Network Diagnostic and Discovery with Traceroute Prepared and presented by PhD candidate,Yihua He Roadmap Identifying the AS PATH • Which AS a packet goes through Review of how traceroute works Possible ways to do IP->AS Hands-on experience with BGP tables What can traceroute tell us besides reachability? Internet routes are not symmetric Autonomous System Forwarding Path Example: Pinpoint forwarding loop & responsible AS IP traffic Internet destination source Autonomous System (AS) Border Gateway Protocol (BGP) Signaling path: control traffic d: path=[A B C] d: path=[B C] d: path=[BC] d: path=[C] Forwarding path: data traffic Origin AS prefix d BGP path may differ from forwarding AS path • Routing loops and deflections • Route aggregation and filtering • BGP misconfiguration Traceroute: Measuring the Forwarding Path Time-To-Live field in IP packet header • Source sends a packet with a TTL of n • Each router along the path decrements the TTL • “TTL exceeded” sent when TTL reaches 0 Traceroute tool exploits this TTL behavior TTL=1 source TTL=2 Time exceeded destination Send packets with TTL=1, 2, 3, … and record source of “time exceeded” message Traceroute gives IP-level forwarding path Traceroute output: (hop number, IP address, DNS name) 1 169.229.62.1 inr-daedalus-0.CS.Berkeley.EDU 2 169.229.59.225 soda-cr-1-1-soda-br-6-2 3 128.32.255.169 vlan242.inr-202-doecev.Berkeley.EDU 4 128.32.0.249 gigE6-0-0.inr-666-doecev.Berkeley.EDU 5 128.32.0.66 qsv-juniper--ucb-gw.calren2.net 6 209.247.159.109 POS1-0.hsipaccess1.SanJose1.Level3.net 7 * ? 8 64.159.1.46 ? 9 209.247.9.170 pos8-0.hsa2.Atlanta2.Level3.net 10 66.185.138.33 pop2-atm-P0-2.atdn.net 11 * ? 12 66.185.136.17 pop1-atl-P4-0.atdn.net 13 64.236.16.52 www4.cnn.com Traceroute from Berkeley to www.cnn.com (64.236.16.52) Map Traceroute Hops to ASes Traceroute output: (hop number, IP) 1 169.229.62.1 AS25 2 169.229.59.225 AS25 Berkeley 3 128.32.255.169 AS25 4 128.32.0.249 AS25 5 128.32.0.66 AS11423 Calren 6 209.247.159.109 AS3356 7 * AS3356 8 64.159.1.46 AS3356 9 209.247.9.170 AS3356 10 66.185.138.33 AS1668 11 * AS1668 12 66.185.136.17 AS1668 13 64.236.16.52 AS5662 CNN Level3 AOL Need accurate IP-to-AS mappings (for network equipment). Possible Ways to Get IP-to-AS Mapping(1) DNS names: • Inaccurate, and in a lot of times, Wrong! Anyone, with $5/year, can register a www.whateveryoulike.com and point it to any IP address! • Some of the IPs do not have any DNS name. Routing address registry (WHOIS) • • • • • That’s what you did in Lab1 More accurate. However… Voluntary public registry such as whois.radb.net Prone to human input errors Incomplete and maybe out-of-date Mergers, acquisitions, delegation to customers Possible Ways to Get IP-to-AS Mapping (2) Origin AS in BGP paths • • • • Prefix=198.133.206.0/24, ASpath=[1239 2914 3130] Public BGP routing tables such as RouteViews Almost real time and avoiding most human input errors It’s approximately 98% accurate, Multiple Origin ASes (MOAS) • due to merge in a lot of cases • E.g., around 2002-2003, 148.231.0.0/16 had two ASes announced its address block: AS5677 and AS7132. That was PacBell and SBC • Now AS5677 does not exist anymore No mapping • Some ASes intentionally do not want to advertise the route/IPs • Incomplete view Hands-on Experience with BGP Routing Tables Telnet://route-views.routeviews.org • Show ip bgp summary Whose BGP feeds do the router take? • Show ip bgp Prefix Origin AS AS Path Collected at http://archive.routeviews.org/ Other BGP table collections are: • http://www.ripe.net/projects/ris/rawdata.html • http://www.cs.ucr.edu/bgp/ What can traceroute tell us? Where are those routers? • from DNS City name Airport name • From roundtrip time Light travels approximately 2*10^8 meters/sec in fiber cables When non-congested, the major delay is propagation delay If you see a host with roundtrip time of 10ms, you know it must be within 600 miles radius. Theoretically, with multiple vantage point, you can pinpoint where the routers are. Internet routes are not symmetric! Try traceroute from both ends And we’ll find most routes are not symmetric! Why? • Hot potato routing --- try to use other guys’ network as much as possible • Policy routing --- when multihomed Traceroute from other places http://www.traceroute.org • • • • Remote traceroute servers Hundreds of them Limited probe rate Not always available http://www.caida.org/tools/measurement/ skitter/ • Dedicated remote traceroute monitors • Almost unlimited probe rate • Only a couple of dozens of them Any questions?