Understanding BGP Miscounfiguration

Size: px

Start display at page:

Download "Understanding BGP Miscounfiguration"

Myron Small
6 years ago
Views:

1 Understanding Archana P Student of Department of Electrical & Computer Engineering Missouri University of Science and Technology appgqb@mst.edu 16 Feb 2017

2 Introduction Background Misconfiguration Outline Methodology to identify misconfiguration Results Causes of Misconfiguration Discussion Conclusion 2

3 Introduction Background Misconfiguration Outline Methodology to identify misconfiguration Results Causes of Misconfiguration Discussion Conclusion 3

4 Introduction BGP is crucial to the overall reliability of the Internet BGP configuration errors can disrupt Internet connectivity Misconfigurations can increase the update load on routers Leads to global connectivity problems. Pakistan youtube blocking 4

5 Introduction How frequently do these misconfigurations occur? 5

6 Introduction How frequently do these misconfigurations occur? 3 in 4 of the new prefix announcements seen each day are the result of misconfiguration. Despite this, we find connectivity to be surprisingly robust only 4% of the bad announcements disrupt connectivity. 6

7 Introduction Probable causes of Misconfiguration Involuntary slips by network operators Router initialization bugs Poor understanding of configuration semantics 7

8 Introduction Background Misconfiguration Outline Methodology to identify misconfiguration Results Causes of Misconfiguration Discussion Conclusion 8

9 Background BGP is a policy based protocol AS chooses among the multiple routes it receives for the same prefix according to its own criteria prefix filters, access lists, and route maps 9

10 Outline Introduction Background Misconfiguration Methodology to identify misconfiguration Results Causes of Misconfiguration Discussion Conclusion 10

11 Misconfigurations: Misconfiguration configuration errors that result in the unintended production or suppression of BGP routing announcements 11

12 Misconfiguration Two types of globally visible BGP misconfigurations: Origin Misconfiguration AS accidentally injects a prefix into the BGP tables. Eg. 1. Hijacks 2. Propagating prefixes meant to stay inside a private network Export Misconfiguration Router exported a route it should have filtered Effects 1.Routing load 2.Connectivity disruption 12

13 Outline Introduction Background Misconfiguration Methodology to identify misconfiguration Results Causes of Misconfiguration Discussion Conclusion 13

14 RouteViews is used. Methodology Identifying is difficult Misconfigurations have signatures that are similar to those of events such as failures and policy changes 14

15 Methodology 45% of the changes last less than a day 30% of them lasted more than 7 days 15

16 Methodology 1. Origin Misconfiguration Analysis Unintentional insertion of a route into the global BGP tables Historical BGP data from the previous day is used to differentiate between new routes and old routes 16

17 Methodology Self deaggregation origin deaggregates its own prefix Related origin existing prefix or its subset by a new origin that appears related to the old origin Foreign origin prefix or its subset by a different origin 17

18 Methodology 2. Export Misconfiguration Analysis Inadvertent export of a route to a BGP peer in violation of the exporter s policy. Export policies depend on commercial relationships between ASs. If relationships between ASs is known, detecting export misconfigurations would be straightforward But AS relationships are closely guarded secrets 18

19 3. Survey Methodology 4. Testing Connectivity connectivity verifier to determine the extent of disruption downloaded the current BGP table from RouteViews checked if the prefix was reachable from various vantage points 19

20 Outline Introduction Background Misconfiguration Methodology to identify misconfiguration Results Causes of Misconfiguration Discussion Conclusion 20

21 Results Results collected over a period of 21 days 1. Origin Misconfiguration : Most of the contribution comes from self deaggregation. Prefixes from related origin and foreign origin incidents contribute roughly the same, smaller amount. At least 72% of new routes in a the day are the result of misconfiguration. 21

22 Results Reason for misidentifying related and foreign origin misconfiguration is backup arrangements Connectivity: Connectivity test & responses confirmed that connectivity gets disrupted. Difficult to observe connectivity problem 1. No means of detecting connectivity problems 2. Short-lived incidents 22

23 Results Duration of Misconfigurations 23

24 Results 2. Export Misconfiguration Do not cause connectivity problems directly They bring extra traffic to the AS 3. Routing Load Misconfigurations increase the load on the routing system It inserts spurious prefixes in the BGP tables 24

25 Outline Introduction Background Misconfiguration Methodology to identify misconfiguration Results Causes of Misconfiguration Discussion Conclusion 25

26 CAUSES OF MISCONFIGURATIONS Categorised in Slips and Mistakes 1. Origin Misconfigurations 26

27 CAUSES OF MISCONFIGURATIONS Export Misconfiguration Prefix based config Initialization bug Forgotten filter Community Unknown config error 27

28 CAUSES OF MISCONFIGURATIONS Prefix based config 28

29 Outline Introduction Background Misconfiguration Methodology to identify misconfiguration Results Causes of Misconfiguration Discussion Conclusion 29

30 Discussion Measures taken to reduce the Internet s vulnerability to accidental errors. 1. User Interface Design The more serious the consequences of the error, the less likely it should be used by an operator. Dangerous features redistribution could be changed Some features are more error-prone than others Poor understanding of router command semantics 30

31 Discussion 2. High-Level Languages and Checking Internet Routing Registries (IRRs), various network management systems (NMSs) NMSs are not flexible to support full range of ISP policy Consistency checking within configuration Highly effective 31

32 Discussion 3. Database Consistency and Registries Result of incorrect or inconsistent data being used for configuration Three types of databases 1. Routers own version of configuration information 2. ISP maintains configuration-related data in NMS 3. Policies maintained in industry-wide IRRs They should be derived from each other 32

33 Discussion 4. Protocol Extensions S-BGP Routing announcements are authorized and authenticated as they travel along the AS-path It prevents 1. Related and foreign origin misconfigurations 2. Hijacks But does not prevent self deaggregation Need a tool to verify the dynamic state of the system 33

34 Outline Introduction Background Misconfiguration Methodology to identify misconfiguration Results Causes of Misconfiguration Discussion Conclusion 34

35 Conclusion 0.2-1% of the global table size, suffer from misconfiguration each day. 3 in 4 of the new route announcements per day are the result of misconfiguration. Ultimate goal is to understand how human errors can be minimized in large distributed systems There is much that can be done to improve the operational reliability of Internet routing 35

36 References Ratul Mahajan, David Wetherall, and Tom Anderson, Understanding BGP Misconfiguration, in Proceedings of the ACM SIGCOMM Conference, Pittsburgh, PA, August 2002, pp ol 36

37 End of Foils 37

A Measurement Study of BGP Misconfiguration

A Measurement Study of BGP Misconfiguration Ratul Mahajan, David Wetherall, and Tom Anderson University of Washington Motivation Routing protocols are robust against failures Meaning fail-stop link and