Update-Driven Root Cause Analysis in Interdomain Routing

Interdomain routes change over time, and it is impressive to observe up to which extent. Routes, even the most stable, can change many times in the same day and sometimes in the same hour or minute. Such variations can be caused by several types of events, e.g., the change of the routing policies of an ISP, the reboot of a router, or the fault of a link. Some events are physiological to the network, while others are anomalous. In this paper we do a step towards the identifycation of the cause of route changes, a problem that is attracting increasing attention from both researchers and network administrators. Namely, we propose a methodology for analyzing a given BGP route change in order to, at least partially, identify and locate the event that triggered the change. Our data sources are the BGP updates collected by RIS and ORV projects. The methodology relies on a flow-based model of BGP updates. The cornerstones of the methodology are: data quality analysis that allows discarding unreliable data, analysis of the ranks of BGP peerings, and analysis of flows of prefixes. The methodology is supported by an on-line service.