Loop-Free Multipath Routing Using Generalized Diffusing Computations

Transcription

1 1 Loop-Free Multpath Routng Usng Generalzed Dffusng Computatons Wllam T. Zaumen J.J. Garca-Luna-Aceves Sun Mcrosystems, Inc. Computer Engneerng Department 901 San Antono Avenue School of Engneerng Palo Alto, CA Unversty of Calforna Santa Cruz, CA Abstract A new dstrbuted algorthm for the dynamc computaton of multple loop-free paths from source to destnaton n a computer network or nternet are presented, valdated, and analyzed. Accordng to ths algorthms, whch s called DASM (Dffusng Algorthm for Shortest Multpath), each router mantans a set of entres for each destnaton n ts routng table, and each such entry conssts of a set of tuples specfyng the next router and dstance n a loop-free path to the destnaton. DASM guarantees nstantaneous loop freedom of multpath routng tables by means of a generalzaton of Djkstra and Scholten s dffusng computatons. Wth generalzed dffusng computatons, a node n a drected acyclc graph (DAG) defned for a gven destnaton has multple next nodes n the DAG and s able to modfy the DAG wthout creatng a drected loop. DASM s shown to be loop-free at every nstant, and ts average performance s analyzed by smulaton and compared aganst an deal lnk-state algorthm and the Dffusng Update Algorthm (DUAL). 1. Introducton The routng protocols used n today s computer networks and nternetworks are based on shortest-path algorthms that are usually classfed as dstance-vector algorthms and lnk-state or topologybroadcast algorthms. In a dstance-vector algorthm, a router knows the length of the shortest path from each neghbor router to every network destnaton, and uses ths nformaton to compute the shortest path and next router n the path to each destnaton. A router sends update messages to ts neghbors and only to them; each update message contans a vector of one or more entres, each of whch specfes, as a mnmum, the dstance to a gven destnaton. Some dstance-vector algorthms and protocols also specfy the second to last hop n the shortest path [7] [9] or the entre path to a destnaton [12]. In a lnk-state algorthm, each router broadcasts messages contanng the state of each of the router s adjacent lnks to every other router n the network; routers use ths nformaton to compute shortest paths to all network destnatons. Recently, Garca-Luna-Aceves and Behrens ntroduced a hybrd type of routng algorthm, called lnk-vector algorthms [6], n whch a router communcates to ts neghbors the costs of those lnks that belong to ts preferred paths to reach destnatons. Data packets can be routed usng ether ncremental routng or source routng. Wth ncremental routng, also called destnatonbased or hop-by-hop routng, each router n the path to the destnaton makes a decson of where to route the packet next. In contrast, wth source routng, the source router specfes the entre path to the destnaton n the header of each data packet, or a connecton s establshed so that only the connecton-establshment packet has to specfy the entre path, whle the rest of the packets need only specfy the dentfer of the connecton. Usng ncremental routng to route packets along multple loop-free paths can be more desrable than usng source routng, because the routers forwardng a packet can react more quckly to changes n local network condtons than the source router can. Furthermore, source routng lmts the number of dfferent paths that can be used to those known by the source, whch means that only a small number of possble paths can be used. In contrast, f multple loop-free paths are obtaned usng ncremental routng, packets can flow through paths that the source need not know. It s desrable, of course, to avod out-of-order packet delvery, and ths can be acheved wth ncremental routng by arrangng that packets assocated wth partcular end ponts (both source and destnaton) follow the same path. Varous technques can be used to do ths; the choce of technques depends on the hardware and software capabltes of the router, but can be done n ways that do not mpact the algorthm used to compute paths to destnatons, and as such are outsde the scope of ths paper. The provson of multple paths n exstng nternet routng protocols s very lmted. For example, OSPF [15] allows a router to choose more than one path to the same destnaton only when multple paths of mnmum cost exst. IGRP [1] allows a router to forward packets through paths whose length s less than the product of the shortest-path length tmes a varance factor specfed by the network admnstrator. If the varance s too small, ths approach becomes one of routng through one or more shortest paths; f the varance s too large, long-term routng loops can occur even when all routng tables are correct. The lnk-state algorthm reported n [2] and [3] attempts to provde multple loop-free paths by requrng a router to forward packets to a destnaton through neghbors who have reported a smaller dstance than the router forwardng the packet. None of these three approaches prevents routng loops when routng tables are nconsstent. To prevent routng loops due to nconsstent routng tables, the algorthm n [3] requres every router to have consstent topology nformaton; however, requrng that the topology tables of all routers be consstent s mpractcal n large nternets. Because of the routng loops that can occur wth ncremental routng based on any shortest-path algorthm, Gardner, et al. [8] argue that source routng be used. Ths paper demonstrates that ncremental routng over multple loop-free paths s possble, even when routng tables are nconsstent. It extends prevous results on loop-free routng along shortest paths by ntroducng the concept of a shortest multpath, whch s defned as a drected acyclc graph defned by the successor entres of the routng tables of the routers n all the paths from a source to a destnaton that are guaranteed to be loop-free at a gven nstant. A shortest multpath to a destnaton contans the shortest path, but may contan longer paths, as shown n Fgure 1, where dark arrows show the shortest path between routers (and ther successors) and destnaton j. Grayarrows denote part of a shortest multpath that does not le along the shortest path from that pont n the shortest multpath. The shortest multpath from router to destnaton j, as shown n Fgure 1,

