IP Prefixes Research Articles

An SRAM-based novel hardware architecture for longest prefix matching for IP route lookup

A static random access memory (SRAM)-based novel hardware architecture for longest prefix match (LPM) search scheme has been proposed in this paper. The key concept of this architecture is to store the IP prefixes virtually in the forwarding table. This architecture reduces memory consumption by using a two-tier hierarchical SRAM-based memory structure for maintaining the next hop port information. Originally, next hop addresses are kept in the shared global memory called next hop global memory (NHGM) and its links are maintained in another memory, called next hop link memory (NHLM). This approximately reduces memory consumption by 50---62.5% compared to existing SRAM-based schemes. The proposed architecture consumes single memory write cycle to store an IP prefix and also takes single memory read cycle for LPM search. However, finding next hop information incurs two memory read cycles due to hierarchical next hop memory structure. The proposed scheme performs an LPM lookup operation in 1.05---1.31 ns in IPv4 and between 1.05 and 1.6 ns in IPv6. This results into LPM search throughput of 950 million lookups per second (MLPS) to 760 MLPS in IPv4 and between 620 and 950 MLPS in IPv6. The average search throughput achievable from this architecture is roughly 850 MLPS in IPv4 and 780 MLPS in IPv6. The numerical results show that this architecture significantly reduces memory requirement, power consumption, and transistor-count/bit requirement.

See How ISPs Care

The Resource Public Key Infrastructure (RPKI) allows BGP routers to verify the origin AS of an IP prefix. In this demo, we present a software extension which performs prefix origin validation in the web browser of end users. The browser extension shows the RPKI validation outcome of the web server infrastructure for the requested web domain. It follows the common plug-in concepts and does not require special modifications of the browser software. It operates on live data and helps end users as well as operators to gain better insight into the Internet security landscape.

Efficient IP lookup using hybrid trie-based partitioning of TCAM-based open flow switches

IP forwarding technique in open flow switch can be done by comparing the destination IP address, which is stored in forwarding table with the input IP prefix. Ternary content-addressable memory (TCAM) is one of the popular mechanisms to store and forward IP packet where flow entries are organized in sorted manner. Searching a prefix value in TCAM uses longest prefix match rather than exact match technique. The major drawback of TCAM is high power consumption (12---15 Watts per chip) due to increase in lookup time. The objective of this paper was to reduce the search time of a key, which is stored in the forwarding table. This paper also proposes an efficient way to represent data and to reduce the index TCAM size by using $$y$$y-fast trie-partitioning algorithm, and it will take search time complexity of $$O(loglog~n)$$O(loglogn).

From the consent of the routed

The Resource Public Key Infrastructure (RPKI) is a new infrastructure that prevents some of the most devastating attacks on interdomain routing. However, the security benefits provided by the RPKI are accomplished via an architecture that empowers centralized authorities to unilaterally revoke any IP prefixes under their control. We propose mechanisms to improve the transparency of the RPKI, in order to mitigate the risk that it will be used for IP address takedowns. First, we present tools that detect and visualize changes to the RPKI that can potentially take down an IP prefix. We use our tools to identify errors and revocations in the production RPKI. Next, we propose modifications to the RPKI's architecture to (1) require any revocation of IP address space to receive consent from all impacted parties, and (2) detect when misbehaving authorities fail to obtain consent. We present a security analysis of our architecture, and estimate its overhead using data-driven analysis.

RPKI vs ROVER

BGP, the Internet's interdomain routing protocol, is highly vulnerable to routing failures that result from unintentional misconfigurations or deliberate attacks. To defend against these failures, recent years have seen the adoption of the Resource Public Key Infrastructure (RPKI), which currently authorizes 4% of the Internet's routes. The RPKI is a completely new security infrastructure (requiring new servers, caches, and the design of new protocols), a fact that has given rise to some controversy. Thus, an alternative proposal has emerged: Route Origin Verification (ROVER}, which leverages the existing reverse DNS (rDNS) and DNSSEC to secure the interdomain routing system. Both RPKI and ROVER rely on a hierarchy of authorities to provide trusted information about the routing system. Recently, however, it has been argued that the misconfigured, faulty or compromised RPKI authorities introduce new vulnerabilities in the routing system, which can take IP prefixes offline. Meanwhile, the designers of ROVER claim that it operates in a "fail-safe mode", where "[o]ne could completely unplug a router verification application at any time and Internet routing would continue to work just as it does today". There has been debate in Internet community mailing lists about the pros and cons of both approaches. This poster therefore compares the impact of ROVER failures to those of the RPKI, in a threat model that covers misconfigurations, faults or compromises of their trusted authorities.

