Search

The validity of the routing advertisements sent by one router to another is essential for Internet connectivity. To perform routing exchanges between Autonomous Systems (AS) on the Internet, a protocol known as the Border Gateway Protocol (BGP) is used. One of the most common attacks on routers running BGP is prefix hijacking. This attack aims to disrupt connections between AS and divert routing to destinations that are not appropriate for crimes, such as fraud and data breach. One of the methods developed to prevent prefix hijacking is the Resource Public Key Infrastructure (RPKI). RPKI is a public key infrastructure (PKI) developed for BGP routing security on the Internet and can be used by routers to validate routing advertisements sent by their BGP peers. RPKI utilizes a digital certificate issued by the Certification Authority (CA) to validate the subnet in a routing advertisement. This study aims to implement BGP and RPKI using the Bird Internet Routing Daemon (BIRD). Simulation and implementation are carried out using the GNS3 simulator and a server that acts as the RPKI validator. Experiments were conducted using 4 AS, 7 routers, 1 server for BIRD, and 1 server for validators, and there were 26 invalid or unknown subnets advertised by 2 routers in the simulated topology. The experiment results show that the router can successfully validated the routing advertisement received from its BGP peer using RPKI. All invalid and unknown subnets are not forwarded to other routers in the AS where they are located such that route hijacking is prevented.

Summary: Named data networking (NDN) is gaining momentum as a future Internet architecture. NDN is a type of information‐centric networking (ICN) that attempts to change the current Internet architecture from host/location‐centric to content‐centric, where data retrieving is done by the names of the contents irrespective of the location of the data. A mechanism to advertise the name‐based prefixes between different domains is necessary to accelerate the NDN deployment. In IP‐based routing, border gateway protocol (BGP) is the de facto inter‐domain routing protocol that plays a vital role in Internet communication by enabling different Internet domains to exchange routing information. In its current form, BGP can advertise and process IP‐based prefixes, but it cannot advertise or process NDN name‐based prefixes. Accordingly, BGP needs to be extended to support NDN technology. This paper proposes an NDN extension for BGP, referred to as N‐BGP, that offers a solution to exchange name‐based routes in the current BGP networks. This proposed extension modifies the traditional BGP speaker into a hybrid one. This hybrid speaker is qualified to understand, advertise, receive, process, and store both IP‐based and name‐based routes simultaneously and efficiently, without disturbing or breaking the current Internet operation; that is, it can coexist along with traditional speakers. We also validate and evaluate our proposed solution in a hybrid environment, and the results show that N‐BGP has the capability to exchange and process both Name and IP‐based routes efficiently. [ABSTRACT FROM AUTHOR]

The purpose of this article is to discuss an ethnography of code, specifically code ethnography, a method for examining code as a socio-technical actor, considering its social, political, and economic dynamics in the context of digital infrastructures. While it can be applied to any code, the article presents the results of code ethnography application in the study of internet interconnection dynamics, having the Border Gateway Protocol (BGP) as code and two of the largest internet exchange points (IXPs) in the world as points of data collection, DE-CIX Frankfurt, and IX.br São Paulo. The results show inequalities in the flows of information between the global North and the global South and concentration of power at the level of interconnection infrastructure hitherto unknown in the context of the political economy of the internet. Code ethnography is explained in terms of code assemblage, code literacy, and code materiality. It demonstrates the grammar of BGP in context, making its logical and physical dimensions visible in the analysis of the formation of giant internet nodes and infrastructural interdependencies in the circulation information infrastructure of the internet. [ABSTRACT FROM AUTHOR]

The interconnected architecture of software defined network (SDN) and traditional IP network we propose is based on the following core idea： taking the SDN as a traditional "route". The network layer reachability information (NLRI) of the entire network becomes consistent after "route" communicates with IP network by exchanging NLRI through the border gateway protocol (BGP). We design an interconnected architecture based on the above idea. Besides, we test the models' functions, and verify the validity of interconnected architecture in the multi-SDN scene and the performance. Simulation results show that the interconnected architecture can make the SDN and traditional IP network interconnect and communicate normally. The proposed interconnected architecture makes little change to network devices, and the changes mainly focus on the SDN controller which is software programmable, and it is helpful for this technology to be deployed and implemented in the real network environment. [ABSTRACT FROM AUTHOR]

