Border Gateway Protocol Sessions Research Articles

Who's Got My Back? Measuring the Adoption of an Internet-wide BGP RTBH Service

Distributed Denial-of-Service (DDoS) attacks continue to threaten the availability of Internet-based services. While countermeasures exist to decrease the impact of these attacks, not all operators have the resources or knowledge to deploy them. Alternatively, anti-DDoS services such as DDoS clearing houses and blackholing have emerged. Unwanted Traffic Removal Service (UTRS), being one of the oldest community-based anti-DDoS services, has become a global free collaborative service that aims at mitigating major DDoS attacks through the Border Gateway Protocol (BGP). Once the BGP session with UTRS is established, UTRS members can advertise part of the prefixes belonging to their AS to UTRS. UTRS will forward them to all other participants, who, in turn, should start blocking traffic to the advertised IP addresses. In this paper, we develop and evaluate a methodology to automatically detect UTRS participation in the wild. To this end, we deploy a measurement infrastructure and devise a methodology to detect UTRS-based traffic blocking. Using this methodology, we conducted a longitudinal analysis of UTRS participants over ten weeks. Our results show that at any point in time, there were 562 participants, including multihomed, stub, transit, and IXP ASes. Moreover, we surveyed 245 network operators to understand why they would (not) join UTRS. Results show that threat and coping appraisal significantly influence the intention to participate in UTRS.

Crafting optimal and resilient iBGP-IP/MPLS overlays for transit backbone networks

The Internet is a collection of interconnected Autonomous Systems (ASes) that use the Border Gateway Protocol (BGP) to exchange reachability information. In this regard, BGP stability and scalability in the inter-domain scope have been matters of major concern for many years, and network engineers have been applying several techniques to cope with these issues. BGP is also used intra-domain (internal BGP - iBGP), to disseminate reachability information inside each AS, and works together with the Interior Gateway Protocols (IGPs) such as OSPF or IS-IS, to build routing tables. Route reflection is a widely adopted technique to tackle BGP scalability in the intra-domain scope, and choosing which routers will play the reflector role and which BGP sessions will be established among reflectors and clients (i.e. the routers which are not elected as reflectors), building an overlay of iBGP sessions, is known as the iBGP overlay design problem. The design of an optimal iBGP overlay is known to be a NP-Hard problem, and we proposed solutions for pure IP networks (i.e. best effort traffic forwarding) in our previous work. However, most Internet providers implement their backbones by combining IP routing with MPLS (Multiprotocol Label Switching) for QoS-aware traffic forwarding. MPLS forwarding incorporates traffic engineering and more efficient failover mechanisms; under this traffic forwarding paradigm, the design of traffic-engineered Label Switched Paths (LSPs, also referred as MPLS tunnels) shall be combined with the aforementioned iBGP overlay design. The present work introduces a coordinated design of both the iBGP overlay and the IP/MPLS substrates. Our contribution is the proposal of an optimal and resilient topology design for an IP/MPLS Internet backbone, which takes advantage of traffic engineering features to optimize the demands, while guaranteeing iBGP overlay optimality. We present a complete solution for a real world scenario, and we study the scalability of the solution for synthetic topologies, achieving encouraging results.

Effect of Route Reflection on IBGP Convergence and an approach to reduce convergence time

Request for Comments (RFCs) for Border gateway Protocol (BGP) suggest that the network topology using BGP must have full mesh of IBGP sessions to avoid routing loops. Routing loop is a condition where packets are routed between two or more routers resulting in slow convergence and routing instability. Route reflection is one of the strategies to avoid full mesh of internal BGP sessions between BGP speaking routers in an autonomous system. This paper focuses on demonstrating an effect of using route reflection on convergence time in a small network. A mixed network scenario of external and internal BGP sessions is considered for demonstration. Results of the simulation have shown that, route reflection can significantly increase the convergence time avoiding full mesh. Also an approach to reduce the convergence time has been proposed. Proposed algorithm is based on the principle of creating logical group of router reflectors. The same concept can be scaled for larger networks for different scenarios.

Practical Security Approaches against Border Gateway Protocol (BGP) Session Hijacking Attacks between Autonomous Systems

The border gateway protocol (BGP) is the default inter domain routing protocol used on the internet for exchanging information between autonomous systems. Available literature suggests that BGP is vulnerable to session hijacking attacks. There are a number of proposals aimed at improving BGP security which have not been fully implemented. This paper examines a number of approaches for securing BGP through a comparative study and identifies the reasons why these proposals have not been implemented commercially. This paper analyses the architecture of internet routing and the design of BGP while focusing on the problem of BGP session hijacking attacks. Using Graphical Network Simulator 3 (GNS-3), a session hijack is demonstrated and a solution which involves the implementation of route filtering, policy-maps and route-maps on CISCO routers representing ASes is carried out. In the end, a workable industry standard framework for securing and protecting BGP sessions and border routers from exploitation with little or no modification to the existing routing infrastructure is demonstrated.