SDX

BGP severely constrains how networks can deliver traffic over the Internet. Today's networks can only forward traffic based on the destination IP prefix, by selecting among routes offered by their immediate neighbors. We believe Software Defined Networking (SDN) could revolutionize wide-area traffic delivery, by offering direct control over packet-processing rules that match on multiple header fields and perform a variety of actions. Internet exchange points (IXPs) are a compelling place to start, given their central role in interconnecting many networks and their growing importance in bringing popular content closer to end users. To realize a Software Defined IXP (an "SDX"), we must create compelling applications, such as "application-specific peering"---where two networks peer only for (say) streaming video traffic. We also need new programming abstractions that allow participating networks to create and run these applications and a runtime that both behaves correctly when interacting with BGP and ensures that applications do not interfere with each other. Finally, we must ensure that the system scales, both in rule-table size and computational overhead. In this paper, we tackle these challenges and demonstrate the flexibility and scalability of our solutions through controlled and in-the-wild experiments. Our experiments demonstrate that our SDX implementation can implement representative policies for hundreds of participants who advertise full routing tables while achieving sub-second convergence in response to configuration changes and routing updates.

SDX

BGP severely constrains how networks can deliver traffic over the Internet. Today's networks can only forward traffic based on the destination IP prefix, by selecting among routes offered by their immediate neighbors. We believe Software Defined Networking (SDN) could revolutionize wide-area traffic delivery, by offering direct control over packet-processing rules that match on multiple header fields and perform a variety of actions. Internet exchange points (IXPs) are a compelling place to start, given their central role in interconnecting many networks and their growing importance in bringing popular content closer to end users. To realize a Software Defined IXP (an "SDX"), we need new programming abstractions that allow participating networks to create and run these applications and a runtime that both behaves correctly when interacting with BGP and ensures that applications do not interfere with each other. We must also ensure that the system scales, both in rule-table size and computational overhead. In this demo, we show how we tackle these challenges demonstrating the flexibility and scalability of our SDX platform. The paper also appears in the main program.

Prefix Cuttings for Packet Classification with Fast Updates

Packet classification is a key technology of the Internet for routers to classify the arriving packets into different flows according to the predefined rulesets. Previous packet classification algorithms have mainly focused on search speed and memory usage, while overlooking update performance. In this paper, we propose PreCuts, which can drastically improve the update speed. According to the characteristics of IP field, we implement three heuristics to build a 3-layer decision tree. In the first layer, we group the rules with the same highest byte of source and destination IP addresses. For the second layer, we cluster the rules which share the same IP prefix length. Finally, we use the heuristic of information entropy-based bit partition to choose some specific bits of IP prefix to split the ruleset into subsets. The heuristics of PreCuts will not introduce rule duplication and incremental update will not reduce the time and space performance. Using ClassBench, it is shown that compared with BRPS and EffiCuts, the proposed algorithm not only improves the time and space performance, but also greatly increases the update speed.

A Novel Approach for Secure Routing Through BGP Using Symmetric Key

The Border Gateway Protocol (BGP) is the path vector routing protocol that connects different autonomous systems.. These ASes have unique integer numbers which assign by IANA organization. The traditional BGP protocol is not sufficient to provide security and authentication for AS path and verification of AS number ownership as well as network IP prefix. The BGP remains vulnerable to various types of misconfiguration by users and attacks. Many secure BGP algorithms have been proposed but complexity of algorithm and attack on that models still remain open problem. In this paper, we propose an efficient model for SBGP; initially establish trust relationship between BGP peers. In this process BGP use TCP protocol for reliable communication. The BGP routers will attempt to create secure BGP session by exchanging BGP Open messages. During this Open messages master BGP router generate private key with help of cyclic shifting of ASCII of password called cyclic shift algorithm. Then hash of this private key send towards neighbour. Instead of key exchange, we use hashing algorithm, we generate hash of only key through SHA-1. This hash code for private key sent with Open messages during session establishment. When this Open messages receive by neighbor BGP routers, first it generate key using same password with same algorithm & generate hash code for same and then compare both hash code. If it matches then establish secure session with master BGP router & accept the Autonomous system number which is sent by master router during Open Messages. In this manner both BGP speakers make trust relationship between each other & then exchange route UPDATE within secure channel. If hash code at receiver end does not match then simply receiving BGP router discard Open messages and does not make connection with unauthorized AS number. If malicious router wants to inject false route or false ip prefix then it does not create secure session by lack of secure private key. So malicious router does not participate in above BGP routing process.

