Determining reputation of autonomous systems based on BGP traffic
This post is an abstract and a translation of the work that was done by former student and the original in Croatian can be found here. BGP protocol, its traffic and some of its configuration errors, will be analyzed. Also it will be explained why it is useful to have a reputation system that uses BGP to determine reputation of neighboring ASes.
Border gateway protocol (BGP) is a standardized exterior gateway protocol (EGP) designed to exchange routing and rechability information between autonomous systems (ASes) on the Internet. Protocol designed to exchange routing and rechability information inside one autonomous system (AS) is called interior gateway protocol (IGP). As opposed to IGP, BGP relies on a larger set of routing information called network layer rechability information (NLRI) which it stores inside its own master routing table called local routing information base (Loc-RIB) that differs from the main routing table of a router and refreshes accepting and advertising NLRI UPDATEs. However, the BGP protocol mostly selects a route following a political routing decisions (filtering among others) rather than just his routing algorithm when determining the best route through multiple ASes. Interior border gateway protocol (iBGP) is mostly used for information exchange inside AS and its goal is to create a unique routing table for all the BGP protocols on different routers and preserve unique routing politics of the AS. Exterior border gateway protocol (eBGP) is similar to iBGP but is mostly used for information exchange between AS while its goal is to preserve neighbor like relations with the routers of neighboring ASes using TCP protocol and incremental periodical messages. There are four types of messages used and those are OPEN, UPDATE, KEEPALIVE and NOTIFICATION.
Attribute "AS Path" is the most important attribute of the field "Path Attributes" in BGP format used in monitoring the BGP traffic. It gathers prefixes from all the AS through which the traffic passes, but its values can be changed by the AS depending on the routing policies of the ISP. For instance, an ISP can decide to route the traffic to his partners AS ignoring what the routing algorithm suggests.
BGP configuration errors cant be perceived by the people because they dont cause connection problems but they are nonetheless a big problem because they slow down convergence of the network (time required for the router tables to be adjusted in order to reflect actual changes in the network). Those problems can ultimately lead to the connection losses with large parts of the Internet if left ignored. Some of the problems among others are instability (caused by configuration errors), iBGP scalability, routing table growth (CIDR and aggregation) and others. Examples of BGP configuration errors are origin misconfiguration, export misconfiguration (changing attribute "AS Path") etc.
Because the BGP implicitly trusts ASes, monitoring of the BGP traffic needs to be done for errors and other malicious ways of exploiting BGP. It has no security mechanism whatsoever. The way it is recommended to be done is through a reputation system. The reputation system can measure the value of routing information that a neighboring AS offers to the main AS through monitoring of their BGP traffic and is described in the original work along with practical measures.
download file now