PoiRoot : Investigating the Root Cause of Interdomain Path Changes - - PowerPoint PPT Presentation

PoiRoot: Investigating the Root Cause

• f Interdomain Path Changes

Umar Javed*, Italo Cunha^, David Choffnes*#, Ethan Katz-Bassett$, Tom Anderson*, Arvind Krishnamurthy*

*U. Washington ^UFMG #Northeastern $USC Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

The case of the missing trigger

! BGP: the glue that holds the Internet together ! When paths change, bad things can happen

! 100ms or more additional user latency caused by interdomain

path changes 40% of the time (Google, Zhu et al. '12)

! 50% of unintelligible

VoIP samples caused by a BGP update (Kushman et al. '07)

! When bad things happen, who do you blame?

2

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Root cause of interdomain path changes

! Goal: Find the network triggering a BGP path change ! Challenge: BGP is an information-hiding protocol ! Our contributions

! New model for path change propagation ! Algorithm for identifying the root cause of an arbitrary change ! Evaluation using controlled experiments on real Internet routes

3

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Outline

! Intro ! Motivation ! Root Cause Isolation ! System & Evaluation

4

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Assumptions in this talk

! Consider a routing toward a single prefix, owned by AS D

! Path changes for D occur one at a time

! Model ASN as a single node

! Approaches apply to finer granularity

! Vantage point: Location at which we measure a path to D

! BGP feed ! Traceroute (forward and reverse)

5

D V

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Approach from previous work

! Feldmann et al. ’04, Caesar et al. ’03

! Key assumption: root cause is on either the new or old path

(NOOP)

! Intersection-based approach

6

Vantage points: {Q,V} Active path Inactive path D Z Y X V Q

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Approach from previous work

! Feldmann et al. ’04, Caesar et al. ’03

! Key assumption: root cause is on either the new or old path

(NOOP)

! Intersection-based approach

7

Active path Inactive path Vantage points: {Q,V} D Z Y X V Q

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Approach from previous work

! Feldmann et al. ’04, Caesar et al. ’03

! Key assumption: root cause is on either the new or old path

(NOOP)

! Intersection-based approach

7

Active path Inactive path Vantage points: {Q,V} D Z Y X V Q

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Approach from previous work

! Feldmann et al. ’04, Caesar et al. ’03

! Key assumption: root cause is on either the new or old path

(NOOP)

! Intersection-based approach

8

D Z Y X V Q Active path Inactive path Vantage points: {Q,V}

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Approach from previous work

! NOOP algorithm

9

Active path Inactive path Vantage points: {Q,V} D Z Y X V Q

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Approach from previous work

! NOOP algorithm

! Union of all old and new paths: {Q,V,X,Y,Z}

9

Active path Inactive path Vantage points: {Q,V} D Z Y X V Q

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Approach from previous work

! NOOP algorithm

! Union of all old and new paths: {Q,V,X,Y,Z} ! Intersection of all old and new paths: {Q,V,X,Z}

9

Active path Inactive path Vantage points: {Q,V} D Z Y X V Q

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Approach from previous work

! NOOP algorithm

! Union of all old and new paths: {Q,V,X,Y,Z} ! Intersection of all old and new paths: {Q,V,X,Z} ! Root cause is U - : {Y}

9

U

Active path Inactive path Vantage points: {Q,V} D Z Y X V Q

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

The case of the induced path change

10

D Z Y X V Vantage point: {V} C F B A E Active path Inactive path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

The case of the induced path change

11

D Z Y X V Vantage point: {V} C F B E A Active path Inactive path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

The case of the induced path change

12

D Z Y X V C F B E A Vantage point: {V} Active path Inactive path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

The case of the induced path change

13

D Z Y X V C F B E A Vantage point: {V} Active path Inactive path Old path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

The case of the induced path change

14

D Z Y X V C F B E New path A Old path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

The case of the induced path change

14

D Z Y X V C F B E New path

! Root cause (B) neither on old or new path!

A Old path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

The case of the induced path change

14

D Z Y X V C F B E New path

! Root cause (B) neither on old or new path!