Effective Performance Compensation for the Premature Handoff Trigger in FMIPv6 Networks

Handoff trigger in Fast Handoff for Mobile IPv6 commonly use the underlying link-layer (L2) events to make effective handoff decisions. Ideally, with the timely L2 trigger invoking the handoff protocols of upper layer, the specified handoff procedures can be fully accomplished before terminating the current access link for enhancing the network performance. Firing the L2 trigger however is not always preferable owing to the irregular mobility profile acted by the mobile terminals. The premature L2 trigger leads to the unnecessary handoff with serious performance loss and resources waste. To address this issue, a performance compensation scheme for the premature handoff trigger (PC-PHT) is proposed, where the IP prefix in the Router Acknowledgement messages received by the mobile node within a defined time frame after the L2 trigger are firstly analyzed to promptly determine the premature trigger, and then a set of specific performance compensation measures are developed to accelerate the process of re-accessing into the previous served subnet. The simulations conducted on Network Simulator platform indicate that PC-PHT outperforms the compared schemes in the case that the L2 trigger does not correspond to an actual handoff by promptly determining the premature trigger, accelerating the re-accessing process and partially eliminating the performance loss.

A comparative study on IP prefixes and their origin ases in BGP and the IRR

The IRR is a set of globally distributed databases with which ASes can register their routing and address-related information. It is often believed that the quality of the IRR data is not reliable since there are few economic incentives for the ASes to register and update their routing information timely. To validate these negative beliefs, we carry out a comprehensive analysis of (IP prefix, its origin AS) pairs in BGP against the corresponding information registered with the IRR, and vice versa. Considering the BGP and IRR practices, we propose a methodology to match the (IP prefix, origin AS) pairs between the IRR and BGP. We observe that the practice of registering IP prefi xes and origin ASes with the IRR is prevalent. However, the quality of the IRR data can vary substantially depending on routing registries, regional Internet registries (to which ASes belong), and AS types. We argue that the IRR can help improve the security level of BGP routing by making BGP routers selectively rely on the corresponding IRR data considering these observations.

A Routing Scalability Model for Core-Edge Separation Internet with Hybrid Routing

It has been widely accepted that core-edge separation architecture can improve routing scalability of the Internet. On the other hand, autonomous system (AS) level hybrid routing protocol has been proposed, where AS numbers are used for inter-domain routing instead of IP prefixes. It is expected that the combination of core-edge separation architecture and AS level hybrid routing can further improve the routing scalability. However, there is a lack of quantitative analysis on the routing scalability improvement for such system. In this letter, we derive a theoretic routing scalability model for analyzing the core-edge separation Internet with hybrid routing protocol, in which the core networks and edge networks comprise of ASes with different business types. The simulation result demonstrates the accuracy of the theoretic model and it is shown that the routing scalability has been improved significantly with routing table size reducing to 0.8% of the original value.

HaRP: Rapid Packet Classification via Hashing Round-Down Prefixes

Packet classification is central to a wide array of Internet applications and services, with its approaches mostly involving either hardware support or optimization steps needed by software-oriented techniques (to add precomputed markers and insert rules in the search data structures). Unfortunately, an approach with hardware support is expensive and has limited scalability, whereas one with optimization fails to handle incremental rule updates effectively. This work deals with rapid packet classification, realized by hashing round-down prefixes (HaRP) in a way that the source and the destination IP prefixes specified in a rule are rounded down to “designated prefix lengths” (DPL) for indexing into hash sets. HaRP exhibits superb hash storage utilization, able to not only outperform those earlier software-oriented classification techniques but also well accommodate dynamic creation and deletion of rules. HaRP makes it possible to hold all its search data structures in the local cache of each core within a contemporary processor, dramatically elevating its classification performance. Empirical results measured on an AMD 4-way 2.8 GHz Opteron system (with 1 MB cache for each core) under six filter data sets (each with up to 30 K rules) obtained from a public source unveil that HaRP enjoys up to some 3.6× throughput level achievable by the best known decision tree-based counterpart, HyperCuts (HC).

