BGP Routing Tables Research Articles

Off-Path TCP Hijacking Attacks via the Side Channel of Downgraded IPID

In this paper, we uncover a new off-path TCP hijacking attack that can be used to terminate victim TCP connections or inject forged data into victim TCP connections by manipulating the new mixed IPID assignment method, which is widely used in Linux kernel version 4.18 and beyond. Our attack has three steps. First, an off-path attacker can downgrade the IPID assignment for TCP packets from the more secure per-socket-based policy to the less secure hash-based policy, thus building a shared IPID counter that forms a side channel in the victim. Second, the attacker detects the presence of TCP connections by observing the side channel of the shared IPID counter. Third, the attacker infers sequence and acknowledgment numbers of the detected connection by observing the side channel. Consequently, the attacker can completely hijack the connection, e.g., resetting the connection or poisoning the data stream. We evaluate the impacts of our attack in the real world, and we uncover that more than 20% of Alexa top 100k websites are vulnerable to our attack. Our case studies of SSH DoS, manipulating web traffic, and poisoning BGP routing tables show its threat on a wide range of applications. Moreover, we demonstrate that our attack can be further extended to exploit IPv4/IPv6 dual-stack networks on increasing the hash collisions and enlarging vulnerable populations. Finally, we analyze the root cause and develop a new IPID assignment method to defeat this attack. We prototype our defense in Linux 4.18 and confirm its effectiveness in the real world.

PredictRoute: A Network Path Prediction Toolkit

Accurate prediction of network paths between arbitrary hosts on the Internet is of vital importance for network operators, cloud providers, and academic researchers. We present PredictRoute, a system that predicts network paths between hosts on the Internet using historical knowledge of the data and control plane. In addition to feeding on freely available traceroutes and BGP routing tables, PredictRoute optimally explores network paths towards chosen BGP prefixes. PredictRoute's strategy for exploring network paths discovers 4X more autonomous system (AS) hops than other well-known strategies used in practice today. Using a corpus of traceroutes, PredictRoute trains probabilistic models of routing towards prefixes on the Internet to predict network paths and their likelihood. PredictRoute's AS-path predictions differ from the measured path by at most 1 hop, 75% of the time. We expose PredictRoute's path prediction capability via a REST API to facilitate its inclusion in other applications and studies. We additionally demonstrate the utility of PredictRoute in improving real-world applications for circumventing Internet censorship and preserving anonymity online.

PredictRoute: A Network Path Prediction Toolkit

Accurate prediction of network paths between arbitrary hosts on the Internet is of vital importance for network operators, cloud providers, and academic researchers. We present PredictRoute, a system that predicts network paths between hosts on the Internet using historical knowledge of the data and control plane. In addition to feeding on freely available traceroutes and BGP routing tables, PredictRoute optimally explores network paths towards chosen BGP prefixes. PredictRoute's strategy for exploring network paths discovers 4X more autonomous system (AS) hops than other well-known strategies used in practice today. Using a corpus of traceroutes, PredictRoute trains probabilistic models of routing towards prefixes on the Internet to predict network paths and their likelihood. PredictRoute's AS-path predictions differ from the measured path by at most 1 hop, 75% of the time. We expose PredictRoute's path prediction capability via a REST API to facilitate its inclusion in other applications and studies. We additionally demonstrate the utility of PredictRoute in improving real-world applications for circumventing Internet censorship and preserving anonymity online.

Формальний опис об’єктів і процесів глобальної маршрутизації у мережі Інтернет для оцінки впливу кібератак на маршрутизацію

Attacks on the global routing, in particular hijacking and interception of routes (route hijack and route leak), are one of the large-scale problems of cybersecurity. Prefix hijacking is a phenomenon in which the Autonomous System (AS) illegally declares itself as a prefix source instead of a genuine source. Leakage of route means that AS illegally, in violation of the routing policy, offers routes to other people's prefixes. These illegitimate routes contaminate BGP routing tables, distort network traffic paths, and affect the privacy, integrity, and availability of IP communications. These attacks are used to manipulate traffic in order to destabilize the Internet, espionage, theft, causing material damage.One of the most important steps in modeling the impact of attacks on routing is the construction of a formal model of global Internet routing. In this paper, we propose a formal description of global routing objects — autonomous systems, IP prefixes, BGP announcements, and the relationships between them: the IP address space as a set of IP prefixes, IP prefixes grouping and their incapsulation principles and concepts, the set of routes, and the concept of best path resolving.A formal description of the routing process in accordance with the best path selection criteria is also given. The special attention is paid to the argumentation of the possibility of applying the results to the IPv6 address space. Tabl.: 1. Fig.: 1. Refs: 10 titles.

