Network king Progr ram Trus stworthy An Analysis of ARIN NetHandles with OriginAS i Data and Analysis of RIR/IRR Registry Data O. Kim, K. Sriram, O. Borchert, P. Gleichmann, and D. Montgomery Presentation at ARIN XXIII, San Antonio, TX April 26-29, 29 2009 Contacts: okim@nist.gov, ksriram@nist.gov, dougm@nist.gov Project Website: www.antd.nist.gov/bgp_security
Outline Problem statement Analysis of ARIN NetHandles with OriginAS i Analysis of Global Registries (comparisons with what is announced in BGP) 2
What is the Problem? Current registry data is considered inaccurate, incomplete Despite weaknesses, data is used for: Local route filtering Debugging purposes No comprehensive investigations to date Improving quality and completeness of routing data could enable new BGP robustness mechanisms 3
Registry Data Object Counts by Source route inetnum (ARIN NetHandle) aut-num (ARIN ASHandle) RIR/IRR 06/18/2007 10/18/2008 Incr 06/18/2007 10/18/2008 Incr 06/18/2007 10/18/2008 Incr ARIN 7,330 8,201 12% 338 (1,618,197) 434 (1,924,454) 28% 19% 758 (18,050) 890 (19,678) RIPENCC 71,569 89,957 26% 2,044,536 2,458,119 20% 14,106 16,969 20% APNIC* 23,616 35,515 50% 822,891 1,080,999 31% 4,559 5,347 17% AFRINIC 0 0 13,948 22,706 63% 342 445 30% LACNIC** 0 0 45,346 83,036 83% 1,219 1,339 10% Standalone IRRs+ 345,129 497,124 44% 1 1 3,785 4,643 23% Total: 447,644 630,797 41% 2,927,060 (1,618,197) 3,645,295 (1,924,454) 25% 19% 24,769 (18,050) 29,633 (19,678) 17% 9% 20% 9% * Includes TWNIC, JPIRR, JPNIC and APNIC ** RIR only + Independent IRR databases that are mirrored via the RADB website including RADB, but EXCLUDING ARIN, APNIC, JPIRR and RIPE Note that route objects can be registered at any IRR regardless of where the address spaces are allocated. 4
Distribution of Prefix Length of inetnum (RPSL) and NetHandle (SWIP) Registry Data Date: 2008-10-1818 10000000 # ine etnum Objects 1000000 100000 10000 1000 100 ARIN_RPSL RIPE APNIC AFRINIC LACNIC ARIN_SWIP 10 1 0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 Prefix Length Length 0 indicates that an address block cannot be represented by a single CIDR Length 4 specifies Multicast and Reserved Future Use blocks Some Legacy and ERX blocks may be included in one or more RIRs 5
1000000 Distribution of Prefix Length of Route Objects in IRR Registry Data Date: 2008-10-1818 100000 Log scale # Route Obj ects (P r efixes) 10000 1000 100 10 1 8 10 12 14 16 18 20 22 24 26 28 30 32 Prefix Length ARIN RPSL RIPE APNIC Standalone IRRs 6
Distribution of Sources of Prefix Allocations of Route Objects Registered to Standalone IRRs 250000 43% 200000 Route Object ts # of 150000 100000 33% 13% 50000 0 7% 3% 0% 1% 0% ARIN AFRINIC APNIC RIPE LACNIC LEGACY ERX IANA All route objects registered in standalone IRRs on 2008-10-18: 18: 497,124 7
Growth of NetHandles with OriginAS 100,000 10,000 1,000 100 NetHandle with One or More Origin AS Multihomed (>= 2 Origin ASes) 10 5/30/2007 6/30/2007 7/30/2007 8/30/2007 9/30/2007 10/30/2007 11/30/2007 12/30/2007 1/30/2008 2/29/2008 3/30/2008 4/30/2008 5/30/2008 6/30/2008 7/30/2008 8/30/2008 9/30/2008 10/30/2008 11/30/2008 12/30/2008 1/30/2009 2/28/2009 3/30/2009 Number of NetHandles with Origin AS 8 Date
ARIN NetHandle Stats in Comparison to BGP Updates and RIBs Raw data ARIN Registry data on 2008-10-18 * All NetHandle objects: 1,924,454 * Unique (NetHandle, OriginAS) pairs: 73,249 (4%) * Unique (NetRange, OriginAS) pairs: 73,062 * Unique OriginASes: 2693 BGP Updates & RIB data: * Collector: Oregon from Routeviews * Updates (2008-06-01 to 2008-11-24) Unique (prefix,origin) pairs: 531,820 * BGP RIBs on 2008-11-3: 283,035 unique (prefix,origin) pairs other than those in Updates prefixes above: 1 ALL Unique (prefix,origin) pairs from both Updates and RIBs: 531,821 9