2 j Fg. 1. Shortest Multpath Routes shortest multpath shortest path contans addtonal paths wth lengths longer than the shortest path. In ths paper, we ntroduce the Dffusng Algorthm for Shortest Multpath (DASM) to compute shortest multpaths dstrbutedly. DASM s based on a generalzaton of the basc scheme frst proposed by Djkstra and Scholten for the dssemnaton of dstrbuted operatons [4], [13]. Ths generalzaton, whch we call Generalzed Dffusng Computatons, permts a router to synchronze the updatng of the routng-table entry for a gven destnaton whle mantanng multple successors n loop-free paths to the destnaton. Although several approaches for shortest-path routng wth nstantaneous loop-freedom have been proposed based on Djkstra and Scholten s dffusng computatons [10] [5] or smlar apporaches [14], [16], all of these algorthms guarantee nstantaneous loop freedom only f the sngle successor chosen by each router accordng to the algorthm s the one used for packet forwardng. In contrast, DASM mantans nstantaneous loop-freedom through multple successorsfor every destnaton at each router; the only nformaton exchanged among neghbor routers consst of vectors of shortest dstances to destnatons. Synchronzng the update actvty of routers elmnates loopng but can ncur consderable addtonal overhead. To reduce ths overhead, DASM uses a feasblty condton to determne when a router can update ts routng table wthout synchronzng wth other routers. Ths condton depends on the router s own dstance and the dstances reported by ts neghbors. DASM operates wth arbtrary transmsson or processng delays, assumes arbtrary postve lnk costs, and provdes correct routng tables wthn a fnte tme after the occurrence of an arbtrary sequence of lnk-cost or topologcal changes. Secton 2 presents the network model and notaton assumed to descrbe DASM. Secton 3 descrbes the operaton of DASM and shows how t supportsloop-free area routng. Secton 4 proves that DASM s loop-free at every nstant and that t converges to correct routng tables wthn a fnte tme after a sequence of lnk-cost or topology changes. Sectons 5 and 6 analyze DASM s complexty and average performance; t s shown that DASM provdes consderable mprovements over DUAL [5] and the deal lnk-state algorthm, whch consttutes an upper bound on the performance of exstng routng protocols based on topology broadcast (e.g., OSPF). 2. Network Model and Notaton An nternet s modeled as an undrected connected graph n whch each lnk has two lengths or costs assocated wth t one for each drecton and n whch any lnk of the graph exsts n both drectons at any one tme. Each router has a unque dentfer, and lnk costs can vary n tme but are always postve. The smallest dstance between two routers s defned as the sum of the lnk costs n any path of least cost or shortest path between them. In addton, DASM requres an underlyng protocol, called a neghbor-toneghbor protocol for passng messages to neghbors relably and for detectng changes n lnk status. The requrements for ths protocol are: Every router detects wthn a fnte tme the exstence of a new neghbor or the loss of connectvty wth a neghbor. All packets transmtted over an operatonal lnk are receved correctly and n the proper sequence wthn a fnte tme. All messages, changes n the cost of a lnk, lnk falures, and new-neghbor notfcatons are processed one at a tme wthn a fnte tme and n the order n whch they occur. Throughout ths paper, the followng notaton s used: G(V; E): a connected network of arbtrary topology n whch DASM s used wth V denotng the set of all routers and E denotng the set of all lnks. N : the set of routers connected through a lnk wth router ; a router n that set s sad to be a neghbor of router. k: a neghbor of router. (; k): the lnk between routers and k n V. lk: the cost of the lnk to neghbor k; f the lnk to neghbor k fals, the cost s assumed to be 1. j: a destnaton router n V. SG j: the drected graph consstng of those routers that can reach router j. Each lnk n SG j conssts of a drected lnk from a router to a lnk n that router s successor set. 3. The Dstrbuted Algorthm for Shortest Multpath 3.1 Prncples of Operaton In any routng algorthm, the aggregate of each router s routngtable entry mantaned for a gven destnaton j defnes a drected graph rooted at j. When the algorthm converges to correct values, ths drected graph s acyclc. The objectve of a loop-free routng algorthm s to ensure that the routng tables never contan loops,.e., that the routng-table entres of routers defne a drected acyclc graph (DAG) for each destnaton at every nstant. The basc objectve n DASM s to permt routers to mantan at all tmes a DAG for each destnaton that has much more connectvty than the drected trees obtaned wth pror loop-free routng algorthms [5], [7], [10], [14]. To accomplsh ths, each router has a successor set for each destnaton, rather than a sngle successor. A message sent by router s an ordered trplet of the form [MessageType, j, RD j], where MessageType can be update, query or reply, where j s a destnaton, and where RD j s the cost reported n the message. DASM tself does not depend on the use of sequence number or tmers drectly. It follows that, n DASM, a router knows only the dstances to destnatons reported by each neghbor, and communcates the same nformaton to ts neghbors. Requrng routers to synchronze ther update actvty every tme any one of them must change ts routng table ncurs excessve communcaton overhead. Accordngly, DASM uses generalzed dffusng computatons to ensure loop freedom only when a suffcent condton for loop-freedom s not met after an nput event s receved, and behaves much lke the Dstrbuted Bellman-Ford (DBF) algorthm when such a condton s met. Accordngly, each router that uses DASM can be n one of two states: actve and passve. Routers begn executon n the passve state and need to know only about ther own exstence; they may becomes actve at varous tmes by sendng queres to all ts neghbors. When the router receves a reply from each neghbor, t may ether become passve or stay actve. The tme nterval between sendng a query and recevng the last reply to that query s called an actve phase, and multple actve phases for a destnaton can occur successvely, but may not overlap. A flag rjk s mantaned to ensure ths behavor: rjk s true f router has sent a query to router k for destnaton j but has not yet receved a reply and false otherwse. As wth DUAL [5], DASM cannot send a query durng an actve phase, so that once a router sends a query to ts neghbors for

