1

Extracting Intra-Domain Topology from mrinfo Probing

JJ Pansiot (Lsiit, UdS)B Donnet, P Mérindol, O Bonaventure (INL, Louvain)

2

Agenda Background Part 1: mrinfo

Context Probing Methodology Dataset

Part 2: Delimiting AS Borders Router-2-AS Mapping Evaluation

Part 3: Intra-Domain Study Importance of Layer-2

Conclusion

3

Background Internet graph seen either as

1.a graph of routers Constructed for example with traceroute

2.a graph of domains (AS) Constructed for example from BGP tables (routeviews)

3.or both To study intra-domain graphs To study interconnection of domains

(our paper at IMC)

- need a way to overlay the AS graph on top of the router graph

4

Part 1: mrinfo Graph of routers

Usually obtained from traceroute tools Difficulty to map IP adresses to routers

Aliasing

Need many sources and targets To increase exhaustivity in edge discovery

Many artifacts Eg load balancers, changes in routing

=> try another way to get information: mrinfo

5

Probing

Topology discovery using mrinfo Uses IGMP message

ASK_NEIGHBORS NEIGHBORS_REPLY

Output All (multicast) interfaces of a given router

All (multicast) neighbor routers

mrinfo applied recursively• mrinfo-rec

6

Probing

switch

7

Data set Four years of data

collected daily May 1st, 2004 to December 31st, 2008

Recursive probing scheme: mrinfo-rec Publicly available

http://svnet.u-strasbg.fr/mrinfo/index.html

(raw data) http://inl.info.ucl.ac.be/content/mrinfo

(refined data)

8

Data set: routers

9

Data set: interfaces

10

Part 2: Delimiting AS Borders

11

IP to AS

First step : IP to AS mapping Obtained from routeviews data Allows to get a mapping on a given day

Discard some rare cases Such as MOA (Multiple Origin AS) Unknown prefixes

AS identified by an ASN (AS Number)

12

Example routeviews prefix Next Hop AS path* 130.79.0.0 217.75.96.60 0 0 16150 1239 5511 2200

2259 i* 209.161.175.4 0 14608 19029 3356 5511

2200 2259 i* 129.250.0.85 11 0 2914 5511 2200 2259 i* 129.250.0.11 18 0 2914 5511 2200 2259 i* 216.140.8.59 2741 0 6395 5511 2200 2259 i* 216.140.2.59 3800 0 6395 5511 2200 2259 i* 208.186.154.35 0 0 5650 1239 5511 2200

2259 i…* 8.7.83.0/24 217.75.96.60 0 0 16150 6939 5650 12284

32808 32808 i

* 209.161.175.4 0 14608 19029 5650 12284 32808 32808 i

* 216.140.2.59 0 0 6395 5650 12284 32808 32808 i

* 216.140.8.59 20 0 6395 5650 12284 32808 32808 i

13

Router to AS Mapping

Problem Graph of routers

Each router has Many IP addresses (interfaces)

IP => prefix => ASN IP addresses may belong to different ASes

For each router decide of the « correct » AS

14

Router-2-AS Mapping

This?Or this?

AS2

15

Router-2-AS Mapping Idea

Apply a series of rules At each step a router r

Has an ASN, Asn(r) An a confidence level c(r), 0 ≤ c(r) ≤ 1

A rule applied at a given step, if c(r) < 1

Increase the confidence level And possibly changes ASN(r)

While remaining consistent with ASN already assigned

Once c(r) = 1, ASN(r) unchanged => most reliable rules first

16

Main rule : election elec

The first (main) rule is an election (elec) router r is given the most frequent AS among its addresses (with tie breaker), ASN1

Plus a confidence level c(r) From 1 (all addresses in the same AS) To 0 (same number of addresses in 2 distinct AS)c(r) = (frequency(ASN1)-frequency(ASN2)) / frequency(ASN1)

17

Rule loopback lb

If a router has a loopback interface lb As deduced from the dns name

Eg loop0.ar3.LON2.gblx.net

Then ASN(r) = ASN(lb) with c(r) =1

18

Rule neighbor N

N rule allows to propagate « ASN certainty »