Disruptive events, such as large-scale power outages, undersea cable cuts, or security attacks, could have an impact on the Internet and cause the Internet to deviate from its normal state of operation, which we also refer to as an “Internet earthquake.” As the Internet is a large, complex moving target, unfortunately little research has been done to define, observe, quantify, and analyze such impact on the Internet, whether it is during a past event period or in real time. In this paper, we devise an Internet seismograph, or I-seismograph, to fill this gap. Since routing is the most basic function of the Internet and the Border Gateway Protocol (BGP) is the de facto standard inter-domain routing protocol, we focus on BGP to observe, measure, and analyze the Internet earthquakes. After defining what an impact to BGP entails, we describe how I-seismograph observes and measures the impact, exemplify its usage during both old and recent disruptive events, and further validate its accuracy and convergency. Finally, we show that I-seismograph can further be used to help analyze what happened to BGP while BGP experienced an impact, including which autonomous systems (AS) were affected most or which AS paths or path segments surged significantly in BGP updates during an Internet earthquake. [ABSTRACT FROM PUBLISHER]

Copyright of Journal of Chongqing University of Posts & Telecommunications (Natural Science Edition) is the property of Chongqing University of Posts & Telecommunications and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

In the last decade, many studies have used the Internet autonomous system (AS)-level topology to perform several analyses, from discovering its graph properties to assessing its impact on the effectiveness of worm-containment strategies. Yet, the Border Gateway Protocol (BGP) data used to reveal the topologies are far from complete. Our contribution is threefold. First, we analyze BGP data currently gathered by the most famous route collector projects, highlighting and explaining the causes of their incompleteness. We found that large areas of the Internet are not properly captured due to the geographical location of route collector feeders and due to BGP filters, such as export policies and decision processes. Second, we propose a methodology based on a new metric, named p2c-distance, which is able to: 1) identify the minimum number of ASs required to obtain an Internet AS-level topology that is closer to reality; and 2) identify a ranking list of these ASs to show that it is possible to obtain nonnegligible coverage improvements with a limited number of appropriately chosen feeding ASs. Third, we characterize the ASs that were found to be part of the solution of the above covering problems. We found that the route collectors are rarely connected to these ASs, thus highlighting that much effort is needed to devise a route collector infrastructure that ideally would be able to capture a complete view of the Internet. [ABSTRACT FROM PUBLISHER]

This paper deals with the Fast Reroute technique which is the extension of the Route Reliability Testing (RRT) algorithm. The main issues of the BGP are link failure and untrustworthiness of the link and many more. In a network when the actual link fails the data will not be sent to its destination and which results in congestion and also increases the load of the network. To deal with these issues, in this paper we propose a Fast ReRoute (FRR) Technique in BGP, which helps when the primary link fails by finding an alternate link for the data. The main advantage of this of this proposal is while finding the alternate link the lowest post failure, traffic load across all the links into the account and also it is possible to decrease the data packet loss. By simulation results, we show that the proposed rerouting technique reduces the packet loss and increases the throughput [ABSTRACT FROM AUTHOR]

The network infrastructure of Internet service providers (ISPs) undergoes constant evolution. Whenever new requirements arise (e.g., the deployment of a new Point of Presence or a change in the business relationship with a neighboring ISP), operators need to change the configuration of the network. Due to the complexity of the Border Gateway Protocol (BGP) and the lack of methodologies and tools, maintaining service availability during reconfigurations that involve BGP is a challenge for operators. In this paper, we show that the current best practices to reconfigure BGP do not provide guarantees with respect to traffic disruptions. Then, we study the problem of finding an operational ordering of BGP reconfiguration steps that guarantees no packet loss. Unfortunately, finding such an operational ordering, when it exists, is computationally hard. To enable lossless reconfigurations, we propose a framework that extends current features of carrier-grade routers to run two BGP control planes in parallel. We present a prototype implementation and show the effectiveness of our framework through a case study. [ABSTRACT FROM PUBLISHER]

