Interdomain RoutingCorrectness and Stability.pptVIP

Interdomain RoutingCorrectness and Stability Nick Feamster Is correctness really that important? The Internet is increasingly becoming part of the mission-critical Infrastructure (a public utility!). Why does routing go wrong? Complex policies Competing / cooperating networks Each with only limited visibility Large scale Tens of thousands networks …each with hundreds of routers …each routing to hundreds of thousands of IP prefixes What can go wrong? Review: Simple operation… …but complex configuration! Which neighboring networks can send traffic Where traffic enters and leaves the network How routers within the network learn routes to external destinations Configuration Semantics What types of problems does configuration cause? Persistent oscillation (today’s reading) Forwarding loops Partitions “Blackholes” Route instability … These problems are real Several “Big” Problems a Week Why is routing hard to get right? Defining correctness is hard Interactions cause unintended consequences Each network independently configured Unintended policy interactions Operators make mistakes Configuration is difficult Complex policies, distributed configuration Correctness Specification Safety: No Persistent Oscillation Strawman: Global Policy Check Require each AS to publish its policies Detect and resolve conflicts Think Globally, Act Locally Key features of a good solution Safety: guaranteed convergence Expressiveness: allow diverse policies for each AS Autonomy: do not require revelation/coordination Backwards-compatibility: no changes to BGP Local restrictions on configuration semantics Ranking Filtering Main Idea of Today’s Paper Permit only two business arrangements Customer-provider Peering Constrain both filtering and ranking based on these arrangements to guarantee safety Surprising result: these arrangements correspond to today’s (common) behavior Relationship #1: Customer-Provider Filtering Routes from customer: to everyone Routes from provider: only to custo