Some Observations on ARIN NetHandles with OriginAS i Multiple NetHandles that contain the exact same (NetRange, OriginAS) pairs with different allocation types: Allocation types: allocation / reallocation / assignment / reassignment # of instances with the following: count 3 NetHandles containing the same (NetRange,OriginAS) pair 2 2 NetHandles containing the same (NetRange,OriginAS) pair 183 NetHandles with unique (NetRange,OriginAS) i pair 72,877 10
Some Observations on ARIN NetHandles with OriginAS i Two or more NetHandle objects contain the exact same (NetRange, OriginAS) pairs, but different NetType: One Example: (66.97.96.0/20, 33125) NetHandle Object 1 NetHandle Object 2 NetHandle: NET-66-97-96-0-1 NET-66-97-96-0-2 OrgID: SNL-27 MCB-21 NetRange: 66.97.96.0 96-66.97.111.255 66.97.96.0 96 66.97.111.255 NetType: Allocation Reassignment OriginAS: AS33125 AS33125 Parent: NET-66-0-0-0-0 0 0 0 NET-66-97-96-0-1 96 RegDate: 2006-10-10 2007-06-12 Updated: 2007-06-12 2007-06-12 11
ARIN NetHandles with OriginAS Multiple OriginAS (MOAS) Distribution Registry Data Date: 2008-10-1818 80000 70000 68753 60000 # of NetHandles 50000 40000 30000 20000 10000 0 779 196 75 349 9 2 1 1 1 1 6 1 2 3 4 5 6 7 8 12 13 18 31 Multiple OriginASes Some prefix owners register prefix with each of their ASes Some never remove old route registrations? 12
20000 18000 Distribution of NetHandles Associated with the Origin AS Registry Data Date: 2008-10-1818 ) P airs ( NetHandle e,orig in A S ) # of 16000 14000 12000 10000 8000 6000 4000 2000 0 1 50 01 10 001 15 00120 001 25 001 30 00135 001 Origin ASN 40 001 45 00150 001 55 001 60 00165 001 A large percentage of (NetHandle,OriginAS) pairs are associated with about 10 Origin ASes 13
Distribution of Prefix Length of NetHandles w/ OriginAS vs. BGP Trace Data Registry Data Date: 2008-10-1818 BGP Trace Data from 2008-06 06-0101 to 2008-11 11-24 45000 300000 a irs 40000 35000 airs 250000 l e,o rig in A S) P # o f ( N eth a n d 30000 25000 20000 15000 10000 5000 # of Uniq ue (P refix, Orig in ) P 200000 150000 100000 50000 0 0 8 10 12 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 0 0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 Prefix Length Length 0 indicates that NetRange cannot be represented by a single CIDR Prefix Length Length 0 indicates prefix 0.0.0.0/0 Prefix 0.0.0.0/0 is announced by 15 Origin ASes (12956, 3561, 19151, 513, 9829, 3130, 293, 5602, 8546, 174, 47797, 28968, 31261, 47819, 18747). There exist 27 (prefix, origin) pairs with prefix length less than 8, excluding length 0 above. 14
Distribution of ARIN NetRange Address Block Allocations Registry Data Date: 2008-10-1818 80000 70000 72069 # of (NetHandle e,originas) Pairs 60000 50000 40000 30000 20000 10000 0 77 1100 3 LEGACY ARIN ERX LACNIC Note: Considering only NetHandles with Origin AS 15
Methodology for Consistency Checks Mntner, OrgID, Contact information (tech- c, admin-c, etc.) are compared across corresponding registered objects Origin Consistent: For {prefix, OriginAS} pair in NetHandle, ASHandle is consistent Not Registered: No ASHandle Exists NC: ASHandle is not consistent 16
Consistency Checks for ARIN NetHandles with OriginAS Registry Data Date: 2008-10-1818 80000 Region OriginC NC NR Total 70000 Legacy 3 73 1 77,O rig inas ) Pa irs 60000 50000 40000 NR NC OriginC ARIN 3519 68437 113 72069 ERX 391 697 12 1100 Lacnic 1 2 0 3 # of (N ethandle 30000 20000 10000 Total 3914 69209 126 73249 Scores for Consistency Checks for ARIN NetHandle w/ OriginAS 0 LEGACY ARIN ERX LACNIC 17
ARIN NetHandles w/ OriginAS and the Existence of Corresponding Route Objects in RPSL 70000 Registry Data Date: 2008-10-1818 60000 79% # of (NetHandle e,originas) Pairs 50000 40000 30000 20000 10000 0 17% 3% 1% No_route_object t RO_exact_match t RO_more_specific RO_less_specific For origin validation, ARIN RPSL route objects provide superior coverage than NetHandles with origin AS 18