! Need to revisit assumptions and model of path changes

A Old path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Outline

! Intro ! Motivation ! Root Cause Isolation ! System & Evaluation

15

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Revisiting assumptions

! Theory of candidate ASes responsible for a change

! Policy (i.e., localPref) trumps path length ! Policy depends only on next-hop AS (Gill et al. @ NANOG)

16

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Revisiting assumptions

! Theory of candidate ASes responsible for a change

! Policy (i.e., localPref) trumps path length ! Policy depends only on next-hop AS (Gill et al. @ NANOG)

! NOOP says ASes on old or new path from

VP

! We know this is wrong. Do we have to consider all ASes? ! No, we prove the root cause can also be:

! Any AS on old paths from ASes in new path from

VP

! Any AS on new paths from ASes in old path from

VP

16

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Revisiting assumptions

! Theory of candidate ASes responsible for a change

! Policy (i.e., localPref) trumps path length ! Policy depends only on next-hop AS (Gill et al. @ NANOG)

! NOOP says ASes on old or new path from

VP

! We know this is wrong. Do we have to consider all ASes? ! No, we prove the root cause can also be:

! Any AS on old paths from ASes in new path from

VP

! Any AS on new paths from ASes in old path from

VP

16

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Revisiting assumptions

! Theory of candidate ASes responsible for a change

! Policy (i.e., localPref) trumps path length ! Policy depends only on next-hop AS (Gill et al. @ NANOG)

! NOOP says ASes on old or new path from

VP

! We know this is wrong. Do we have to consider all ASes? ! No, we prove the root cause can also be:

! Any AS on old paths from ASes in new path from

VP

! Any AS on new paths from ASes in old path from

VP

For now, let’s assume I can obtain this.

16

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Theory in action

! Model tells us which networks may be root cause in general ! Algorithm to identify cause of specific change

! Visit all ASes in candidate set ! Move from

VP toward D (DFS traversal)

! Eliminate ASes that cannot the root cause

Let’s walk through an example

17

D ... VP Direction of traversal

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Recursion

! Start at

V

! Check ASes on old path O(V) ! After reaching D, check ASes on new path N(V)

18

D Z Y X V C F B A E Old path Active path Inactive path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Recursion

Axiom 1:

! If O(V) != N(V),

V may be the root cause but ASes upstream of V are not the root cause

19

D Z Y X V C F B A E Old path Active path Inactive path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Recursion

Axiom 2:

! If O(X) == N(X), X is not the root cause

20

D Z Y X V C F B A E Active path Inactive path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Recursion

! O(A) != N(A):

A might be root cause, but V is not

21

D Z Y X V C F B A E Active path Inactive path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Recursion

! O(E) == N(E):

E is not the root cause

22

D Z Y X V C F B A E Active path Inactive path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Recursion

Now check ASes on old paths from ASes in N(V)

! O(B) != N(B):

B may be the root cause

23

D Z Y X V C F B A E Active path Inactive path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Recursion

! O(F) == N(F):

F is not the root cause

24

D Z Y X V C F B A E Active path Inactive path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Recursion

! Only candidate AS left is B, the root cause

25

D Z Y X V C F B A E Active path Inactive path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

PoiRoot: Recursion

! Only candidate AS left is B, the root cause

25

D Z Y X V C F B A E Root cause Active path Inactive path

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Other considerations

! Requires measuring paths that might be used in the future

! Use poisoning to explore less preferred paths before a change ! Measure those paths (e.g., via reverse traceroutes)

26

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Poisoning on the BGP Links

! Normal case (no poisoning)

27

D Z Y X V Q

D

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Poisoning on the BGP Links

! Normal case (no poisoning)

27

D Z Y X V Q

D Z → D

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Poisoning on the BGP Links

! Normal case (no poisoning)

27

D Z Y X V Q

D Z → D Y → Z → D

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Poisoning on the BGP Links

! Normal case (no poisoning)