Prediction models for long-term Internet prefix availability

The Border Gateway Protocol (BGP) maintains inter-domain routing information by announcing and withdrawing IP prefixes. These routing updates can cause prefixes to be unreachable for periods of time, reducing prefix availability observed from different vantage points on the Internet. The observed prefix availability values may not meet the standards promised by Service Level Agreements (SLAs).In this paper, we develop a framework for predicting long-term availability of prefixes, given short-duration prefix information from publicly available BGP routing databases like RouteViews, and prediction models constructed from information about other Internet prefixes. We compare three prediction models and find that machine learning-based prediction methods outperform a baseline model that predicts the future availability of a prefix to be the same as its past availability. Our results show that mean time to failure is the most important attribute for predicting availability. We also quantify how prefix availability is related to prefix length and update frequency. Our prediction models achieve 82% accuracy and 0.7 ranking quality when predicting for a future duration equal to the learning duration. We can also predict for a longer future duration, with graceful performance reduction. Our models allow ISPs to adjust BGP routing policies if predicted availability is low, and are generally useful for cloud computing systems, content distribution networks, P2P, and VoIP applications.

Route oracle

Many network-management problems in large backbone networks need the answer to a seemingly simple question: where does a given IP packet, entering the network at a particular place and time, leave the network to continue on its path to the destination? Answering this question at scale and in real time is challenging for several reasons: (i) a destination IP address could match several IP prefixes, (ii) the longest-matching prefix may change over time, (iii) the number of IP prefixes and routing protocol messages is very large, and (iv) network-management applications often require answers to this question for a large number of destination IP addresses in real time. In this paper, we present an efficient algorithm for tracking prefix-match changes for ranges of IP addresses. We then present the design, implementation, and evaluation of the Route Oracle tool that answers queries about routing changes on behalf of network management applications. Our design of Route Oracle includes several performance optimizations, such as pre-processing of BGP update messages, and parallelization of query processing. Experiments with BGP measurement data from a large ISP backbone demonstrate that our system answers queries in real time and at scale.

Managing interdomain traffic in Latin America: a new perspective based on LISP

The characteristics of Latin American network infrastructures have global consequences, particularly in the area of interdomain traffic engineering. As an example, Latin America shows the largest de-aggregation factor of IP prefixes among all regional Internet registries, being proportionally the largest contributor to the growth and dynamics of the global BGP routing table. In this article we analyze the peculiarities of LA interdomain routing architecture, and provide up-to-date data about the combined effects of the multihoming and TE practices in the region. We observe that the Internet Research Task Force initiative on the separation of the address space into locators and identifiers can not only alleviate the growth and dynamics of the global routing table, but can also offer appealing TE opportunities for LA. We outline one of the solutions under discussion at the IRTF, the Locator/Identifier Separation Protocol, and examine its potential in terms of interdomain traffic management in the context of LA. The key advantage of LISP is its nondisruptive nature, but the existing proposals for its control plane have some problems that may hinder its possible deployment. In light of this, we introduce a promising control plane for LISP that can solve these issues, and at the same time has the potential to bridge the gap between intradomain and interdomain traffic management.

DMP-tree: A dynamic M-way prefix tree data structure for strings matching

We propose DMP-tree, a dynamic M-way prefix tree, data structure for the string matching problem in general and prefix matching in particular. DMP-tree has been initially devised for fast and efficiently handling prefix matching which constitutes the building block of some applications in the computer realm and related area. It is assumed there are strings of an alphabet Σ which are ordered. The data strings can have different lengths and some of them can be prefixes of others. Two well known applications of prefix matching are layers 3 and 4 switching in TCP/IP protocols. In layer 3 switching, routers forward an IP packet by checking its destination address and finding the longest matching prefix from a database. In layer 4 switching, the source and destination addresses are used to classify packets for differentiated service and Quality of Services (QoS). DMP-tree is a superset of B-tree. When none of the data strings are a prefix of each other, DMP-tree is the same as B-tree. In DMP-tree, no data string can be in a higher level than another data string which is its prefix. This requires a special procedure for node splitting. Indeed, node splitting differentiates DMP-tree from B-tree. The proposed data structure is simple, well defined, easy to implement in hardware or software and efficient in terms of memory usages and search time compared to other data structures proposed for prefix matching. We have implemented DMP-tree and the experimental results for simulated IP prefixes from the {0, 1} character set show an average search time of Log M N for a large number of N, number of data elements, when the internal node branching factor M is big enough (⩾5).