3 destnaton j, the same router cannot send more queres for destnaton j, untl all reples are receved. When router sends a query for destnaton j, router sets r jk = true for all k 2 N,andsets r jk = false when a reply from router k s receved. Router s not allowed to send another query for destnaton j untl r jk = false for all k 2 N (the tme at whch ths frst occurs after sendng a query marks the end of an actve phase). Ths prevents actve phases from overlappng, whch smplfes the state that each router needs to mantan for each destnaton. The rest of ths secton descrbes the condtons used n DASM to determne when to nvoke generalzed dffusng computatons, how generalzed dffusng computatons work n DASM n statc topologes, how topology changes are handled, and why DASM supports not only multple paths to each destnaton n a flat topology, but also loop-free multpath area routng. 3.2 Suffcent Condtons for Loop-Free Routng DASM avods routng-table loops by forcng routers to choose as ther next hops to destnatons only among those neghbor routers that satsfy a destnaton-based orderng constrant that s vald for all routers n the network. Smply put, for a gven destnaton, a router a s gven a label such that t can use a neghbor router b as a successor to the destnaton f and only f b s label s strctly smaller than a s own label. The followng descrbes how DASM accomplshes ths makng use of the followng varables: FD j: s the feasble dstance at router for destnaton j. Sj: s the set of neghbors of router that are used as successors of router for destnaton j. Ths setrepresents the neghbors to use along all loop-free paths mantaned by the routngalgorthm. Djk: the dstance reported by neghbor k n an update, query, or reply. Djk: an upper bound on neghbor k s feasble dstance. RD j: the cost for destnaton j that wll be used n messages sent to neghbors. Let 2 V be an arbtrary router n graph G(V; E). For each destnaton j, and every router k 2 N, DASM requres that router mantans a label FD j representng a feasble dstance and a label Djk that by desgn satsfes FD k j Djk at all tmes (ths s proven n Theorem 1). Because FD k j represents a value avalable at router k (whch s a neghbor of router ), and gven that Djk and FD j represent values avalable at router, the condton FD k j Djk mples that router has an upper bound on each of ts neghbor s feasble dstances for destnaton j, and loop-free paths are easly obtaned by requrng that the next router along a path have a feasble dstance smaller than the current router s feasble dstance. The followng defnton specfes ths orderng constrant as mposed n DASM: Defnton 1: Loop-Free Routng Condton (LRC). Router can choose any neghbor router n the set Sj = fk 2 N j Djk < FD jg. Clearly, for any router k n Sj, FD k j < FD j. Then, provded that all labels are properly updated, loop-free multpath routes are obtaned at each nstant of tme by smply choosng, at each router any router n Sj as the next hop. Furthermore, f Sj contans routers other than ones along the shortest path, there are more avalable paths to a destnaton than what s possble wth shortest-path routng alone. In order to mantan the condton FD k j < FD j at all tmes, DASM behaves dfferently wthn a passve phase than wthn an actve phase. Whle passve (for destnaton j), a router s feasble dstance must be a decreasng (as opposed to monotoncally ncreasng) functon of tme, and ts feasble dstance must be no larger than ts actual dstance to the destnaton. Thus, f the dstance that wll be reported to neghbors falls below the feasble dstance, the feasble dstance must be decreased. Router can explot ths behavor as descrbed below to mantan an upper bound on router k s feasble dstance, thus ensurng loop-free routng whle routers are passve. It s also mportant, however, for the neghbor provdng the shortest path to be n router s successor set, and f ths s not true, router must ncrease ts feasble dstance. Ths s done n two steps. Frst a query contanng the desred dstance s sent, startng an actve phase. Ths query n effect asks permsson from router s neghbors for router to rase ts feasble dstance. When a reply has been receved from each neghbor, endng the actve phase (see Secton 3.5 for how lnk falures are handled), router can safely rase ts feasble dstance to the lowest value reported n any message snce the query. Between recevng a query and sendng a reply, an addtonal varable s used to track the mnmum reported dstance snce the query was receved, and ths becomes the new upper bound once the reply s sent. Ths s descrbed n detal below, and n subsequent sectons, addtonal condtons on the behavor of a router durng an actve phases are ntroduced. These condtons are needed for ensurng convergence and termnaton. To proceed, several addtonal defntons are needed: ~D jk: an upper bound on the feasble dstance of neghbor k after a query from the neghbor s processed and before the next reply s sent. QS j: the set of routers for whch a query has been receved, by router, but for whch a reply has not been sent. The followng summarzes the way n whch the values of Djk and FD j are updated to make LRC a vald orderng constrant. Intally, Sj = ;, rjk = false, and the values of the remanng varables are nfnte, except when = j, n whch case FD j j = RD j j =0. At router 6= j, FD j RD j,andfd j ncreases only at the end of an actve phase, at whch pont can rase FD j to the mnmum value of RD j that occurred durng the actve phase. When router k sends a message to router, the value n the message wll be the current value of RD k j. When router receves ths message, t sets Djk to that value, and updates Djk so that t contans the mnmum of Djk and the prevous value of Djk. If the message was a query, router also sets D ~ jk to the new value of Djk, and subsequently sets D ~ jk to the mnmum of Djk and the prevous value of D ~ jk upon recevng each addtonal message from router k untl router sends router k a reply. When the reply s sent, Djk s set to D ~ jk. Whether a reply has been sent or not s determned by usng the set QS j a neghborng router m s added to ths set when a query for destnaton j s receved from router m, and router m s removed from QS j when a reply for destnaton j s sent by router to router m. Ths s llustrated n Fgure 2 (although ~ D jk and QS j are not shown). It s worth pontng out that when router s passve, Djk = D ~ jk. As we wll show n Secton 4.1, the above mples that FD k j Djk. Therefore, because the successor set Sj satsfes Sj = fk 2 N j Djk < FD jg, then loop-free routng follows because a loop would mply that FD j < FD j, whch s not possble. AlthoughLRC leads to loop-free paths at every nstant, the paths obtaned by smply applyng LRC need not be useful addtonal condtons are needed, whch we dscuss subsequently.