A Multi-Index Hybrid Trie for Lookup and Updates

\begin{abstract} High-performance routers require high-speed IP address lookup to achieve wire-speed packet forwarding. This study proposes a new data structure, the Multi-Index Hybrid Trie (MIHT), for dynamic router table designs. This data structure was constructed by combining the useful characteristics of the ${\rm B}^{+}$ tree and priority trie. IP lookup operations can be performed efficiently by associating each prefix with a key value in the MIHT. Furthermore, because the required tree height and number of prefixes were reduced, dynamic router table operations were performed efficiently using the MIHT. To reduce the memory requirement, each prefix stored its corresponding suffix in a node of the MIHT, rather than storing a full prefix. Experiments using IPv4 and IPv6 routing databases indicated that the proposed data structure has efficient memory usage and performs well for lookup, insertion, and deletion operations. This study reports the results of the experiments performed to compare the proposed data structure with other structures using the benchmark IPv4 and IPv6 prefix databases AS1221, AS4637, AS6447, AS65000, AS1221*, and AS6447* with 407,067, 219,581, 417,995, 406,973 , 12,155, and 12,278 prefixes, respectively, where AS1221* and AS6447* are IPv6 BGP routing tables. \end{abstract} \begin{IEEEkeywords} Classless inter domain routing (CIDR), dynamic router tables, IP address lookup, longest matching prefix, multi-index hybrid trie. \end{IEEEkeywords}

Optimization Techniques of Traceroute Measurement Based on BGP Routing Table

Abstract：With the complexity of network structure and the network expanded rapidly, AS-level network macroscopic topology measurements will be more and more important in the network studies. If we can catch a network macroscopic topology which is more close to the actual world, it will help researchers explore the inherent laws of network structure and the relationships between network structure and political, and economic in the real world, it also useful for network providers to prediction of network problems and improve the network environment more accurate and timely. Our paper puts forward method that combined BGP routing table with traceroute measurement and use the given BGP data to predict the result of traceroute measure, and change the sequence of measurement target, so as to improve the accuracy and efficiency of the traceroute measurements result.

The Research on Control Strategy of Worms Spread in Complex Network in Industry

Internet worms have been a severe threat to the Internet infrastructure and hosts recently. However, because of its outbreak of a sudden and massive make the worm’s research facing enormous challenges. This article describes a simulation system based on NS2 worm - WSS. First, by processing BGP routing table information to the Internet used for simulation of the abstract network, then the model-based epidemiological model of worm propagation, and finally in the two in NS2 combination to achieve the simulation of worm propagation. Experiments show that, WSS can get in a lab environment similar to actual worm outbreak statistics, in understanding the macroscopic behavior of the worm, the worm flow forecasting, transmission speed and damage have a wide range of applications.

A Framework to Quantify the Pitfalls of Using Traceroute in AS-Level Topology Measurement

Although traceroute has the potential to discover AS links that are invisible to existing BGP monitors, it is well known that the common approach for mapping router IP addresses to AS numbers based on BGP routing tables is highly error-prone. We develop a systematic framework to quantify the potential errors of traceroute measurement in AS-level topology inference. In comparing traceroute-derived AS paths with BGP AS paths, we take a novel approach to identifying mismatched path segments and then inferring the causes of these mismatches through a set of tests. Our results show that about 60% of mismatches are due to routers using IP addresses belonging to peering neighbors. This result helps settle a debate in previous works regarding the major cause of errors in traceroute measurement. With the approximate ground truth of the ASes with BGP monitors inside, we identify the inaccuracy of publicly available traceroute-derived topology datasets and find that between 8% and 42% of AS adjacencies on the monitored ASes are false. With a new method to characterize AS links, we show that the derived (false) links between Tier-1/large ISPs and their customers' customers appear more frequently than real links do.

