measurement of highly active prefixes in bgp
Skip this Video
Download Presentation
Measurement of Highly Active Prefixes in BGP

Loading in 2 Seconds...

play fullscreen
1 / 18

Measurement of Highly Active Prefixes in BGP PowerPoint Presentation - PowerPoint PPT Presentation

  • Uploaded on

Measurement of Highly Active Prefixes in BGP Ricardo V. Oliveira, Rafit Izhak-Ratzin, Beichuan Zhang, Lixia Zhang GLOBECOM’05 Motivation and Goals

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about 'Measurement of Highly Active Prefixes in BGP PowerPoint Presentation' - benjamin

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
measurement of highly active prefixes in bgp

Measurement of Highly Active Prefixes in BGP

Ricardo V. Oliveira, Rafit Izhak-Ratzin, Beichuan Zhang, Lixia Zhang


motivation and goals
Motivation and Goals
  • Previous Internet routing measurement studies ([Rexford’02],[Broido’02] and [Wang’02]) observed the existence of a small number of prefixes which contributed a large number of routing updates
    • However those observations were made at specific ISPs and over short time periods
  • Question: Is this a common phenomenon in the Internet or specific to individual ISPs and limited time periods?
  • We conducted a systematic study of prefix activity by analyzing BGP log data over a 3-year period
internet and autonomous systems
Internet and Autonomous Systems



  • Autonomous System: a set of routers or networks under the same administration
  • Border routers exchange routing updates via Border Gateway Protocol


bgp and network dynamics




BGP and Network Dynamics
  • Link C-A fails
  • Node C sends a withdraw to node D
  • Node D sends announcement to all neighbors except B; to B it sends a withdraw (poison)
  • Node C sends withdraw to node D (poison)


A(P, [ D B A ])




A(P, [ D B A ])




If link C-A is unstable, multiple updates will be generated ...

Prefix P=

how to capture the unstable prefixes
How to capture the unstable prefixes?
  • Divide time in 1-day slots
  • Count the number of updates associated with each BGP prefix in each slot
  • Introduce Activity FunctionA(d,P):
  • Where:
  • Nu(d,P) : number of updates on day d for prefix P
  • Tu : activity threshold

A prefix P is highly active (HA) in day d if A(d,P)=1

how to obtain t u
How to obtain Tu?

Be conservative: take the worst case 99th percentile

prefix activity sprint router
Prefix Activity (Sprint router)

Number of HA prefixes roughly bounded between 100 and 200 per day

prefix activity across different monitors
Prefix Activity Across Different Monitors

33 monitors, 90% confidence interval

prefix activity across different monitors cont d
Prefix Activity Across Different Monitors (cont’d)

31 days of May 2004, 95% confidence intervals

ha life time
HA Life Time

We define Life Time as the total number of days during which a prefix is active:

With D = 1040 days

cause 1 sporadic link failures
Cause #1: Sporadic link failures
  • In April 13 2004, one of Internet2 routers experienced several outages in a short time period
  • This router had direct connections to some of RouteViews monitors
  • Using LinkRank (, we discover that one monitor switched paths for aprox. 1,500 prefixes
  • The BGP updates caused by these path changes made these prefixes to appear as HA
  • We believe this case represents most of the HA cases, as more than 75% of HA prefixes have a lifetime of only one day
cause 2 bgp path exploration





. . .


2 h

2 h

2 h

Cause #2: BGP Path Exploration
  • A BGP router may try several backup paths before converging to a stable route (path exploration)
  • How to measure path exploration?
  • Beacon prefixes: periodic announcements and withdraws of prefixes; root cause is known and we know how many updates to expect if there was no path exploration…

12 BGP updates/day for each router

cause 2 path exploration cont d

30 sec

Took almost 3 min

Cause #2: Path Exploration (cont’d)
  • Beacon seen at one monitor:

Time(s) Type AS_PATH

0 W

7,114 A 1239 3257 3257 28747 12654

7,144 A 1239 8928 25232 12654

14,254 A 1239 3356 25232 12654

14,280 A 1239 701 6762 12654

14,337 A 1239 701 6762 12654 (community change)

14,362 A 1239 7018 8220 513 3320 702 13030 12654

14,397 A 1239 7018 8220 513 3320 702 13030 12654

14,420 W

cause 3 router mis configurations
Cause #3: Router (mis)configurations
  • BGP has two built-in mechanisms to reduce the instability caused by update surges: MRAI and Route Flap Damping
  • Not all routers have these mechanisms configured by default…
  • Juniper routers don’t have MRAI timer configured by default and Cisco routers don’t have Route Flap Damping configured by default
  • A /24 prefix was HA for 12 consecutive days with 6011 updates/day; in one of the days there was 12,000 updates for this prefix; we discover that this router didn’t have the MRAI timer configured
  • The existence of HA prefixes is a common phenomenon
    • Observed everywhere
    • Observed all the time
  • Causes
    • Mainly sporadic link failures (75% of the cases)
    • Slow convergence
    • Lack of strict adherence to the existing protocol mechanisms (mainly MRAI timer and route dampening)
  • Future work:
    • Further identification of the causes
    • Investigation of solutions
    • Creation of tool for automatic detection of HA prefixes