4 FD k j RD j k D * jk Q node k s actve actve phase 1 R Q actve phase 2 tme R Q = Query R = Reply propagaton delay Actve Perod Fg. 2. Feasblty Condton and Reported Dstances 3.3 Condtons for Local Computatons A router s sad to use a local computaton for destnaton j when t updates ts routng-table entry for that destnaton wthout requrng any nternodal synchronzaton. In such a case, we say that router s n the passve state. In passve state, a router sends only updates or reples to queres, but t does not send ts own queres. Because nternodal synchronzaton requres addtonal communcaton overhead, t s desrable for routers to execute local computatons as much as possble, but wthout creatng loops. Because DASM s desgned to provde shortest multpaths, routers should be allowed to update ther successor sets (.e., whch neghbors they can use to reach destnatons) wthout synchronzng wth other routers, as long as those successorsets contan neghbors that provde shortest paths to destnatons. Otherwse, the lengths of the loop-free paths obtaned usng LRC could ncrease wthout bound, even f they are loop-free. Hence, a router remans passve as long as LRC yelds paths that nclude shortest paths. The followng descrbes how DASM accomplshes ths usng the followng varables: D j mn : the cost of a path from router to destnaton j along the shortest path. D j mn = mnfd jk + lk j k 2 N g, assumng that Djk has been updated f router s respondng to a message. Zj: the set of neghbors of router that le along a shortest path to destnaton j, and s computed after D j mn s updated. SjP1 : the value the successor set of router would have after an actve-to-passve transton or f router remans passve. SjP1 = fk 2 N j D ~ jk < mn(fd j;d j mn )g, andscomputed after D ~ jk, FD j,andd j mn are updated. In terms of the above varables, DASM allows a router to execute local computatons for destnaton j as long as Zj \ SjP1 6= ;. If router s passve when a message has been receved for destnaton j or a lnk-cost change has occurred, and Djk, Djk, QS j, Sj, D j mn, Z j,and D ~ jk havebeenupdated, thenrouter wll reman passve (and therefore execute local computatons) f Zj \ SjP1 6= ;. If ths condton s true, then router updates several varable: RD j D j mn, S j SjP1,and FD j mn(fd j;d j mn ). Router then sends updates to all ts neghbors f RD j has changed. If Zj \ SjP1 = ;, then router must become actve. In ths case, f Sj = ;, thenrd j 1. Otherwse a value must be chosen. Ths value can be ether 1 or some value n fdjk + lk j k 2 N g,butfqs j 6= ;, then the value must be at least as large as mnfdjk + lk j k 2 QS jg. 3.4 Internodal Synchronzaton A router becomes actve when LRC does not yeld any shortest path. At that pont, the router must synchronze wth ts neghbors, before t can brng new neghbors to ts successor set to reflect the changes caused by the nput event that makes the router update ts routng table. Internodal synchronzaton n DASM s based on generalzed dffusng computatons, whch dffer from the dffusng computatons used n DUAL n that a router can change ts query successor set wthn a dffusng computaton and can reply to the members of ts query successor set and become a root of a dffusng computaton (DUAL by contrast requres ths set contan a sngle member for the duraton of a dffusng computaton unless the lnk to that member fals). Secton 4.3 provdes condtons under whch ths can be done. The key dea s to explot loop-freedom and to requre that a router never empty ts successor set unless (a) the router becomes passve wth nfnte feasble dstance or (b) a topology change has made the successor unreachable. Wth loop-free paths, a path must ether reach the destnaton, or reach a router wth an empty successor set. Furthermore, except n response to a lnk falure, a router can prevent a neghborng router from leavng the router s successor set by not replyng to a query untl router wll ether have some other router n ts successor set (ths may requre that router send a query wth a suffcently hgh feasble dstance so another successor can be obtaned) or wll become passve wth nfnte feasble dstance (n whch case all the neghbors wll have reported an nfnte dstance, so a passve router wth nfnte feasble dstance has an empty successor set and the defnton of a successor set ensures that such a router s not n any other router s successor set). The requrement that a router never empty ts successor set unless (a) or (b) hold mples that, f router has no successors and s also n the successor set of a neghborng router, then router must be actve and n fact only a lnk falure can cause router to become actve whle stll n the successor set of another node. Hence, as long as an actve router eventually becomes passve (condtons that ensure ths are gven below), then n a stable topology, all routers wth no successors wll eventually become passve routers that cannot be n the successor set of any other routers. Once ths happens, all paths wll lead to the destnaton, and all routers for whch the destnaton s not reachable wll have empty successor sets. We now proceed by descrbng the nternodal sychronzaton mechansms n DASM n detal. When a router receves a query from a destnaton that s not n ts successor set, the router must send a reply to ensure that the lveness property gven n Secton 4.2 holds. Otherwse, when the local computaton condton does not hold at router for destnaton j, router begns or jons a generalzed dffusng computaton by sendng queres to ts neghbors usng the new value chosen for RD j n the queres. Durng ths actve phase, FD j s not ncreased. At the end of the actve phase, FD j wll ncrease to RD j f router starts another actve phase, and wll assume a value no larger than RD j f router becomes passve. The behavor of router at the end of an actve phase (where rjk = false for all k) s determned by a varable SjP2 defned as follows: SjP2 : At the end of an actve phase, S jp2 s the successor set that router would have for destnaton j f router becomes passve for destnaton j. SjP2 = fk 2 N j D ~ jk < mn(d j mn ; RD j)g. If SjP2 \ Z j 6= ;, a neghbor n SjP2 wll provde the shortest path to destnaton j, and router can become passve, settng Sj SjP2, RD j D j mn,andfd j mn(rd j;d j mn ). In becomng passve, router wll also send reples to all neghbors n QS j,and