SpliTable: Toward Routing Scalability through Distributed BGP Routing Tables

The Internet has grown extremely fast in the last two decades. The number of routes to be supported by the routers has become very large. Moreover, the number of messages exchanged to distribute the routes has increased even faster. In this paper, we propose SpliTable, a scalable way to support the Internet routes in a Service Provider network. In our proposal, BGP route selection is done by distributed servers on behalf of the routers. They are called route selection servers. The selected routes are then stored in distributed routing tables. Each router maintains only its share of Internet routes, not the routes for each Internet prefix as it is the case today. We adapted the concept of Distributed Hash Tables (DHT) for that purpose. We show analytically that our proposal is more scalable in the number of routes supported in each router than current iBGP route distribution solutions. Moreover, the number of control messages exchanged with our proposal is bounded contrary to current sparse iBGP route distribution solutions which may never converge. We confirm these findings in an evaluation of a prototype implementation.

Evolution of Internet Address Space Deaggregation: Myths and Reality

Internet routing table size growth and BGP update churn are two prominent Internet scaling issues. There is widespread belief in a high and fast growing number of ASs that deaggregate prefixes, e.g., due to multi-homing and for the purpose of traffic engineering. Moreover, researchers often blame specific classes of ASs for generating a disproportionate amount of BGP updates. Our primary objective is to challenge such widespread assumptions (“myths”) and not solely to confirm previous findings. Surprisingly, we find severe discrepancies between existing myths and reality. According to our results, there is no trend towards more aggressive prefix deaggregation or traffic engineering over time. With respect to update dynamics, we observe that deaggregated prefixes generally do not generate a disproportionate number of BGP updates, with respect to their share of the BGP routing table. On the other side, we observe much more widespread traffic engineering in the form of AS path prepending and scoped advertisements compared to previous studies. Overall, our work gives a far more positive picture compared to the alarming discourses typically heard: The impact of “bad guys” on routing table size growth and BGP churn has not changed for the worse in recent years. Rather, it increases at the same pace as the Internet itself.

LISP-TREE: A DNS Hierarchy to Support the LISP Mapping System

During the last years, some operators have expressed concerns about the continued growth of the BGP routing tables in the default-free zone. Several proposed solutions for this issue are centered around the idea of separating the network node's identifier from its topological location. Among the existing proposals, the Locator/ID Separation Protocol (LISP) has seen important development and implementation effort. LISP relies on a mapping system to provide bindings between locators and identifiers. The mapping system is a critical protocol component, and its design is still an open issue. In this paper we present a new mapping system: LISP-TREE. It is based on DNS and has a similar hierarchical topology: blocks of identifiers are assigned to the levels of the hierarchy by following the current IP address allocation policies. We also present measurement-driven simulations of mapping systems' performance, assuming a deployment of LISP in the current Internet.

Identifying BGP routing table transfers

BGP routing updates collected by monitoring projects such as RouteViews and RIPE have been a vital source to our understanding of the global routing system. However the collected BGP data contains both the updates generated by actual route changes, and the updates of BGP routing table transfers resulted from BGP session resets between operational routers and the data collection stations. Since the latter is caused by measurement artifact, it is important to accurately separate out the latter from the former. In this paper, we present the design and evaluation of the minimum collection time (MCT) algorithm. Given a BGP update stream, MCT can identify the start and duration of each routing table transfer in the stream with high accuracy. We evaluated MCT performance by using three months of BGP data from all RIPE collectors. Our results show that out of the total 1664 BGP resets with 166 monitors, MCT can identify BGP routing table transfers with over 95% accuracy, and pinpoint the exact starting time of the detected table transfers in 83% of such cases. Accurate detection of BGP table transfers enables users to separate out real BGP routing changes and measurement artifacts, and can be used to measure and diagnose the BGP session failures.