ARIN NetHandles w/ OriginAS and Existence and Quality of Corresponding Route Objects in RPSL Registry Data Date: 2008-10-1818 60000 # of (NetHand dle,originas) Pairs 50000 40000 30000 20000 10000 No_RO NR NC OriginC PrefixC FC 0 No_route_object RO_exact_match RO_more_specific RO_less_specific No_RO: No Route objects exist NR: No Referenced objects exist (ie., ASHandle or aut-num) NC: (referenced objects exist, but) Not Consistent FC: Fully (Prefix & Origin) Consistent PrefixC: Only Prefix Consistent OriginC: Only Origin Consistent 19
ARIN NetHandles w/ OriginAS that are Observed in BGP Trace Data 70000 87% 60000 # of (Ne ethandle,origi inas) Pairs 50000 40000 30000 20000 10000 0 7% 5% 1% Unobserved Obs w/ exact match Obs w/ more specific Obs w/ less specific About 6% of the NetHandles with origin AS are usable for direct verification of origin in BGP update messages; that is less than 5K NetHandles (in Oct. 2008) 20
Comparison of ARIN NetHandles with OriginAS vs. Announced (p, OAS) Pairs for Prefix Length >= 25 Prefix length >= 25 All (p, OAS) # of (p, OAS) percentage ARIN NetHandles with OriginAS 73k 60k 82.2% Announced (p, OAS) that correspond to ARIN 186k 6.5 3.5% Address Space Globally announced (p, OAS) 532k 29.3k 5.5% 21
ARIN NetHandle w/ OriginAS Consolidation of (NetHandle, OriginAS) Pairs On 2008-10-18 Total # sub-prefixes All unique (NetRange,OriginAS) Pairs 73,062 Distinct NH_ OAS (NetHandle w/ OriginAS) with no super- 39,297 prefixes Of these (39,297): # of NH_OAS with no sub-prefixes 38,693 0 # of NH_OAS with sub-prefixes (only one level below) 584 16828 # of NH_OAS with sub-prefixes (two levels below) 20 16937 Note: 38,693 + 584 + 20 + 16828 + 16937 = 73,062 Many of the consolidated 39,297 are also subprefixes of what are actually observed 22
Outline Problem statement Analysis of ARIN NetHandles with OriginAS i Analysis of Global Registries (comparisons with what is announced in BGP) 23
Registry Self-Consistency Check (Quality Analysis Algorithm) Self-Consistency check criteria: Check consistency between relevant objects by comparing the following attributes: * mntner related attributes: Used mainly for RPSL * orgid attribute: Used mainly for SWIP * Contact information (i.e., tech-c / admin-c / TechHandle / AbuseHandle) A route object is considered as fully consistent if, based on the above criteria, it matches with both of these: the referenced aut-num for the origin; and the referenced inetnum for the prefix. inetnum route aut-num inetnum: 129.6.0.0 route: 129.6.0.0/24 aut-num: AS49 129.6.255.255 descr: description stmt tech-c: nist-tech-id admin-c: nist-admin-id status: assigned PA mnt-by: MNT-NIST descr: NIST/DOC origin: AS49 mnt-by: iip-bgp-mnt source: RIPE org: import: export: default: tech-c: AS49-tech mnt-by: MNT-NIST mnt-routes: iip-bgp-mnt source: RIPE mntner mnt-routes: iip-bgp-mnt source: RIPE Authentication ti ti Consistency Check mntner: iip-bgp-mnt descr: description stmt auth: encryp mnt-by: MNT-NIST source: RIPE 24
Route Objects Percentage of 90% 80% 70% 60% 50% 40% 30% 20% 10% Registry Data PrefixC 0% FC OriginC Characterization of IRR Consistency Based on Route Object Registrations NC NR Registry Data Date: 2008-10-1818 FC: Fully (Prefix & Origin) Consistent PrefixC: Only Prefix Consistent OriginC: Only Origin Consistent NC: (referenced objects exist, but) Not Consistent NR: No Referenced Resource Objects Exist FC PrefixC OriginC NC NR 500000 450000 400000 350000 300000 250000 200000 150000 100000 50000 0 NR NC OriginC PrefixC FC ARIN RPSL RIPE APNIC* Standalone IRRs ARIN RPSL RIPE APNIC* Standalone IRRs FC 169 2% 70057 78% 22981 65% 534 0% PreifxC 27 1% 4458 5% 8364 23% 107 0% OriginC 5845 71% 12627 14% 3562 10% 141323 29% NC 2147 26% 2815 3% 608 2% 353598 71% NR 13 0% 0 0 0 0 1534 0% Total 8201 89957 35515 497096 ARIN RPSL RIPE APNIC* Standalone IRRs 25