5 wll send updates as needed to announce changes n RD j.ifsjp2 \ Zj = ; and RD j = 1, then router can also become passve. In ths case, D j mn s also 1, and router wll become passve wth FD j = 1. If SjP2 \ Z j = ; and RD j 6= 1, router must start a new actve phase, and to do ths, t must rase ts feasble dstance. The method used ensures that n a stable topology, router can become passve after a fnte number of actve phases. Frst, router sets FD j RD j, and then sets Sj fk 2 N j Djk < FD jg. If Sj = ;, thenrd j 1;elsef QS j 6= ;, thenrd j mnfdjk + l k j k 2 QS j g,otherwserd j mnfdjk + lk j k 2 Sjg. Because a neghbor can only rase ts feasble dstance when the neghbor receves a reply to a query, and because a router does not have to reply mmedately to a query from any router n ts successor set, a router can keep a neghbor n ts successor set long enough for the router to rase ts feasble dstance suffcently that the router becomes passve. Fnally, f, durng an actve phase, an event results n Zj \ SjP1 6= ;^RD j D j mn at router for destnaton j, then router may send reples to all ts neghbors n QS j and updates as requred to all other neghbors. For performance reasons, ths s done only when QS j \fk 2 N j D ~ jk = 1g = ;. Under these condtons, router would be able to become passve f reples to all ts queres had arrved. Upstream neghbors wll, of course, behave smlarly. Under the approprate crcumstances, the root of the dffusng computaton wll then move upstream shortenng the tme needed for convergence. 3.5 Handlng of Topology Changes Lnk falures are treated as mplct reples to outstandng queres sent to a neghbor reachable over the lnk. Thus, f a falure of lnk (; k) s detected at router, router sets rjk false for each destnaton j. Because no path may traverse a lnk that has faled, router also sets Djk 1, ~D jk 1,andDjk 1.DASM then behaves just as t would for any other event. 3.6 Loop-Free Area Routng Suppose each area s represented by a separate entry n the routng tables, and that a destnaton can belong to more than one area. Whle one could add routng-table entres to represent such ntersectons, ths would ncrease table szes and the length or number of routng-table updates that would have to be sent. We can avod the need for these addtonal table entres as follows. Consder a graph G(V; E) and let J = fj 1;j 2;:::;j mg beaset of m destnatons such that J V.LetFD J = mnffd jn j jn 2 Jg. Furthermore, let SJ = fx j8(j n 2 J) :(D jnx < FD J )g We defne the successor graph SG J of graph G(V;E) for a set of destnatons J at tme t to be a drected graph wth the same routers as those n G(V;E), but for whch a drected edge from router 2 V to router k 2 V exsts f and only f k 2 SJ. Loop-free routng follows mmedately, as s shown n Theorem 3. Thus, to route to a router v that s n more than one area, one can set J to be the destnatons representng the areas that contan v, and use S J n SJ tme. to determne a successor. No matter what successor s used, the path wll always be loop free at each nstant of 4. Correctness of DASM The correctness proof for DASM requres provng that (1) DASM s loop free at every nstant of tme, (2) DASM ensures that a router wll not wat ndefntely before recevng reples to queres, (3) n a stable topology DASM converges n C j (the routers wth no paths to destnaton j), and (4) n a stable topology, DASM converges n C j (the routers for whch a path to destnaton j exsts). For purposes of the proof, varables n DASM are modeled as functons of tme, wth an equvalent defnton of Djk that avods the need to use the varable D ~ jk. 4.1 Loop Freedom For a router, a destnaton j, and neghbor k of router, FD j(t) s the feasble dstance at router, RD j(t) s the dstance that router wll report n an update, Mjk s the set of tmes at whch router processes a message from router k for destnaton j, andxmt k (t) s the tme at whch a message processed by router at tme t was sent by router k. Djk(t) s defned as follows: Defnton 2: Let G(V;E) be a graph, let 2 V be a router, let j 2 V be a destnaton, and let k 2 N be a neghbor of router. Then Djk(t) s a functon satsfyng the followng condtons: When lnk (; k) s not operatonal or has just recovered, or when router ntalzes tself at tme t, D (t) =1. Suppose router sends a reply to router k at tme t r. Let t 1 be the last tme before or at t r at whch ether a query from router k was processed, lnk (; k) recovered, or router ntalzed tself. Then Djk(t r) = mnfrd k j (xmt k ()) j 2 M jk \ [t 1; t r]g. Otherwse, Djk(t) = mn(frd k (xmt k ()) j 2 M jk \ [t 2; t]g[fd jk(t 2)g), wheret 2 s the last tme before t when router ether sent router k a reply, detected a lnk recovery for lnk (; k), or ntalzed tself. Lemma 1: Let G(V; E) be a graph n whch each router runs DASM. If router 2 V ntalzes tself or receves the last reply to a query for destnaton j 2 V at tme t, all undelvered messages (f any) sent by router for destnaton j wll contan a dstance greater than or equal to RD j(t, ), the value mmedately before router processes the last reply. Proof: When a router ntalzes tself, there are no undelvered messages. The lemma holds n ths case. DASM requres that all messages be delvered n FIFO order, and that all messages that are undelvered before a lnk falure are lost. Thus, all messages that router orgnated before sendng a query wll ether have been lost or delvered. For some destnaton, the reply dstance of a router must be a decreasng functon of tme over the nterval between sendng a query for that destnaton and recevng the last reply to that query. Accordngly, all messages from router that are undelvered when the last reply to that query s receved must contan a value greater than or equal to RD j(t, ). Lemma 2: Let G(V; E) be a graph n whch each router runs DASM, and let j 2 V be a destnaton. At tme t, when a router 2 V ntalzes tself or receves ts last reply f t had become actve, any neghbor k 2 N that can use router as a feasble successorfor some destnaton j wll have ether set Dj k (t) to some value such that RD j(t, ) Dj k (t). Proof: At t =0, all routers ntalze themselves and set the dstance to ther neghbors to 1. The lemma s consequently true at tme t =0. At any pont at whch a router has become actve, or at whch t wll stay actve after recevng reples from all ts neghbors, the router wll send queres to all ts neghbors when orgnatng a dffusng computaton, and wll send queres to all ts neghbors. Suppose that, at tme t 2, router receves ts last reply to a query for destnaton j sent at tme t 1. Let RD j(t + 1 ) be the value of the reply dstance for router that wll be sent n the query generated at tme t 1,andletRD j(t, ) be the value of the reply dstance for router just before t receves ts last reply. Because jk

