Measurement of highly active prefixes in BGP

We conduct a systematic study on the pervasiveness and persistency of one specific phenomenon in the global routing system: a small set of highly active prefixes accounts for a large number of routing updates. Our data analysis shows that this phenomenon is commonly observed from monitors in many different ISPs, and exists throughout our 3-year study period. The analysis further shows that the majority of these prefixes are highly active for only one or a few days, while a small number of them are persistently active over long period of time. Case studies demonstrate that the causes of these high routing activity include topological failures, BGP path exploration, protocol defects, and the failure of turning on protection mechanisms.

[1]  Daniel Massey,et al.  Observation and analysis of BGP behavior under stress , 2002, IMW '02.

[2]  Robert K. Cunningham,et al.  A taxonomy of computer worms , 2003, WORM '03.

[3]  Daniel Massey,et al.  Link-Rank: a graphical tool for capturing BGP routing dynamics , 2004, 2004 IEEE/IFIP Network Operations and Management Symposium (IEEE Cat. No.04CH37507).

[4]  Evi Nemeth,et al.  Internet expansion, refinement and churn , 2002, Eur. Trans. Telecommun..

[5]  Daniel Massey,et al.  Timer Interaction in Route Flap Damping , 2005, 25th IEEE International Conference on Distributed Computing Systems (ICDCS'05).

[6]  Matthew Roughan,et al.  BGP beacons , 2003, IMC '03.

[7]  Yougu Yuan,et al.  Global Routing Instabilities Triggered by Code Red II and Nimda Worm Attacks , 2001 .

[8]  Yin Zhang,et al.  BGP routing stability of popular destinations , 2002, IMW '02.