Managing interdomain traffic in Latin America: a new perspective based on LISP

The characteristics of Latin American network infrastructures have global consequences, particularly in the area of interdomain traffic engineering. As an example, Latin America shows the largest de-aggregation factor of IP prefixes among all regional Internet registries, being proportionally the largest contributor to the growth and dynamics of the global BGP routing table. In this article we analyze the peculiarities of LA interdomain routing architecture, and provide up-to-date data about the combined effects of the multihoming and TE practices in the region. We observe that the Internet Research Task Force initiative on the separation of the address space into locators and identifiers can not only alleviate the growth and dynamics of the global routing table, but can also offer appealing TE opportunities for LA. We outline one of the solutions under discussion at the IRTF, the Locator/Identifier Separation Protocol, and examine its potential in terms of interdomain traffic management in the context of LA. The key advantage of LISP is its nondisruptive nature, but the existing proposals for its control plane have some problems that may hinder its possible deployment. In light of this, we introduce a promising control plane for LISP that can solve these issues, and at the same time has the potential to bridge the gap between intradomain and interdomain traffic management.

Lord of the Links: A Framework for Discovering Missing Links in the Internet Topology

The topology of the Internet at the autonomous system (AS) level is not yet fully discovered despite significant research activity. The community still does not know how many links are missing, where these links are and finally, whether the missing links will change our conceptual model of the Internet topology. An accurate and complete model of the topology would be important for protocol design, performance evaluation and analyses. The goal of our work is to develop methodologies and tools to identify and validate such missing links between ASes. In this work, we develop several methods and identify a significant number of missing links, particularly of the peer-to-peer type. Interestingly, most of the missing AS links that we find exist as peer-to-peer links at the Internet exchange points (IXPs). First, in more detail, we provide a large-scale comprehensive synthesis of the available sources of information. We cross-validate and compare BGP routing tables, Internet routing registries, and traceroute data, while we extract significant new information from the less-studied Internet exchange points (IXPs). We identify 40% more edges and approximately 300% more peer-to-peer edges compared to commonly used data sets. All of these edges have been verified by either BGP tables or traceroute. Second, we identify properties of the new edges and quantify their effects on important topological properties. Given the new peer-to-peer edges, we find that for some ASes more than 50% of their paths stop going through their ISPs assuming policy-aware routing. A surprising observation is that the degree of an AS may be a poor indicator of which ASes it will peer with.

Computing the Types of the Relationships Between Autonomous Systems

We investigate the problem of computing the types of the relationships between Internet Autonomous Systems. We refer to the model introduced by Gao [IEEE/ACM Transactions on Networking, 9(6):733-645, 2001] and Subramanian (IEEE Infocom, 2002) that bases the discovery of such relationships on the analysis of the AS paths extracted from the BGP routing tables. We characterize the time complexity of the above problem, showing both NP-completeness results and efficient algorithms for solving specific cases. Motivated by the hardness of the general problem, we propose approximation algorithms and heuristics based on a novel paradigm and show their effectiveness against publicly available data sets. The experiments provide evidence that our algorithms perform significantly better than state-of-the-art heuristics

Routing table partitioning for speedy packet lookups in scalable routers

Most of the high-performance routers available commercially these days equip each of their line cards (LCs) with a forwarding engine (FE) to perform table lookups locally. This work introduces and evaluates a technique for speedy packet lookups, called SPAL, in such routers. The BGP routing table under SPAL is fragmented into subsets which constitute forwarding tables for different FEs so that the number of table entries in each FE drops as the router grows. This reduction in the forwarding table size drastically lowers the amount of SRAM (e.g., L3 data cache) required in each LC to hold the trie constructed according to the prefix matching algorithm. SPAL calls for caching the lookup result of a given IP address at its home LC (denoted by LC/sub ho/, using the LR-cache), such that the result can satisfy the lookup requests for the same address from not only LC/sub ho/, but also other LCs quickly. Our trace-driven simulation reveals that SPAL leads to improved mean lookup performance by a factor of at least 2.5 (or 4.3) for a router with three (or 16) LCs, if the LR-cache contains 4K blocks. SPAL achieves this significant improvement, while greatly lowering the SRAM (i.e., the L3 data cache plus the LR-cache combined) requirement in each LC and possibly shortening the worst-case lookup time (thanks to fewer memory accesses during longest-prefix matching search) when compared with a current router without partitioning the routing table. It promises good scalability (with respect to routing table growth) and exhibits a small mean lookup time per packet. With its ability to speed up packet lookup performance while lowering overall SRAM substantially, SPAL is ideally applicable to the new generation of scalable high-performance routers.