6 RD j s a decreasng functon n (t 1;t), RD j(t + 1 ) RD j(t, ). Because router s actve for all t 2 (t 1;t), and accordng to DASM s operaton, router can only send messages for destnaton j contanng a dstance RD j() at some tme 2 (t 1;t) f RD j() mnfrd j(t 0 ) j t 0 2 (t 1;t)g. Suppose that router has sent a query to router k. Unless the lnk from router fals n (t 1;t), router k wll have processed that query and router wll have receved ts reply sometme at or before t. When router k sends ts reply at tme t r, t wll have receved a query contanng the value RD j(t + 1 ) and wll have set Dk j (t r) to the mnmum value or RD j receved n the query or a subsequent update. Because RD j s a decreasng functon of tme n (t 1;t), and because router k receved the query transmtted from router at tme t 1, RD j(t, ) s less than or equal to the value n the last message receved by router k before tme t. Thus, RD j(t, ) Dj k (t). If the lnk has faled at some tme t f durng (t 1;t 2), router k wll set Dj k (t f )=1. If a message from s subsequently receved durng (t f;t), router k can set Dj k (t) to some value such that Dj k (t) 2fRD j() j 2 (t f ;t)g. Ths s also true f the lnk fals multple tmes. If the lnk had faled at or before t 1 and recovered (or was ntally establshed) after t 1, then router k may or may not have receved a message (whch must have been generated after t 1) from router for destnaton j. If router k has not receved ths message, then Dj k (t) =1 n whch case RD j(t, ) Dj k (t)g, otherwse Dj k (t 2) 2fRD j(t 0 ) j t 0 2 (t + 1;t, 2 )g, n whch case RD j(t, ) Dj k (t) because RD j s a decreasng functon of tme n (t 1;t 2). Lemma 3: Let G(V; E) be a graph n whch each router runs DASM. Let and k be routers n V,andj be a destnaton. Furthermore, let k 2 N. Suppose that, at tme t a, FD j(t a) Dj k (t a), all messages that are undelvered (but not lost) at tme t a and that are generated by router before t a contan a dstance at least as large as FD j(t a), andthatfd j s a decreasng functon of t for t 2 [t a;t b]. ThenFD j(t) Dj k (t) for all t 2 [t a;t b]. Proof: If the lnk from router to router k fals at some tme t f 2 [t a;t b], wheret f s the earlest tme n ths nterval at whch such a lnk falure occurs, then router k wll set Dj k (t f ) to nfnty, and reset the value only when a new message for destnaton j s receved from router. The lemma thus holds when Dj k (t f )=1. In the nterval [t f ;t b], the only messages receved by router k wll have been generated by router after t f because of the operaton of the neghbor-to-neghbor protocol. Thus, there are no messages are undelvered at tme t f that wll be receved after t f, and by assumpton, Fj s a decreasng functon of t n [t f;t b], and all the condtons the lemma requres are therefore true over the nterval [t f ;t b] f these condtons are true for [t a;t b]. It s therefore suffcent to prove that the lemma s true only n the case where there are no falures of lnk (; k) n the nterval [t a;t b] By assumpton, all messages generated by router before t a and receved by router k contan dstances larger than FD j(t a), and FD j(t) FD j(t a). The lemma therefore holds when any of these messages are delvered to router k, and f no other messages or no messages at all are delvered to router k from router durng [t a;t b], the lemma s true. The remanng case s the one where at least one message generated after tme t a s receved before tme t 2 [t a;t b]/ For any message generated at tme t 0 2 [t a;t b] for destnaton j, DASM requres that RD j(t 0 ) FD j(t 0 ), and because FD j s a decreasng functon of tme n [t a;t b], t follows that FD j(t) mnfrd j() j 2 [t a;t]g for t 2 [t a;t b]. Smlarly, because Dj k (t a) FD j(t a), because all messages generated before t a and receved after t a contan dstances larger than FD j(t a), and because the defnton of Dj k requres t to contan the mnmum dstance seen n a message after ether a router ntalzed tself (at whch pont the value s nfnty), the lnk recovered (at whch pont the value s nfnty), or a query was receved for whch a reply has been sent, t follows that Dj k (t) mn(ffd j(t a)g [frd j(tau) j 2 [t a;t]g for t 2 [t a;t b]. Because FD j(t) mnfrd j() j 2 [t a;t]g, t s obvously true that FD j(t) mn(ffd j(t a)g [frd j() j 2 [t a;t]g). Consequently, FD j(t) Dj k (t) for t 2 [t a;t b].. Theorem 1: Let G be a graph n whch each router runs DASM. Let, j and k be routers n G,letj be a destnaton, and let k 2 N. Then FD j(t) Dj k (t) s true for all t 0. Proof: Consder the tmes n the nterval [0;t] at whch router ether ntalzes tself, looses all ts neghbors, or receves the last reply to a query. These tmes form a sequence L = ft 0 = 0;t 1;t 2;:::;t n <tg, wheret 0 s the tme at whch router ntalzes tself, and t 1;t 2;:::;t n are the tmes at whch router receves the last reply from some query. DASM requres that the feasble dstance of router always decrease except at the tmes n L. When a router frst ntalzes tself, the theorem s true because all ts neghbors wll set ther dstance-table entry for that router to 1 for destnaton j untl they receve a message for destnaton j contanng a lower dstance. Other than at tme t =0, DASM allows a router a router to ncrease ts feasble dstance only when t receves reples from all ts neghbors, or when t has lost all neghbors (n whch case ts neghbors wll set ther dstance for that router to 1). Thus, n the nterval [0;t 1) the Lemma 3 apples and FD j(t) Dj k (t) for all t 2 [0;t 1). The proof proceeds by nducton. Consder any tme t m 2 L and assume the theorem holds up to that tme. Accordng to Lemma 1, at any tme t 2 [t m;t m+1], any undelvered message for destnaton j that router sent before t m wll contan a dstance greater than or equal to RD j(t, m). By Lemma 2, for any neghbor k of router, Djm(t k m) wll be larger than RD j(t, m). When router receves ts last reply at tme t m, t wll change ts feasble dstance to FD j(t m)=rd j(t, m). Because DASM requres that at any router, FD j(t) RD j(t), t follows that FD j(t m) Dj k (t m). Because FD j(t) s a decreasng functon n the nterval [t m;t m+1), Lemma 3 mples that FD j(t) Dj k (t) for all t 2 [t m;t m+1). We can therefore proceed by nducton up to tme t. Theorem 2: Let