A comparative study on IP prefixes and their origin ases in BGP and the IRR

Abstract

The IRR is a set of globally distributed databases with which ASes can register their routing and address-related information. It is often believed that the quality of the IRR data is not reliable since there are few economic incentives for ASes to register and update their routing information in a timely manner. To validate these negative beliefs, we carry out a comprehensive analysis of (IP prefix, its origin AS) pairs in BGP against the corresponding information registered with the IRR, and vice versa. Considering the IRR and BGP practices, we propose a methodology to match the (IP prefix, origin AS) pairs between those two datasets. We observe that the practice of registering IP prefixes and origin ASes with the IRR is prevalent, though the quality of the IRR data varies substantially depending on routing registries, regional Internet registries (to which ASes belong), and AS types. The IRR can help improve the security level of BGP routing by making BGP routers selectively rely on the corresponding IRR data considering these observations.

AS-level topology collection through looking glass servers

“…We observe 686 unique ASes from LG servers while IRL has only 181 unique ASes. There are around 6.2 K unique ASes in the IRR; mostly from RIPE and APNIC regions suggesting the popularity of the IRR usage in these regions [17]. We do not find any unique ASes in Ark, which suggests their accurate use of the BGP traces since Ark relies on BGP traces from RouteViews to convert IP-to-AS paths collected from traceroute measurements.…”

“…On further investigation, we find that these ASes were not operational in BGP in the month of We check the RIR wise distribution of these 686 new ASes found from the LG servers, and find that 548 ASes are operational in ARIN, 71 in RIPE, 31 in APNIC, 28 in LACNIC, and 8 in AfriNIC. Most of the ASes are from the ARIN region, possibly due to the lower popularity of the IRR registration practice in that region, compared with the RIPE and APNIC ones [17]. We also check the length of IP prefixes announced by the new 686 ASes to find that 90% of the ASes announce IP prefixes of length between /19 and /24, which suggests that these IP prefixes are possibly aggregated by their provider ASes.…”

“…Second, traceroute-based datasets suffer from limited vantage points, selectively probing prefixes, IPto-AS mapping issues [15,16], and can not discover backup links [20]. Finally, many of the ASes, except in the RIPE region, do not actively use the IRR to register their routing policy related information [17,36]. Thus, topology collection from LG servers result in discovering otherwise unobserved part of the Internet as LG servers provide new BGP feeders from geographically diverse locations in the Internet.…”

“…Request permissions from permissions@acm.org. There have been three main approaches to construct the AS topology, each of which has its own limitations: (i) passive measurements by collecting BGP routing tables and updates [18] suffer from routing policy filters and best path selection decisions made by the neighboring ASes of BGP collectors [22], (ii) active measurements using traceroute [14,19] are error-prone and generate potentially false AS links due to non-responsive hosts or errors in converting IP addresses to AS numbers (IP-to-AS mapping) [15,16], and (iii) Internet routing registry (IRR) [21] is known to have incomplete and/or outdated information and possibly biased towards RIPE region [6,17].…”

A Primer on IPv4 Scarcity

“…The various IRR databases are managed by several independent organizations, including ISPs, RIRs and others [51]. However, not all address space is registered in some registry (only around 50% according to [87]) and information in these registries is known to be significantly inaccurate [52]. Many IRRs allow their participants to introduce essentially any route object without further validation [88].…”