A Novel Approach for Secure Routing Through BGP Using Symmetric Key

The Border Gateway Protocol (BGP) is the path vector routing protocol that connects different autonomous systems.. These ASes have unique integer numbers which assign by IANA organization. The traditional BGP protocol is not sufficient to provide security and authentication for AS path and verification of AS number ownership as well as network IP prefix. The BGP remains vulnerable to various types of misconfiguration by users and attacks. Many secure BGP algorithms have been proposed but complexity of algorithm and attack on that models still remain open problem. In this paper, we propose an efficient model for SBGP; initially establish trust relationship between BGP peers. In this process BGP use TCP protocol for reliable communication. The BGP routers will attempt to create secure BGP session by exchanging BGP Open messages. During this Open messages master BGP router generate private key with help of cyclic shifting of ASCII of password called cyclic shift algorithm. Then hash of this private key send towards neighbour. Instead of key exchange, we use hashing algorithm, we generate hash of only key through SHA-1. This hash code for private key sent with Open messages during session establishment. When this Open messages receive by neighbor BGP routers, first it generate key using same password with same algorithm & generate hash code for same and then compare both hash code. If it matches then establish secure session with master BGP router & accept the Autonomous system number which is sent by master router during Open Messages. In this manner both BGP speakers make trust relationship between each other & then exchange route UPDATE within secure channel. If hash code at receiver end does not match then simply receiving BGP router discard Open messages and does not make connection with unauthorized AS number. If malicious router wants to inject false route or false ip prefix then it does not create secure session by lack of secure private key. So malicious router does not participate in above BGP routing process.

On a novel pattern of distributed low-rate denial of service attacks

Recent research has exposed that low-rate transmission control protocol (TCP)-targeted denial-of-service (DoS) attacks can cause failures of border gateway protocol (BGP) sessions and route flapping without being detected by current defense mechanisms. Deliberately constructed distributed low-rate denial of service(DLDoS) attacks can even generate surge of updates throughout the Internet. As this breed of attacks need a low-rate time gap between pulses, this time gap waste large number opportunities to form other attack flows. In this paper, we investigate the possibility and methods of employing the time gap to evoke other attack flows against target network. Simulations show that this method can exponentially reduce the number of nodes and therefore lower the cost of the attack when attacking multiple BGP sessions simultaneously. We also proposed the attack scheme and defense mechanisms of this kind of attacks.

Rethinking iBGP routing

The Internet is organized as a collection of administrative domains, known as Autonomous Systems (ASes). These ASes interact through the Border Gateway Protocol (BGP) that allows them to share reachability information. Adjacent routers in distinct ASes use external BGP (eBGP), whereas in a given AS routes are propagated over internal BGP (iBGP) sessions between any pair of routers. In large ASes where a logical full-mesh is not possible, confederations or route reflectors (RRs) are used. However, these somewhat scalable alternatives have introduced their own set of unpredictable effects (persistent routing oscillations and forwarding loops causing an increase of the convergence time) addressed in the literature [1]. The solution we propose to these issues consists of a structured routing overlay holding a comprehensive view of the routes. We describe the design of a distributed entity that performs BGP route pre-computation for its clients inside a large backbone network and propagates the paths to the routers. Compared to the current iBGP routing, the advantage of the overlay approach is the separation between the responsibility of the control plane (route storage and best path computation) and the forwarding of the packets. One of the major improvements we bring is the divided routing table tackling the scalability concerns and allowing for parallel computation of paths.

A Survey of BGP Session Maintenance Issues and Solutions

Normal 0 21 false false false MicrosoftInternetExplorer4 /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Tableau Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:""; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman"; mso-fareast-font-family:"Times New Roman"; mso-ansi-language:#0400; mso-fareast-language:#0400; mso-bidi-language:#0400;} The Border Gateway Protocol (BGP) is the routing protocol that glues together the global Internet. BGP makes use of a managed session to maintain a bidirectional error-free session over which reachability information is exchanged between Autonomous Systems (ASes) in the global Internet. Nevertheless, despite its great importance to BGP, this ``managed session'' suffers from some weaknesses such as a slow failure mechanism, which may represent a great deal of lost data, and some security problems. This paper surveys both research and standardization efforts relating to BGP session maintenance and interdomain routing.

Scaling Virtual Private Networks

Many organizations purchase connectionless Virtual Private Network (VPN) services from a telecommunications service provider, who deploys a network of routers, interconnected by high bandwidth trunks, which serve thousands of customers. The nodes in a service provider network are Provider Edge routers (PEs), which store forwarding tables which dictate on which outgoing link to send an incoming packet addressed to a particular destination. In practice, router capacity may be limited by memory, bandwidth, or processing capacity for BGP (Border Gateway Protocol) sessions used to advertise addresses. We describe three techniques that help a service provider deploy a large-scale VPN service. The first technique shows how a service provider can deploy sets of routers, called “route reflector planes,” to advertise addresses when the number of addresses in the service provider network grows. The second technique, applicable when the number of BGP sessions is the limiting resource, is a method to enhance the network reliability at no additional cost, by having each customers forwarding table stored on only a small number of PEs. The third technique is a way to estimate the number of VPNs that can be handled by a PE, when memory is the limiting resource.

BGP session lifetime modeling in congested networks

The reliable Border Gateway Protocol (BGP) is essential for supporting high quality Internet data communication. In present Internet, due to the lack of differentiation mechanism in packet forwarding, BGP sessions are sensitive to severe network congestion. It is thus important to understand the reliability of BGP in congested networks, for the purposes of system reliability evaluation and failure avoidance.In this paper, we investigate the lifetime of BGP sessions in two types of network congestion scenarios: (1) the TCP bandwidth saturation caused by traffic engineering failures; (2) the UDP bandwidth saturation caused by worm attacks. Using statistical analysis based on intensive simulation results, we find that in most cases the BGP session lifetime can be characterized using exponential distributions and Weibull distributions. In the case of TCP bandwidth saturation, if all TCP connections have the same round trip time, the tail of the BGP lifetime tends to be power law. Furthermore, we propose an approximate model for the expected lifetime of BGP sessions, and show that by slightly changing the TCP retransmission parameters, the robustness of BGP sessions can be improved significantly.