The weak trust model in Border Gateway Protocol (BGP) introduces severe vulnerabilities for Internet routing including active malicious attacks and unintended misconfigurations. Although various secure BGP solutions have been proposed, the complexity of security enforcement and data-plane attacks still remain open problems. We propose TBGP, a trusted BGP scheme aiming to achieve high authenticity of Internet routing with a simple and lightweight attestation mechanism. TBGP introduces a set of route update and withdrawal rules that, if correctly enforced by each router, can guarantee the authenticity and integrity of route information that is announced to other routers in the Internet. To verify this enforcement, an attestation service running on each router provides interfaces for a neighboring router to challenge the integrity of its routing stack, enforced rules, and the attestation service itself. If this attestation succeeds, the neighboring router updates its routing table or announces the route to its neighbors, following the same rules. Thus, a router on a routing path only needs to verify one neighbor's routing status to ensure that the route information is valid. Through this, TBGP builds a transitive trust relationship among all routers on a routing path. We implement a prototype of TBGP to investigate its practicality. In our implementation, we use identity-based signature and trusted computing techniques to further reduce the complexity of security operations. Our security analysis and performance study shows that TBGP can achieve the security goals of BGP with significantly better convergence performance and lower computation overhead than existing secure BGP solutions. [ABSTRACT FROM PUBLISHER]

We present a game-theoretic model that captures many of the intricacies of interdomain routing in today's Internet. In this model, the strategic agents are source nodes located on a network, who aim to send traffic to a unique destination node. The interaction between the agents is dynamic and complex--asynchronous, sequential, and based on partial information. Best-reply dynamics in this model capture crucial aspects of the de facto standard interdomain routing protocol, namely, the Border Gateway Protocol (BGP). We study complexity and incentive-related issues in this model. Our main results show that in realistic and well-studied settings, BGP is incentive-compatible. That is, not only does myopic behavior of all players converge to a "stable" routing outcome, but no player has motivation to unilaterally deviate from BGP. Moreover, we show that even coalitions of players of any size cannot improve their routing outcomes by collaborating. Unlike the vast majority of works in mechanism design, our results do not require any monetary transfers (to or by the agents). [ABSTRACT FROM AUTHOR]

Border Gateway Protocol (BGP) allows providers to express complex routing policies preserving high degrees of autonomy. However, unrestricted routing policies can adversely impact routing stability. A key concept to understand the interplay between autonomy and expressiveness on one side, and stability on the other side, is safety under filtering, i.e., guaranteed stability under autonomous usage of route filters. BGP route filters are used to selectively advertise specific routes to specific neighbors. In this paper, we provide a characterization of safety under filtering, filling the large gap between previously known necessary and sufficient conditions. Our characterization is based on the absence of a particular kind of dispute wheel, a structure involving circular dependencies among routing preferences. We exploit our result to show that networks admitting multiple stable states are provably unsafe under filtering, and the troublesome portion of the configuration can be pinpointed starting from the stable states alone. This is especially interesting from an operational point of view since networks with multiple stable states actually happen in practice (BGP wedgies). Finally, we show that adding filters to an existing configuration may lead to oscillations even if the configuration is safe under any link failure. Unexpectedly, we find policy configurations where misconfigured filters can do more harm than network faults. [ABSTRACT FROM PUBLISHER]

It is generally admitted that interdomain peering links represent nowadays the main bottleneck of the Internet, particularly because of lack of coordination between providers, which use independent and “selfish” routing policies. We are interested in identifying possible “light” coordination strategies that would allow carriers to better control their peering links while preserving their independence and respective interests. We propose a robust multipath routing coordination framework for peering carriers, which relies on the multiple-exit discriminator (MED) attribute of Border Gateway Protocol (BGP) as signaling medium. Our scheme relies on a game theory modeling, with a non-cooperative potential game considering both routing and congestions costs. Peering equilibrium multipath (PEMP) coordination policies can be implemented by selecting Pareto-superior Nash equilibria at each carrier. We compare different PEMP policies to BGP Multipath schemes by emulating a realistic peering scenario. Our results show that the routing cost can be decreased by roughly 10% with PEMP. We also show that the stability of routes can be significantly improved and that congestion can be practically avoided on the peering links. Finally, we discuss practical implementation aspects and extend the model to multiple players highlighting the possible incentives for the resulting extended peering framework. [ABSTRACT FROM PUBLISHER]