G(V; E) be a graph n whch each router runs DASM. Let P j(t) be a path through G for destnaton j at tme t for whch each 2 P j(t) (other than the last router) chooses a router s as the next router n P j(t) such that s 2 Sj(t). ThenP j(t) s loop free. Proof: By defnton, each router s 2 Sj satsfes Djs(t) < FDj(t). By Theorem 1, for any router 2 P j(t), the next router s n P j(t) wll satsfy FDj s (t) Djs. By assumpton, Djs(t) < FD j(t); accordngly, t follows that FDj s (t) < FD j(t). Thus, each subsequent router along the path has a lower value for ts feasble dstance. If P j(t) contaned a loop, then for any router p 2 P j(t) that was part of such a loop, t would follow that FD p j (t) <FDp j (t). Thus, by contradcton, the path must be loop free. The followng theorem shows that DASM also provdes loopfree area routng: Theorem 3: Let G(V; E) be a graph n whch each router runs DASM. Let SG J(t) be the successor graph for graph G(V; E) and for destnaton set J at tme t. ThenSG J(t) s loop free. Proof: By defnton, for each node 2 SG J(t), every neghbor k 2 N \ SG J(t) satsfes k 2 SJ,whereSJ (t) = fx j 8(j n 2 J) : (Djnx(t) < FD J (t))g. For k 2 N,let

7 Jk (t) =fj n 2 J j Djnk(t) < FD J (t)g. Clearly, for each j n 2 Jk (t), D jnk (t) < FD J (t). By Theorem 2, FD k jn (t) D jnk (t), and thus FD k jn (t) FD J (t). By the defnton of FD k J (t), FD k J (t) FD k jn (t), and therefore FDk J (t) < FD J (t) for any k 2 SJ (t). Accordngly, f there s a loop L J(t) n SG J(t) at tme t, then for some p 2 L J(t), FD p J (t) < FDp J (t), and by contradcton, SG J(t) s loop free. 4.2 Lveness Theorem 4: Let G(V; E) be a graph n whch each router runs DASM. If router becomes actve, t wll receve a reply from each neghbor (wth lnk falures generatng mplct reples) n a fnte tme. The formal proof s essentally the same as the proof for DUAL [5], and can be descrbed nformally as follows: The frst requrement for showng that generalzed dffusng computatons termnate s to show that a router that sends a query wll always receve a reply to that query and wll eventually become passve. To ensure ths, several requrements are necessary: a router must reply mmedately to a query from any router that s not n ts successor set, a router may not rase RD j durng an actve phase (excludng ts start), and f a new actve phase begns mmedately after a prevous actve phase, then the router must rase ts reported dstance to mn(fdjk(t)+l k(t) j k 2 QS j (t)g [ f1g, and s requred to become passve f possble (n whch case the router must send reples to any neghbors stll n QS j (t)). Furthermore, f QS j (t) 6= ;, router should not decrease RD j durng an actve phase to a value below mn(fdjk(t) +lk(t) j k 2 QS j (t)g unless router reples to all routers n QS j (t). As a result, router wll ether have sent all the routers n QS j a reply durng an actve phase, or wll be able to become passve at the end of the actve phase, as long as router tself receves reples to all the queres t has sent. Thus, a router wll reply to a query unless some other router does not reply to t s query, whch cannot happen: f t dd, one can generate a sequence of routers, followng the successor graph upstream, untl one reach a router that had not repled, but s not n the successor set of any router. Because a router that s not n the successor set of any other router must send reples, t follows by contradcton that all dffusng computatons wll termnate. 4.3 Convergence n C j The proof for convergence s C j makes use of the followng sets: Defnton 3: W 1j(t)=fx 2 V j x 6= j ^ S x j (t) =;^9y :(y 2 V ^ x 2 S y j )g W 2j(t)=fx 2 V j x 6= j ^ S x j (t) =;^actve x j (t)g A 1j(t)=fx 2 V j x 6= j ^ S x j (t) 6= ;g A 2j(t)=fx 2 V j x 6= j ^ S x j (t) =;^passve x j (t)g and W j(t) = W 1j(t) [ W 2j(t), where actve x j (t) s true f and only f router x s actve for destnaton j at tme t, and passve x j (t) s true f and only f router x s passve for destnaton j at tme t. These sets are shown n Fgure 3. As proven below, DASM ensures that routers move between these sets only as shown n Fgure 4, and that the set W j(t) eventually becomes empty once the topology s stable. W j(t) contans all the routers other than the destnaton at whch a path (obtaned by followng successors)termnates, so once W j(t) s empty, all paths must be ones that go to the destnaton, and all routers that cannot reach the destnaton must have empty successor sets. j C j W j A 2j Fg. 3. The Successor Graph and Sets Wj, A 1j,andA2j Lnk change only A 1j W j A 1j C j A 2j Fg. 4. Transtons between Sets Wj, A 1j,andA2j The operaton of DASM s desgned to ensure that the followng condtons are true: R1 If an actve phase starts at tme t and Sj(t) = ;, then RD j(t) = 1. R2 Suppose an actve phase at router starts at tme t q and ends at tme t, andthatrd j() =1 for all 2 [t q;t). Then router must become passve at tme t. R3 When router s passve at tme t, andf 6= j and Sj(t) = ;,thenfd j(t) = 1 and RD j(t) = 1. R4 Suppose router s actve at tme t and that the actve phase at tme t began at tme t 1 <t.letmj be the tmes at whch router generated a message for destnaton j. Then for some 2 [t 1;t] \ Mj, RD j(t)=rd j() where RD() =1 f Sj() =;. R5 If Sj(t, ) 6= ; and router does not process a lnk event at tme t,thensj(t) 6= ; unless router becomes passve at tme t or stays passve at tme t. R6 If a router s passve at tme t, and Sj(t, ) =;,then router must stay passve at tme t. R7 f FD j(t) = 1, then router cannot be n the successor set of any other router. Lemma 4: Let G(V; E) be a graph for whch each router runs DASM and let j 2 V be a destnaton. Then W j(t) [ A 1j(t) [ A 2j(t) [fjg = V. Proof: Routers are ether actve or passve, but not both. The lemma follows by drect computaton of W j(t)[a 1j(t)[A 2j(t)[ fjg. Lemma 5: Let G(V; E) be a graph for whch each router runs DASM and let j 2 V be a destnaton. If W j(t) = ;, then A 1j(t) C j(t) and C j(t) A 2j(t). Proof: If A 1j(t)\ C j(t) 6= ;, then, because SG j(t) s acyclc by Theorem 2, startng at some router n A 1j(t) \ C j(t) and followng successors must lead to a router n C j(t) wth no successors. Such a router must be n W 1j(t),andW 1j(t) 2 W j(t). Therefore, f W j(t) =;, thena 1j(t) \ C j(t) =;. By Lemma 4, C j(t) = [W j(t)\ C j(t)][[a 1j(t)\ C j(t)][[a 2j(t)\ C j(t)]; therefore,, t follows that, f W j(t) =;,thenc j(t) =A 2j(t) \ C j(t). Accordngly, f W j(t) =;, thena 1j(t) C j(t) and C j(t) A 2j(t).