Assumption On a P2P link the prefix of the link belongs to the AS of 1 of its end routers

If R1 is in AS1 (with c(R1) = 1) and link R1 - R2 is in AS2

then ASN(R2) = AS2 with c(R2) =1

Warning : not applied to multipoint links Eg IXP

19

Rule lan

Idea : if router r has an interface to a leaf Lan in ASN (leaf) Then ASN(r) = ASN(leaf)

20

Increase confidence and propagate

For remaining routers with 0 < c(r) < 1 By decreasing order of c(r)

set c(r) to 1 Propagate to neighbors (rule N)

21

Rule c2p

Customer to provider rule c2p Assumption: the link between a provider AS and its customer AS is usually taken in the provider address space

Need to know the AS relationshipObtained from work by Caida

R1 R3 R2

AS1 AS1 AS2

C(R3)=0

AS1 AS2 AS2 customer of AS1

=> ASN(R3) = AS2AS2

C(R3) = 1

22

Evaluation

Subset of original dataset 1 probing dataset/month 56 samples

Purpose Algorithm efficiency

23

The power of election

24

Other rules : refinement

90% solved after elec

95% solved after lan

0.45% unsolved at the end

25

Closer look at steps

26

Part 3: Preliminary topology analysis:

Some results

27

Global switch/router ratio

28

AS3356 Level3

29

AS1239 Sprint

30

Les CRS ne répondent plus

31

Conclusion

New tool for collecting topological data mrinfo-rec

Intra-Domain topology delimitation

Importance of layer-2

32

Conclusion Jean-Jacques Pansiot, Pascal Mérindol, Benoit Donnet, Olivier

Bonaventure. Extracting Intra-Domain Topology from mrinfo Probing. In Proc. PAM 2010, Zurich.

Pascal Mérindol, Virginie Van den Schrieck, Benoit Donnet, Olivier

Bonaventure, Jean-Jacques Pansiot. Quantifying ASes Multiconnectivity using Multicast Information. In Proc. IMC 2009.

Preliminary analysis:

Jean-Jacques Pansiot. Local and Dynamic Analysis of Internet Multicast Router Topology. Annals of telecommunications, 2007.

Data publicly available http://svnet.u-strasbg.fr/mrinfo/index.html (raw data) http://inl.info.ucl.ac.be/content/mrinfo (refined data)

33

Output of mrinfo128.103.15.25 (bdrgw2-vl-15-core.net.harvard.edu) [version 12.2]: 192.5.66.204 -> 0.0.0.0 (local) [1/0/pim/querier/leaf] 128.103.15.25 -> 128.103.15.23 (hlkgw1-vl-15-core.net.harvard.edu) [1/0/pim] 128.103.15.25 -> 128.103.15.30 (perkgw1-vl-15-core.net.harvard.edu) [1/0/pim] 128.103.15.25 -> 128.103.15.26 (war10gw1-vl-15-core.net.harvard.edu) [1/0/pim] 128.103.15.25 -> 128.103.15.21 (oxgw3-vl-15-core.net.harvard.edu) [1/0/pim] 128.103.15.25 -> 128.103.15.16 (arsgw1-vl-15-core.net.harvard.edu) [1/0/pim] 128.103.15.25 -> 128.103.15.34 (bdrgw1-ge-3-1-core.net.harvard.edu) [1/0/pim] 128.103.15.25 -> 128.103.15.22 (lowgw1-vl-15-core.net.harvard.edu) [1/0/pim] 128.103.15.25 -> 128.103.15.15 (oxgw2-vl-15-core.net.harvard.edu) [1/0/pim] 128.103.15.25 -> 128.103.15.20 (nh175gw1-vl-15-core.net.harvard.edu) [1/0/pim] 128.103.15.25 -> 128.103.15.27 (st8gw1-vl-15-core.net.harvard.edu) [1/0/pim] 128.103.17.25 -> 128.103.17.23 (hlkgw1-vl-17-rcore.net.harvard.edu) [1/0/pim] 128.103.17.25 -> 128.103.17.30 (perkgw1-vl-17-rcore.net.harvard.edu) [1/0/pim] 128.103.17.25 -> 128.103.17.26 (war10gw1-vl-17-rcore.net.harvard.edu) [1/0/pim] 128.103.17.25 -> 128.103.17.21 (oxgw3-vl-17-rcore.net.harvard.edu) [1/0/pim] 128.103.17.25 -> 128.103.17.17 (cftgw1-vl-17-rcore.net.harvard.edu) [1/0/pim] 128.103.17.25 -> 128.103.17.16 (arsgw1-vl-17-rcore.net.harvard.edu) [1/0/pim] 128.103.17.25 -> 128.103.17.34 (bdrgw1-ge-4-1-rcore.net.harvard.edu) [1/0/pim] 128.103.17.25 -> 128.103.17.27 (st8gw1-vl-17-rcore.net.harvard.edu) [1/0/pim] 128.103.17.25 -> 128.103.17.22 (lowgw1-vl-17-rcore.net.harvard.edu) [1/0/pim] 128.103.17.25 -> 128.103.17.20 (nh175gw1-vl-17-rcore.net.harvard.edu) [1/0/pim] 128.103.252.145 -> 128.103.252.146 (lmagw1-vl-100-core.net.harvard.edu) [1/0/pim] 192.5.89.6 -> 192.5.89.5 (ATM10-400-OC12-GIGAPOPNE.nox.org) [1/0/pim/querier]