It is well known that today's inter-domain routing protocol, Border Gateway Protocol (BGP), converges slowly during network failures. Due to the distribution nature of Internet routing decisions and the rate-limiting timer Minimum Route Advertisement Interval (MRAI) of BGP, unavoidable convergence latency is introduced in reaction to network changes. During the period of convergence temporarily routing table inconsistencies cause short-term routing blackholes and loops which result in widespread temporary burst packet loss. In this paper, we present ROute-Free Forwarding (ROFF) - a novel technique for packet delivering continuously during periods of convergence. With slightly modifications on IP packet header and BGP, route loops and blackholes can be avoided. Our preliminary evaluation demonstrates that ROFF succeeds in reducing the number of Autonomous Systems (ASes) which experience burst packet loss and the duration of packet loss. [ABSTRACT FROM AUTHOR]

Despite significant efforts to obtain an accurate picture of the Internet's connectivity structure at the level of individual autonomous systems (ASes), much has remained unknown in terms of the quality of the inferred AS maps that have been widely used by the research community. In this paper, we assess the quality of the inferred Internet maps through case studies of a sample set of ASes. These case studies allow us to establish the ground truth of connectivity between this set of ASes and their directly connected neighbors. A direct comparison between the ground truth and inferred topology maps yield insights into questions such as which parts of the actual topology are adequately captured by the inferred maps, which parts are missing and why, and what is the percentage of missing links in these parts. This information is critical in assessing, for each class of real-world networking problems, whether the use of currently inferred AS maps or proposed AS topology models is, or is not, appropriate. More importantly, our newly gained insights also point to new directions towards building realistic and economically viable Internet topology maps. [ABSTRACT FROM AUTHOR]

Previous measurement studies have shown the existence of path exploration and slow convergence in the global Internet routing system, and a number of protocol enhancements have been proposed to remedy the problem. However, existing measurements were conducted only over a small number of testing prefixes. There has been no systematic study to quantify the pervasiveness of Border Gateway Protocol (BGP) slow convergence in the operational Internet, nor any known effort to deploy any of the proposed solutions. In this paper, we present our measurement results that identify BGP slow convergence events across the entire global routing table. Our data shows that the severity of path exploration and slow convergence varies depending on where prefixes are originated and where the observations are made in the Internet routing hierarchy. In general, routers in tier-1 Internet service providers (ISPs) observe less path exploration, hence they experience shorter convergence delays than routers in edge ASs; prefixes originated from tier-I ISPs also experience less path exploration than those originated from edge ASs. Furthermore, our data show that the convergence time of route fail-over events is similar to that of new route announcements and is significantly shorter than that of route failures. This observation is contrary to the widely held view from previous experiments but confirms our earlier analytical results. Our effort also led to the development of a path-preference inference method based on the path usage time, which can be used by future studies of BGP dynamics. [ABSTRACT FROM AUTHOR]

The current Internet has no secure way to validate the correctness of routing information. We propose a mechanism that supports secure validation of routing information in the interdomain routing protocol of the Internet. Our mechanism focuses on alleviating obstacles which previously prevent the complete and correct construction of the Internet routing information. In particular, we present a registry with authorized and verifiable search (RAVS) by which routing information can be constructed securely. We give an efficient RAVS scheme and prove its securities in the random oracle model. By our scheme, the routing information can be securely stored and tested without revealing contents of registry entries and search queries. Only legal autonomous systems (ASes) can construct valid registry entries and a single compromised AS can be detected. Our experiment shows that our RAVS scheme can be implemented efficiently and the incurred overhead, in terms of time and space, is acceptable in practice. [ABSTRACT FROM PUBLISHER]