Pe rcentage e of Rout te Object ts 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Characterization of IRR Consistency Based on Route Object Registrations Registry Data Date: 2008-10-1818 FC PrefixC OriginC NC NR ARIN RPSL RIPE APNIC* Standalone IRRs 26
Stability of (p, OAS) in the Trace Data If (p, OAS) pair remained in RIBs stably for 48 hours or more at least once during the observation period (6 months), then the (p, OAS) pair is considered stable Otherwise, the (p, OAS) pair is considered unstable (transient) 27
erved {Prefix x, Origin AS} Pairs Percen ntage of Obs Classification of Observed (p, OAS) Pairs According to Stability / Consistency Scores 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% RIPE Global APNIC ARIN Unstable Unstable Unstable Unstable Stable & Stable & Stable & Stable & & NR & NC & PC & FC NR NC PC FC 28 FC = Fully Consistent; PC = Partially Consistent; NC = Not Consistent; NR = Not Registered
% of Obser rved (p, OAS) Pairs 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% Stability/Consistency Scores of Observed (p, OAS) Pairs: ARIN Region Prefixes ARIN Region Prefixes Validation using ARIN IRR Only Validation using RABD & ARIN IRR 0% Unstable & NR Unstable & NC Unstable & PC Unstable & FC Stable & NR Stable & NC Stable & PC Stable & FC 29 FC = Fully Consistent; PC = Partially Consistent; NC = Not Consistent; NR = Not Registered
Analysis of Registered But Unobserved Routes ARIN Prefixes {prefix, origin} pairs registered but never announced: 110,956 Large number of {prefix, origin} pairs registered but never announced In most cases, superprefixes are announced with the same origin AS (as in registered route) or a different origin AS Re-origination type of aggregation by a higher tier ISPs and/or stale Route registrations? (A) At least one super prefix announced with same origin but none with any other origin: 47,905 Stable: 47,876 Unstable: 29 (B) Same prefix or at least one super prefix announced with different originbut none with same origin: 58,384 Stable: 57,798 Unstable: 3,374 Other possibil ities: 4,667 Fully Consistent: 43 Fully Consistent: 133 Partially Consistent: 35,186 Partially Consistent: 21,976 Not Consistent: 11,267 Not Consistent: 19,688 Not registered: 1,409 Not registered: 19,375 For the super-prefixes with their observed origin ASes 30
Analysis of Registered But Unobserved Routes Global Prefixes {prefix, origin} pairs registered but never announced: 237,870 Large number of {prefix, (A) At least one (B) At least one origin} pairs registered super prefix super prefix Other but never announced announced with announced with possibil In most cases, super- same origin but none different originbut ities: with any other origin: none with same 30,375 prefixes are announced 130,901 origin: 76,594 with the same origin AS (as in registered route) or a different origin AS Re-origination type of Stable: 129,957 Unstable: 944 Stable: 69,519 Unstable: 10,315 aggregation by a higher Fully Consistent: 24,227227 Fully Consistent: 4,422422 Partially Consistent: 60,566 Partially Consistent: 24,806 tier ISPs and/or stale Not Consistent: 38,639 Not Consistent: 29,534 Route registrations? Not registered: 7,469 Not registered: 21,072 For the super-prefixes with their observed origin ASes 31
Conclusions and Future Work ARIN NetHandles with Origin AS -- dominantly for prefix lengths > 25 Announced prefixes are dominantly of length < 24 As it stands, ARIN RPSL routes (~10K) more useful than NetHandles with origin AS (~100K) Routes exist in standalone RABD but not enough and lacking consistency (Verizon alone has about 60 different OrgIDs *) It would be immensely helpful whatever RIRs / ISPs can do to encourage/support: Route registrations Using consistent OrgIDs SIDR RPKI trials and testing * Based on informal communication between NIST and Verizon 32