No abstract

Network-wide migrations of a running network, such as the replacement of a routing protocol or the modification of its configuration, can improve the performance, scalability, manageability, and security of the entire network. However, such migrations are an important source of concerns for network operators as the reconfiguration campaign can lead to long and service-affecting outages.In this paper, we propose a methodology which addresses the problem of seamlessly modifying the configuration of commonly used link-state Interior Gateway Protocols (IGP). We illustrate the benefits of our methodology by considering several migration scenarios, including the addition or the removal of routing hierarchy in an existing IGP and the replacement of one IGP with another. We prove that a strict operational ordering can guarantee that the migration will not create IP transit service outages. Although finding a safe ordering is NP-complete, we describe techniques which efficiently find such an ordering and evaluate them using both real-world and inferred ISP topologies. Finally, we describe the implementation of a provisioning system which automatically performs the migration by pushing the configurations on the routers in the appropriate order, while monitoring the entire migration process.

No abstract

Understanding data plane health is essential to improving Internet reliability and usability. For instance, detecting disruptions in peer and provider networks can identify repairable connectivity problems. Currently this task is time consuming as it involves a fair amount of manual observation, as an operator has poor visibility beyond their network's border. In this paper we leverage existing public RIPE Atlas measurement data to monitor and analyze network conditions; creating no new measurements. We demonstrate a set of complementary methods to detect network disruptions using traceroute measurements, and to report problems in near real time. A novel method of detecting changes in delay is used to identify congested links, and a packet forwarding model is employed to predict traffic paths and to identify faulty routers and links in cases of packet loss. In addition, aggregating results from each method allows us to easily monitor a network and correlate related reports of significant network disruptions, reducing uninteresting alarms. Our contributions consist of a statistical approach to providing robust estimation of Internet delays and the study of hundreds of thousands link delays. We present three cases demonstrating that the proposed methods detect real disruptions and provide valuable insights, as well as surprising findings, on the location and impact of the identified events. arXiv:1605.04784v2 [cs.NI] 15 May 2017 (4,307 IPv6 probes) connected within the eight studied months.As our study relies solely on traceroute results the scope and terminology of this paper are constrained to the IP layer. That is, a link refers to a pair of IP addresses rather than a physical cable.Consequently, the proposed methods suffer from common limitations faced by traceroute data [29,40,28]. Traceroute visibility is limited to the IP space, hence, changes at lower layers that are not visible at the IP layer can be misinterpreted. For example, the RIPE Atlas data reports MPLS information if routers support RFC4950. But for routers not supporting RFC4950, the reconfiguration of an MPLS tunnel is not visible with traceroutes while being likely to impact observed delays. The RTT values reported by traceroute include both network delays and routers' slow path delay [28]. Therefore, the delay changes found using traceroute data are not to be taken as actual delay increases experienced by TCP/UDP traffic, though they are good for detecting network damage. CHALLENGES AND RELATED WORKMonitoring network performance with traceroute raises three key challenges. In this section, we present these challenges, discuss how they were tackled in previous (a) Round-trip to router B (blue) and C (red).(b) Difference of the two round-trips (∆ P BC ).

The Border Gateway Protocol (BGP) coordinates the connectivity and reachability among Autonomous Systems, providing efficient operation of the global Internet. Historically, BGP anomalies have disrupted network connections on a global scale, i.e., detecting them is of great importance. Today, Machine Learning (ML) methods have improved BGP anomaly detection using volume and path features of BGP's update messages, which are often noisy and bursty. In this work, we identified different graph features to detect BGP anomalies, which are arguably more robust than traditional features. We evaluate such features through an extensive comparison of different ML algorithms, i.e., Naive Bayes classifier (NB), Decision Trees (DT), Random Forests (RF), Support Vector Machines (SVM), and Multi-Layer Perceptron (MLP), to specifically detect BGP path leaks. We show that SVM offers a good trade-off between precision and recall. Finally, we provide insights into the graph features' characteristics during the anomalous and non-anomalous interval and provide an interpretation of the ML classifier results.