Reverse traceroutes. Presented by F.E. Bustamante

Transcription

1 Reverse traceroutes Ethan Katz- Basse3, Harsha V. Madhyastha, Vijay K. Adhikari, Colin Sco3, JusCne Sherry, Peter van Wesep, Arvind Krishnamurthy, Thomas Anderson NSDI 2010 Presented by F.E. Bustamante 1

2 Data centers need reverse path Clients in Taiwan experienced 500ms latency Actual problem encountered by Google [IMC09] Is client served by a distant data center? No Is path from data center to client indirect? No How about the reverse path?! Need reverse path to clients for troubleshoocng 2

3 Researchers need reverse path Without, unrealiscc assumpcons of symmetry Path prediccon Geolocaiton ISP performance analysis Prefix hijack deteccon Network topology mapping 3

4 Everyone does The number one go- to tool is traceroute. Asymmetric paths are the number one plague. The reverse path itself is completely invisible NANOG Network operators troubleshoocng tutorial, 2009 Goal: Reverse traceroute, without control of descnacon and deployable today without new support 4

5 Goal and basic idea Traceroute gives S to D, but likely asymmetric Can t use traceroute s TTL limicng on reverse path V1 V1 Basic idea Create a bootstrapping atlas using TRs from vantage points S S Incrementally get path from D uncl it intersects atlas Using IP RR and TS opcons Compose the paths D D SS V3 V3 V2 V2 (a) Vantage points traceroute to S, creating (b) Va (a) Vantage points traceroute to S, creating (b) V an atlas of known paths. til it in an atlas of known paths. 5 til it Figure 1: High-level overview of the reverse tracero

6 Create atlas of known paths Use mulcple vantage points (VPs) to TR to S Construct atlas of paths to S DesCnaCon- based roucng if we hit part of the path, we know the rest Use atlas to bootstrap S V1 D S V2 V3 (a) Vantage points traceroute to, creating (b) V til it i Figure 1: High-level overview of the reverse tracer 6

7 Reverse hops with IP opcons Key idea path from Ri depends only on S, neither on the source nor on the path from D to Ri Get the segments from D uncl path intersects atlas Compose to get the reverse path To get the segments S V1 R4 R3 R2 R1 D S V3 V2 (b) Vantage points measure path from D until it intersects a path in the atlas. Figure 1: High-level overview of the reverse traceroute technique. We explain how to measure 7 (

8 Two handy IP opcons IP Record- route (RR) If set, probe records router interfaces it encounters, limited to 9 RR- Ping(S- >D) S issues ICMP Echo Request (ping) probe to D if RR slots remain when D sends its response, routers on the reverse path will record some of that route 8

9 Two handy IP opcons IP Cmestamp (TS) Each probe can specify up to 4 IP addresses, in order If probe traverse the router matching the next IP address yet to be stamped, router records a TS Router will not Cmestamp if its IP address is in the list but is not the next one TS- Query- Ping(S- >D D, R) R will record its Cmestamp only if it is encountered by the probe aper D has stamped the packet For their goal, the actual TS is meaningless 9

10 IP opcons and spoofing To get the segments Unlike TTL, IP opcons are reflected in reply Spoof to best use RR get closer Source- spoofed probe: prober sets the S address to another s When V probes D spoofing as S, D s response will go to S S V1 R4 R3 R2 V2 R1 D V3 S (b) Vantage points measure path from D until it intersects a path in the atlas. Figure 1: High-level overview of the reverse traceroute technique. We explain how to measure 10 (

11 Last few wrinkles If nobody known is close If neither S nor any of the VPs is within 8 hops of R3 Pick potencal adjacent routers from an Internet map Use TS- Query- Ping to verify which one is the next hop And if everything else fails Back to the symmetric assumpcon use TRand assume a symmetric traversal of the last link, then compose from there Plus a number of implementacon hacks 11

12 Key points Works without control of descnacon MulCple VPs SCtch path hop- by- hop TR atlas provides Baseline paths Adjacencies IP opcons work over forward and reverse path Spoofing lets it use VPs in best posicon 12

13 Deployment Coverage Ced to set of spoofing VPs Current VPs: PL/M- Lab ~90 sites did not filter spoofing Sources: Closed system of PL sources, demo to show it Future plans RecruiCng more VPs to increase coverage Open the system to outside sources 13

14 EvaluaCon PL dataset TR to TR, two different days Similar to the atlas phase Coarser granularity, smaller set Guessing with TR/ assuming symmetry 14

15 EvaluaCon TR server dataset Revtr PoP-level Guess Fwd PoP 15

16 ApplicaCon(s) Forward path from UCF to IP address AS name Location RTT UCF Orlando, FL 0ms FloridaNet Orlando, FL 0ms FloridaNet Jacksonville, FL 3ms Cox Comm. Atlanta, GA 9ms Cox Comm. Ashburn, VA 116ms Internap Washington, DC 35ms Internap Washington, DC 26ms Internap Washington, DC 24ms Internap Miami, FL 53ms Internap Seattle, WA 149ms Table 1: Traceroute giving forward path from University of 16

17 ApplicaCon(s) Reverse TR back to UCF from IP address AS name Location RTT Internap Seattle, WA 148ms Internap Seattle, WA 141ms TransitRail Los Angeles, CA 118ms TransitRail Los Angeles, CA 118ms TransitRail Palo Alto, CA 109ms TransitRail Seattle, WA 92ms TransitRail Chicago, IL 41ms TransitRail Ashburn, VA 23ms UCF Orlando, FL 0ms UCF Orlando, FL 0ms Table 2: Reverse traceroute giving reverse path from The detour through LA was due to a roucng misconfiguracon (Internap and TransitRail connect in Sea3le) 17

18 Conclusion Traceroute is great, but we lack reverse path Reverse traceroute to address this MulCple VPs to build the path incrementally Gives most hops as if you issued TR from descnacon, without needing to control it Coverage may be a problem Demo is down WaiCng to be made open system to outside sources 18