8 Lemma 6: Let G(V; E) be a graph for whch each router runs DASM and let j 2 V be a destnaton. Then all routers n W j(t) are actve (.e., W j(t) =W 2j(t)). Proof: Suppose router 2 V s passve at tme t and that 2 W 1j(t). By defnton of W 1j, Sj(t) =; and by R3, FD j(t) = 1. Thus, by R7, router cannot be n the successor set of any router. Because a router n W 1j(t) must be n the successor set of some other router by Defnton 3, the assumpton that a passve router s n W 1j(t) s false. By defnton, all routers n W 2j(t) are actve, W 1j(t) W 2j(t); therefore, W j(t) =W 2j(t). Accordngly, by Defnton 3, all routers n W j(t) are actve. Lemma 7: Let G(V; E) be a graph for whch each router runs DASM and let j 2 V be a destnaton. Then A 1j(t), A 2j(t), W j(t),andfjg are dsjont sets that cover V. Proof: By Defnton 3, fjg s dsjont from A 1j(t), A 2j(t), and W j(t). Agan by Defnton 3, both W j(t) and A 2j(t) are subsets of fx 2 V j x 6= j ^ Sj x (t) = ;g, and by defnton, A 1j(t) = fx 2 V j x 6= j ^ Sj x (t) 6= ;g. Clearly, A 1j(t) \ W j(t) =; and A 1j(t) \ A 2j(t) =;. By defnton, all routers n A 2j(t) are passve and by Lemma 6, all routers n W j(t) are actve. Thus, A 2j(t) \ W j(t) =;. anda 1j(t), A 2j(t), W j(t), and fjg are consequently dsjont sets. By Lemma 4, A 1j(t), A 2j(t), W j(t),andfjg cover V. Lemma 8: Let G(V; E) be a graph for whch each router runs DASM, let 2 V be a router, and let j 2 V be a destnaton. If 2 W j(t), then at some tme t 0 >t, 2 A 1j(t 0 ) [ A 2j(t 0 ). Proof: Suppose 2 W j() for all t. By Lemma 6, router s actve at tme t and by Theorem 4, must termnate the actve phase that exsts at tme t at some tme t 1 >t. By assumpton, 2 W j(), and accordng to Lemma 6 all routers n W j(t 1) are actve; therefore, t follows that router must begn another actve phase at tme t 1. Because Sj(t 1) = ; f 2 W j(t), then by R1, RD j(t 1)=1. By Theorem 4, ths second actve phase must termnate at some tme t 2. If 2 W j() for 2 [t 1;t 2), then Sj() =; for 2 [t 1;t 2), and by R4, RD j() =1 for 2 [t 1;t 2). Thus, mnfrd j() j 2 [t 1; t 2)g = 1. By R2, router must become passve at tme t 2, and hence, 62 W j(t 2), contradctng the assumpton that 2 W j() for all t. Gven that j 62 W j(t),then 6= j. Thus by Lemma 7, at some tme t 0 >t, 2 A 1j(t 0 ) [ A 2j(t 0 ). Lemma 9: Let G(V; E) be a graph for whch each router runs DASM, let 2 V be a router, and let j 2 V be a destnaton. Suppose that no lnk events occur after tme t c. If t > t c, 2 A 1j(t, ),then 62 W j(t). Proof: By Lemma 7, 62 W j(t, ) and by Defnton 3, Sj(t, ) 6= ;. By Lemma 6, f 2 W j(t), router must ether be actve at tme t, or change from passve to actve at tme t. Because there are no lnk events after tme t c,byr5,sj(t) 6= ; for router to be actve at tme t. Hence 62 W j(t). Lemma 10: Let G(V; E) be a graph for whch each router runs DASM, let 2 V be a router, and let j 2 V be a destnaton. Suppose that no lnk events occur after tme t c.if2a 2j(t, ) for t, >t c,then 62 W j(t). Proof: By Defnton 3, router s passve at tme t, and Sj(t, ) 6= ;. By R6, router must reman passve at tme t, and therefore 62 W j(t) because accordng to Lemma 6, all routers n W j(t) are actve. Theorem 5: Let G(V; E) be a graph for whch each router runs DASM, and let j 2 V be a destnaton. If no lnk events occur after tme t c, then there must exst a tme t f >t c such that for all t t f, W j(t) =; and C j(t) A 2j(t). Proof: By Lemmas 7 and 8, any router 2 W j(t c) must satsfy 62 W j(t 0 ) and 2 A 1j(t 0 ) [ A 2j(t 0 ) for some tme t 0 > t c. By Lemmas 9, 10, the assumpton that there are no lnk events after t c, and the condton 2 A 1j(t 0 ) [ A 2j (t 0 ), t follows that 62 W j(t) for all t>t 0. Because W j(t c) can contan only a fnte number of routers, there must exst a tme t f such that W j(t) =; for all t t f. Because W j(t) =; for all t t f, Lemma 8 mples that C j(t) A 2j(t) for t t f. Theorem 5 shows that eventually for destnaton j,gven a stable network, every router n C j wll be n the set A 2j(t) for t>t f,and the defnton of A 2j(t) requres that members of ths set be passve wth an empty successor set. The operaton of DASM also ensures that routers n ths state have ther dstance to j set to nfnty, thus ensurng convergence n the C j wth correct dstances. Termnaton follows because DASM does not send messages (other than reples to queres) when passve unless dstances change. 4.4 Convergence n C j The proof for convergence n C j s omtted; t s smlar to the proof for DUAL [5] and follows by an nductve argument. The dea behnd the proof s to show that, wth a stable topology, all routers n C j eventually have obtaned dstances from each neghbor at least as large as the dstances along the shortest paths through those neghbors. The proof then shows that the router whose shortest-path dstance to the destnaton s smallest (ths must be a neghbor of the destnaton) wll become passve wth the correct dstance, and only send reples to queres. 5. Complexty of DASM DASM s complexty s measured by the number of steps, called tme complexty or TC, and the number of messages,called communcaton complexty or CC, requred by the algorthms after a sngle change n the cost or status of a lnk. To calculate DASM s complexty, t s necessary to assume that the algorthms under study behave synchronously, so that every router n the network executes a step of the algorthm smultaneously at fxed ponts n tme. At each step, a router receves and processes all nput events orgnated durng the precedng step, and, f needed, creates an update message after processng each nput event; all these update messages are transmtted n the same step. The frst step occurs when at least one router detects a topologcal change and ssues update messages to ts neghbors. Durng the last step, at least one router receves and processes updates from ts neghbors, after whch all routng tables are correct and routers stop transmttng updatesuntl a new topologcal change takes place. DASM has the same tme and communcaton complexty as DUAL. After a sngle lnk falure or lnk-cost ncrease, DASM has TC = O(x) [5] [10], where x s the number of routers affected by the routng-table perturbaton. To verfy ths, we note that n the worst case all routers upstream of a destnaton router j n SG j must partcpate n a dffusng computaton for router j, whch corresponds to the operaton of DUAL. DASM s communcaton complexty s the same as DUAL s,.e., CC = O(6D x), whered s the maxmum degree of a router; ths s verfed n [5]. After a sngle lnk addton or lnk-cost reducton, DASM has TC = O(d) and CC = O(E), wheree s the number of lnks n the network and d s the network dameter (.e., the length of the longest shortest path n hops between any two network routers). To verfy ths, note that any router that receves a query reportng a dstance decrease must be able to fnd a feasble successor; accordngly, a router that sends a query after ts dstance decreases must receve mmedate reples from all ts neghbors, wthout those neghbors havng to forward the query. On the other hand, routers as far as d hops from the router detectng the change may requre to send an update after recevng an update from a neghbor on ther successor set, and all routers may have to send an update as a result of the update they