34

After processingID7 ROUTEUR 128.103.15.25, AS1742 INTER bdrgw2-vl-15-core.net.harvard.edu LOCAL 192.5.66.204(AS1742) -> 0.0.0.0 SWITCH 128.103.15.25(AS1742) -> (AS1742) ID10001 AS1742 ( bdrgw2-vl-15-

core.net.harvard.edu -> ) SWITCH 128.103.17.25(AS1742) -> (AS1742) ID9656 AS1742 ( bdrgw2-vl-17-

rcore.net.harvard.edu -> ) GLOBAL 128.103.252.145(AS1742) -> 128.103.252.146 (AS1742) ID13 AS1742 ( bdrgw2-vl-

100-core.net.harvard.edu -> lmagw1-vl-100-core.net.harvard.edu) GLOBAL 192.5.89.6(AS10578) -> 192.5.89.5 (AS10578) ID3827 AS10578 ( HARVARD-

GIGAPOPNE.nox.org -> ATM10-400-OC12-GIGAPOPNE.nox.org)

ID10001 SWITCH 128.103.15.0/26, AS1742 INTRA () -> 128.103.15.16 (AS1742) ID1 AS1742 ( -> arsgw1-vl-15-core.net.harvard.edu) () -> 128.103.15.21 (AS1742) ID4 AS1742 ( -> oxgw3-vl-15-core.net.harvard.edu) () -> 128.103.15.20 (AS1742) ID3 AS1742 ( -> nh175gw1-vl-15-core.net.harvard.edu) () -> 128.103.15.30 (AS1742) ID10 AS1742 ( -> perkgw1-vl-15-core.net.harvard.edu) () -> 128.103.15.25 (AS1742) ID7 AS1742 ( -> bdrgw2-vl-15-core.net.harvard.edu) () -> 128.103.15.34 (AS1742) ID11 AS1742 ( -> bdrgw1-ge-3-1-core.net.harvard.edu) () -> 128.103.15.23 (AS1742) ID6 AS1742 ( -> hlkgw1-vl-15-core.net.harvard.edu) () -> 128.103.15.27 (AS1742) ID9 AS1742 ( -> st8gw1-vl-15-core.net.harvard.edu) () -> 128.103.15.15 (AS1742) ID0 AS1742 ( -> oxgw2-vl-15-core.net.harvard.edu) () -> 128.103.15.22 (AS1742) ID5 AS1742 ( -> lowgw1-vl-15-core.net.harvard.edu) () -> 128.103.15.26 (AS1742) ID8 AS1742 ( -> war10gw1-vl-15-core.net.harvard.edu)