Introduction
A Configuration-only Approach to FIB Reduction. Paul Francis Hitesh Ballani, Tuan Cao Cornell
A Configuration-only Approach to FIB Reduction Paul Francis Hitesh Ballani, Tuan Cao Cornell Virtual Aggregation An approach to shrinking FIBs (and RIBs) In interface-card FIB, maybe control-card RIB Works
BGP Route Flap Damping Algorithms
BGP Route Flap Damping Algorithms Wei Shen and Ljiljana Trajković * Simon Fraser University Vancouver, British Columbia, Canada {wshen, ljilja}@cs.sfu.ca Keywords: Routing protocols, BGP, route flap damping,
Quantifying Path Exploration in the Internet
IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 17, NO. 2, APRIL 2009 445 Quantifying Path Exploration in the Internet Ricardo Oliveira, Member, IEEE, Beichuan Zhang, Dan Pei, and Lixia Zhang Abstract Previous
Routing Unicast routing protocols
Routing Unicast routing protocols Jens A Andersson Electrical and Information Technology R1 Choosing an Optimal Path R4 5 R7 5 10 40 R6 6 5 B R2 15 A 20 4 10 10 R8 R3 5 10 R5 1 Router A router is a type
Module 19 Internet Exchange Points
Module 19 Internet Exchange Points ISP/IXP Networking Workshop Lab Objective: To investigate methods for connecting to an Internet Exchange Point. Prerequisites: Modules 12, 13 and 18, and the Exchange
Module 18 Transit. Objective: To investigate methods for providing transit services. Prerequisites: Modules 12 and 13, and the Transit Presentation
ISP/IXP Networking Workshop Lab Module 18 Transit Objective: To investigate methods for providing transit services. Prerequisites: Modules 12 and 13, and the Transit Presentation The following will be
CSCD 433/533 Network Programming Fall Lecture 14 Global Address Space Autonomous Systems, BGP Protocol Routing
CSCD 433/533 Network Programming Fall 2012 Lecture 14 Global Address Space Autonomous Systems, BGP Protocol Routing 1 Topics Interdomain Routing BGP Interdomain Routing Benefits vs. Link State Routing
Introduction to BGP ISP/IXP Workshops
Introduction to BGP ISP/IXP Workshops 1 Border Gateway Protocol Routing Protocol used to exchange routing information between networks exterior gateway protocol RFC1771 work in progress to update draft-ietf-idr-bgp4-18.txt
Jumpstarting BGP Security. Yossi Gilad Joint work with: Avichai Cohen, Amir Herzberg, and Michael Schapira
Jumpstarting BGP Security Yossi Gilad Joint work with: Avichai Cohen, Amir Herzberg, and Michael Schapira Prefix hijacking Victim Path: 111 AS X AS 111 Boston University BGP Ad. AS 666 Data flow 2 Prefix
Configuring BGP. Cisco s BGP Implementation
Configuring BGP This chapter describes how to configure Border Gateway Protocol (BGP). For a complete description of the BGP commands in this chapter, refer to the BGP s chapter of the Network Protocols
Routing Basics. ISP Workshops
Routing Basics ISP Workshops These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/) Last updated 26
AS-CRED: Reputation Service for Trustworthy Inter-domain Routing
AS-CRED: Reputation Service for Trustworthy Inter-domain Routing Krishna Venkatasubramanian Computer and Information Science University of Pennsylvania ONR MURI N00014-07-1-0907 Review Meeting June 10,
Measuring the Global Routing Table
Measuring the Global Routing Table by Alexander Afanasyev, Brent Longstaff, Neil Tilley UCLA CS27B Term Project Presentation June 2, 2009 Presented by Lixia Zhang at IEPG meeting 7/27/09 Outline Data sources
An Analysis on Selective Dropping Attack in BGP
An Analysis on Selective Dropping Attack in BGP Ke Zhang Department of Computer Science University of California, Davis Email: kezhang@ucdavisedu Xiaoliang Zhao USC/ISI Email: xzhao@isiedu SFelix Wu Department
Measuring BGP. Geoff Huston. CAIA SEMINAR 31 May
Measuring BGP Geoff Huston BGP is An instance of the Bellman-Ford Distance Vector family of routing protocols And a relatively vanilla one at that The routing protocol used to support inter-domain routing
A Measurement Study of BGP Misconfiguration
A Measurement Study of BGP Misconfiguration Ratul Mahajan, David Wetherall, and Tom Anderson University of Washington Motivation Routing protocols are robust against failures Meaning fail-stop link and
Evaluation of Prefix Hijacking Impact Based on Hinge-Transmit Property of BGP Routing System
Evaluation of Prefix Hijacking Impact Based on Hinge-Transmit Property of BGP Routing System Evaluation of Prefix Hijacking Impact Based on Hinge-Transmit Property of BGP Routing System School of Computer,
DOLPHIN: THE MEASUREMENT SYSTEM FOR THE NEXT GENERATION INTERNET
DOLPHIN: THE MEASUREMENT SYSTEM FOR THE NEXT GENERATION INTERNET Xinpei Lang, Gang Zhou, Chen Gong, Wei Han National Lab of Software Development Environment Department of Computer Science Beihang University,
6 Watch: Monitoring IPv6 Deployment and Connectivity
6 Watch: Monitoring IPv6 Deployment and Connectivity Dan Massey Colorado State University 1 Many Positive Trends For IPv6 2 Growth in IPv6 ASNs From http://6watch.net/6views.html Data From Colorado Exchange
BGP Route Propagation between Neighboring Domains
BGP Route Propagation between Neighboring Domains Renata Teixeira 1, Steve Uhlig 2, and Christophe Diot 3 1 Univ. Pierre et Marie Curie, LIP6-CNRS, renata.teixeira@lip6.fr 2 Delft University of Technology
Worm Detection, Early Warning and Response Based on Local Victim Information
Worm Detection, Early Warning and Response Based on Local Victim Information Guofei Gu, Monirul Sharif, Xinzhou Qin, David Dagon, Wenke Lee, and George Riley Georgia Institute of Technology ACSAC'04 1
Detecting Internet Traffic Interception based on Route Hijacking
Detecting Internet Traffic Interception based on Route Hijacking Alberto Dainotti alberto@caida.org Center for Applied Internet Data Analysis University of California, San Diego Joint work with: Pavlos
CSE/EE 461 Lecture 11. Inter-domain Routing. This Lecture. Structure of the Internet. Focus How do we make routing scale?
CSE/EE 461 Lecture 11 Inter-domain Routing This Lecture Focus How do we make routing scale? Inter-domain routing ASes and BGP Application Presentation Session Transport Network Data Link Physical sdg //
The Impact of BGP Dynamics on Intra-Domain Traffic
The Impact of BGP Dynamics on Intra-Domain Traffic Sharad Agarwal Chen-Nee Chuah Supratik Bhattacharyya Christophe Diot CS Division, ECE Department, Sprint ATL, Intel Research, University of California,