To devise effective network engineering strategies and to assess the quality of upstream providers, network operators would greatly benefit from the knowledge of which Internet paths might be traversed by the traffic flows entering their networks in the case of network faults or when traffic engineering measures are used. However, current methodologies do not provide this information. This paper presents methodologies to discover alternate paths that might be selected in the presence of network faults or different routing policies and to deduce the routing policies of other operators. The techniques are validated through extensive experimentation on the Internet. [Copyright &y& Elsevier]

We present a detailed study of the potential impact of border gateway protocol peering session attacks and the resulting exploitation of route flap damping (RFD) that cause network-wide routing disruptions. We consider canonical grid as well as down-sampled realistic autonomous system (AS) topologies and address the impact of various typical service provider routing policies. Our modeling focuses on three dimensions of routing performance sensitivity: 1) protocol aware attacks (e.g., tuned to RFD); 2) route selection policy: and 3) attack-region topology. Analytical results provide insights into the nature of the problem and potential impact of the attacks. Detailed packet-level simulation results complement the analytical models and provide many additional insights into specific protocol interactions and timing issues. Finally, we quantify the potential effect of the BGP graceful restart mechanism as a partial mitigation of the BGP vulnerability to peering session attacks. [ABSTRACT FROM AUTHOR]

To enable end-to-end quality-of-service (QoS) guarantees in the Internet, based on the border gateway protocol (BGP), interdomain QoS information advertising, and routing are important. However, little research has been done in this area so far. Two major challenges, scalability and heterogeneity, make the QoS extension to BGP difficult. In the existing routing schemes, static and instantaneous QoS metrics, such as link capacity and available bandwidth, are used to represent QoS routing information, but neither of them can solve the two challenges well. In this paper, BGP is extended to advertise available bandwidth and delay information of routes, but, instead of using the traditional deterministic metrics, a series of statistical metrics, available bandwidth index (ABI), delay index (DI), available bandwidth histogram (ABH), and delay histogram (DH), are defined and applied to QoS information advertising and routing. Two major contributions of the proposed statistical metrics are: 1) QoS information is abstracted into one or several probability intervals and, thus, the heterogeneous and dynamic QoS information can be represented more flexibly and precisely and 2) by capturing the statistical property of the detailed distribution of QoS information, these new metrics are efficient and they can highly decrease the message overhead in routing, thereby making the QoS advertising and routing scalable. Our extensive simulations confirm both contributions of the QoS extension to BGP very well. Moreover, besides BGP, these statistical metrics can be applied to other networks and protocols to represent QoS information in a more scalable and precise way. [ABSTRACT FROM AUTHOR]

The growth in use of Internet-based applications in recent years has led to telecommunication networks transporting an increasingly large amount of Internet Protocol (IP)-based traffic. Proposed broadband satellite constellation networks, currently under development, will be required to transport IP traffic. A case can be made for implementing IP routing directly within the constellation network, in order to transport IP traffic well and to provide good support for IP multicast and for emerging IP-based quality of service (QoS) guarantees. This paper examines strategies for implementing and operating IP routing effectively within satellite constellation networks, given known constraints on the constellation resulting from satellite mobility, global visibility, routing and addressing. Copyright © 2001 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

This paper defines and evaluates Path Exploration Damping (PED) — a router-level mechanism for reducing the volume of propagation of likely transient update messages within a BGP network and decreasing average time to restore reachability compared to current BGP Update damping practices. PED selectively delays and suppresses the propagation of BGP updates that either lengthen an existing AS Path or vary an existing AS Path without shortening its length. We show how PED impacts on convergence time compared to currently deployed mechanisms like Route Flap Damping (RFD), Minimum Route Advertisement Interval (MRAI) and Withdrawal Rate Limiting (WRATE). We replay Internet BGP update traffic captured at two Autonomous Systems to observe that a PED-enabled BGP speaker can reduce the total number of BGP announcements by up to 32% and reduce Path Exploration by 77% compared to conventional use of MRAI. We also describe how PED can be incrementally deployed in the Internet, as it interacts well with prevailing MRAI deployment, and enables restoration of reachability more quickly than MRAI. [ABSTRACT FROM PUBLISHER]