Leveraging network performance with IPv6 multihoming and multiple provider-dependent aggregatable prefixes

Multihoming, the practice of connecting to multiple providers, is becoming highly popular. Due to the growth of the BGP routing tables in the Internet, IPv6 multihoming is required to preserve the scalability of the interdomain routing system. A proposed method is to assign multiple provider-dependent aggregatable (PA) IPv6 prefixes to each site, instead of a single provider-independent (PI) prefix. We show that the use of multiple PA prefixes not only allows route aggregation but also can be used to reduce end-to-end delays by leveraging the Internet path diversity. We quantify the gain in path diversity, and show that a dual-homed stub AS that uses multiple PA prefixes has already a better Internet path diversity than any multihomed stub AS that uses a single PI prefix, whatever its number of providers. The benefits provided by the use of IPv6 multihoming with multiple PA prefixes are an opportunity to develop the support for quality of service and traffic engineering.

IPv4 address allocation and the BGP routing table evolution

The IP address consumption and the global routing table size are two of the vital parameters of the Internet growth. In this paper we quantitatively characterize the IPv4 address allocations made over the past six years and the global BGP routing table size changes during the same period of time. About 63,000 address blocks have been allocated since the beginning of the Internet, of which about 18,000 address blocks were allocated during our study period, from November 1997 to August 2004. Among these 18,000 allocations, 90% of them started being announced into the BGP routing table within 75 days after the allocation, while 8% of them has not been used up to now. Among all the address blocks that have ever been used, 45% of them were split into fragments smaller than the original allocated blocks; without these fragementations, the current BGP table would have been about half of its current size. Furthermore, we found that the evolution of BGP routing table consists of both the appearance of new prefixes and the disappearance of old prefixes. While the change of the BGP routing table size only reflects the combined results of the two processes, the dynamics of either process is much higher than that of the BGP table size. Finally, we classify routing prefixes into covering and covered ones, and examine their evolution separately. For the covered prefixes, which account for almost half of the BGP table size, we infer their practical motives such as multihoming, load balancing, and traffic engineering, etc., via a classification method.

On Global Multicast Networks Using Satellite Unidirectional Links

IP Multicast network deployment is still lagging far behind the Internet. Meanwhile, satellite links have been considered as the links that can deliver multicast traffic efficiently because of their broadcast nature. This paper analyzes the deployment of global multicast networks using satellite unidirectional links assuming that the Internet's backbone networks become the UDL feeds, and regional and stub networks become the receivers. The main objective is to understand how and how much satellite unidirectional links benefit the deployment of global multicast networks. We simulate deployment scenarios on several instances of the Internet topology taken from the RouteViews BGP routing table snapshots, where each scenario consists of UDL feeds and receivers placement strategies. The performance of each deployment scenario is measured using the multicast link count, cumulative multicast out-degree, and the expected number of downstreams per UDL receiver. Our simulations demonstrate that such a deployment gives an advantage over deployment using the existing links on the Internet.

On characterizing BGP routing table growth

The sizes of the BGP routing tables have increased by an order of magnitude over the last six years. This dramatic growth of the routing table can decrease the packet forwarding speed and demand more router memory space. In this paper, we explore the extent that various factors contribute to the routing table size and characterize the growth of each contribution. We begin with measurement study using routing tables of Oregon Route Views server to determine the contributions of multi-homing, load balancing, address fragmentation, and failure to aggregate to routing table size. We find that the contribution of address fragmentation is the greatest and is three times that of multi-homing or load balancing. The contribution of failure to aggregate is the least. Although multi-homing and load balancing contribute less to routing table size than address fragmentation does, we observe that the contribution of multi-homing and that of load balancing grow faster than the routing table does and that the load balancing has surpassed multi-homing becoming the fastest growing contributor. Moreover, we find that both load balancing and multi-homing contribute to routing table growth by introducing more prefixes of length greater than 17 but less than 25, which is the fastest growing class of prefixes. Next, we compare the growth of the routing table to the expanding of IP addresses that can be routed and conclude that the growth of routable IP addresses is much slower than that of routing table size. Last, we demonstrate that our findings based on the view derived from the Oregon server are accurate through evaluation using additional 15 routing tables collected from different locations in the Internet.