27

D Z Y X V Q

D Z → D Y → Z → D X → Y → Z → D

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Poisoning on the BGP Links

! Poisoning

Y to force X to explore less preferred paths

28

D Z Y X V Q

D → Y → D

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Poisoning on the BGP Links

! Poisoning

Y to force X to explore less preferred paths

28

D Z Y X V Q

D → Y → D Z → D → Y → D

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Poisoning on the BGP Links

! Poisoning

Y to force X to explore less preferred paths

28

D Z Y X V Q

D → Y → D Z → D → Y → D Q → Z → D → Y → D

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Poisoning on the BGP Links

! Poisoning

Y to force X to explore less preferred paths

28

D Z Y X V Q

Z → D → Y → D ? Q → Z → D → Y → D

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Poisoning on the BGP Links

29

D Z Y X V Q

?

! Poisoning

Y to force X to explore less preferred paths

Q → Z → D → Y → D

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Poisoning on the BGP Links

29

D Z Y X V Q

?

! Poisoning

Y to force X to explore less preferred paths

X → Q → Z → D → Y → D Q → Z → D → Y → D

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Other considerations

! Requires measuring paths that might be used in the future

! Use poisoning to explore less preferred paths before a change ! Measure those paths (e.g., via traceroutes)

! Potential set of ASes to monitor can grow quite large

! Consider next-less-preferred and all more preferred paths

! May not have all measurements

! Use correlation to reduce candidate set

30

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Outline

! Intro ! Motivation ! Root Cause Isolation ! System & Evaluation

31

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

System overview

32

Monitoring mode Collect paths

• BGP feeds
• Traceroutes

Build set of ASes to monitor

• Infer path preferences

Identification mode Run root cause analysis algorithm No change Path change Identification complete

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Evaluation

! What we want to know

! Accuracy: How often do I identify the root cause? ! Precision: How large is the candidate set?

! Key challenge: Ground truth!

! Requires an AS to experiment with, ... ! ... known triggers for path changes, ... ! and running code to identify the root cause during the change

33

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Evaluation

! What we want to know

! Accuracy: How often do I identify the root cause? ! Precision: How large is the candidate set?

! Key challenge: Ground truth!

! Requires: an AS to experiment with, ...

! Transit Portal: uses 5 universities as providers

! ... known triggers for path changes, ... ! and running code to identify the root cause during the change

34

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Evaluation

! What we want to know

! Accuracy: How often do I identify the root cause? ! Precision: How large is the candidate set?

! Key challenge: Ground truth!

! Requires: an AS to experiment with, ...

! Transit Portal: uses 5 universities as providers

! ... known triggers for path changes, ...

! Our good friend BGP path poisoning

! and running code to identify the root cause during the change

35

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Evaluation

! What we want to know

! Accuracy: How often do I identify the root cause? ! Precision: How large is the candidate set?

! Key challenge: Ground truth!

! Requires: an AS to experiment with, ...

! Transit Portal: uses 5 universities as providers

! ... known triggers for path changes, ...

! Our good friend BGP path poisoning

! and running code to identify the root cause during the change

! Continuous path measurements from a large set of

VPs

36

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Accuracy and precision

! Accuracy: 100%

! PoiRoot never excludes an AS that is the root cause ! NOOP does exclude when doing correlation (38% incorrect)

37

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Accuracy and precision

! Accuracy: 100%

! PoiRoot never excludes an AS that is the root cause ! NOOP does exclude when doing correlation (38% incorrect)

! Precision: Mean suspect set size is 1.66

37

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Accuracy and precision

! Accuracy: 100%

! PoiRoot never excludes an AS that is the root cause ! NOOP does exclude when doing correlation (38% incorrect)

! Precision: Mean suspect set size is 1.66

37

Most suspect sets are adjacent ASes

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Conclusion

! Identify network triggering an interdomain path change

! Both accurate and precise ! Handles arbitrary changes

! New model to reason about path changes

! Relies on few, generally valid, assumptions about routing

! Evaluation using controlled experiments on Internet paths

38

Wednesday, August 14, 13

PoiRoot: Investigating the Root Cause of Interdomain Path Changes SIGCOMM ’13

Questions?

39

Wednesday, August 14, 13