Re: [GROW] A new bgpdump tool

John Kemp <kemp@network-services.uoregon.edu> Fri, 06 March 2015 18:29 UTC

Return-Path: <kemp@network-services.uoregon.edu>
X-Original-To: grow@ietfa.amsl.com
Delivered-To: grow@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 596B41A1B2D for <grow@ietfa.amsl.com>; Fri, 6 Mar 2015 10:29:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Level:
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cOptWJwBfTMt for <grow@ietfa.amsl.com>; Fri, 6 Mar 2015 10:29:16 -0800 (PST)
Received: from network-services.uoregon.edu (uowireless.uoregon.edu [IPv6:2001:468:d01:3c::80df:3c5e]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 585151A1AA6 for <grow@ietf.org>; Fri, 6 Mar 2015 10:29:16 -0800 (PST)
Received: from rvpro.routeviews.org (rvpro.routeviews.org [128.223.51.52]) (authenticated bits=0) by network-services.uoregon.edu (8.13.8/8.13.8) with ESMTP id t26ITCSG013971 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Fri, 6 Mar 2015 10:29:15 -0800
Message-ID: <54F9F1F8.5020700@network-services.uoregon.edu>
Date: Fri, 06 Mar 2015 10:29:12 -0800
From: John Kemp <kemp@network-services.uoregon.edu>
Organization: RouteViews, University of Oregon
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:31.0) Gecko/20100101 Thunderbird/31.5.0
MIME-Version: 1.0
To: "Sriram, Kotikalapudi" <kotikalapudi.sriram@nist.gov>, Yasuhiro Ohara <yasu@nttv6.jp>
References: <20150305.101734.501639731449288981.yasu@nttv6.jp> <54F8ACFA.1040503@network-services.uoregon.edu>, <20150306.142705.1611674823609985976.yasu@nttv6.jp> <1425655141369.1718@nist.gov>
In-Reply-To: <1425655141369.1718@nist.gov>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/grow/3xZkAAfDDpHMVpb1mOqdWMS66VM>
Cc: "grow@ietf.org" <grow@ietf.org>
Subject: Re: [GROW] A new bgpdump tool
X-BeenThere: grow@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: kemp@network-services.uoregon.edu
List-Id: Grow Working Group Mailing List <grow.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/grow>, <mailto:grow-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/grow/>
List-Post: <mailto:grow@ietf.org>
List-Help: <mailto:grow-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/grow>, <mailto:grow-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 06 Mar 2015 18:29:22 -0000

Yasuhiro,

We are sort of at two ends of the spectrum here.
If we are just talking about a simple tool, I guess the
point I was making was that somehow you probably want to
consider that there is a time domain.

For example, if your tool is parsing out ribs.  If it
could also read those back in, and then do "comm" kinds
of comparisons, then you could compare two ribs from different
times.  IE what is common, what is in both, what is only in
1 vs. 2, or 2 vs. 1.

Or a kind of regexp feature might be nice.  You probably
want ASPATH regexp to add to the prefix matching, as well
as next-longest/next-shortest matching....

/jgk

On 3/6/15 7:19 AM, Sriram, Kotikalapudi wrote:
>> Yes, I'm interested in route leaks. Now I'm wondering what kind of
>> functions are beneficial in a BGP dump tool to help people check or
>> find the route leaks. Please let me know if you have some idea.
> 
> Some additional references related to determining AS relations, routing policies, 
> and route leak detection/mitigation:
> 
> "Valley-free violation in Internet routing - Analysis based on BGP Community data"
> http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=6363987&url=http%3A%2F%2Fieeexplore.ieee.org%2Fxpls%2Fabs_all.jsp%3Farnumber%3D6363987 
> 
> "AS Relationships, Customer Cones, and Validation"
> http://www.caida.org/~amogh/papers/asrank-IMC13.pdf 
> 
> "A Survey of Interdomain Routing Policies"
> https://www.cs.bu.edu/~goldbe/papers/survey.pdf
> 
> "Methods for Detection and Mitigation of BGP Route Leaks"
> https://tools.ietf.org/html/draft-sriram-route-leak-detection-mitigation-00
> (to be presented in the IDR WG meeting in Dallas)
> 
> Sriram
> 
> 
>