Two stage packet classification using most specific filter matching and transport level sharing

In this paper we introduce two new concepts to the design of packet classification systems. First, we propose most specific filter matching (MSFM), an improvement over the well known Cross Producting algorithm [V. Srinivasan, S. Suri, G. Varghese, M. Waldvogel, Fast and scalable layer four switching, in: Proceedings of ACM SIGCOMM, 1998] that significantly reduces the memory requirement of the earlier scheme. Second, we suggest that rules specifying the same source-destination IP prefix pair can be grouped together forming shared sets of transport level fields. This property of Transport Level Sharing (TLS), which characterizes real world classification databases is exploited for reducing a classifier's memory requirement and for hardware acceleration. We split the classification process into two stages. First, we perform classification on source-destination IP prefix pairs using the MSFM algorithm. Second, we perform classification on transport level fields exploiting transport level sharing. It is the combination of most specific filter matching and transport level sharing which results in a scheme that requires no more than 11 dependent memory accesses in the critical path independent of the size of the classification database. The memory access bandwidth of our scheme is also bounded when our scheme is accelerated in hardware. Compared to other schemes which involve a small and predictable number of steps in the critical path (e.g., Cross Producting [V. Srinivasan, S. Suri, G. Varghese, M. Waldvogel, Fast and scalable layer four switching, in: Proceedings of ACM SIGCOMM, 1998] or Recursive Flow Classification [P. Gupta, N. McKeown, Packet classification on multiple fields, in: Proceedings of ACM SIGCOMM, 1999]) the combination of most specific filter matching and transport level sharing is associated with the least memory requirement.

IP-based Clustering for Peer-to-Peer Overlays

The efficiency of overlay networks built on top of the IP network is often threatened by the mismatch between the topologies of the overlay and the underlying IP network, resulting in unnecessary traffic and increased latencies. Substantial improvement can be achieved by optimizing the logical links between overlay nodes to better match the IP network topology. In this paper, we propose a new method for selfoptimization of a DHT-based peer-to-peer overlay. Our method has no need for active measurement of inter-node latencies, thus minimizing network traffic costs of node insertion and topology maintenance. We verify our method by means of analysis of large data sets of latency measurements between arbitrary nodes on the Internet, proving correlation among common IP prefix length of communicating nodes and latency.

Fast packet classification for two-dimensional conflict-free filters

Routers can use packet classification to support advanced functions such as QoS routing, virtual private networks and access control. Unlike traditional routers, which forward packets based on destination address only, routers with packet classification capability can forward packets based on multiple header fields, such as source address, protocol type, or application port numbers. The destination-based forwarding can be thought of as one-dimensional packet classification. While several efficient solutions are known for the one-dimensional IP lookup problem, the multi-dimensional packet classification has proved to be far more difficult. While an O(log w) time scheme is known for the IP lookup, Srinivisan et al. [V. Srinivasan, S. Suri, G. Varghese, Packet classification using tuple space search, in: Proceedings of SIGCOMM’99, 1999] show a lower bound of Ω( w k−1 ) for k-dimensional filter lookup, where w is the number of bits in a header field. In particular, this lower bound precludes the possibility of a binary search like scheme even for two-dimensional filters (say, IP source and destination pairs). In this paper, we examine this lower bound more closely, and discover that the lower bound depends crucially on conflicts in the filter database. We then show that for two-dimensional conflict-free filters, a binary search scheme does work! Our lookup scheme requires O(log 2 w) hashes in the worst case, and uses O( n log 2 w) memory. Alternatively, our algorithm can be viewed as making O(log w) calls to a prefix lookup scheme. It has been observed in practice that filter databases have very few conflicts, and these conflicts can be removed by adding additional filters (one per conflict). Thus, our scheme may also be quite practical. Our simulation and experimental results show that the proposed scheme also performs as good as or better than existing schemes. For example, on real firewall data sets with over 200 rules consisting of source and destination IP prefixes, our algorithm performs worst case 12 hashes. For filter sets containing arbitrarily many filtering rules with IP prefixes, the worst case search time guaranteed is utmost 25 hashes.