Topology Inference from BGP Routing Dynamics
Authors:	D. G. Andersen N. Feamster S. Bauer H. Balakrishnan
Published:	Proc. of ACM SIGCOMM Internet Measurement Workshop , Marseille, France, 2002
URL:	http://www.sds.lcs.mit.edu/papers/clustering-imw2002.html http://citeseer.nj.nec.com/andersen02topology.html
Entry Date:	2003-01-22
Abstract:	This paper describes a method of inferring logical relationships between network prefixes within an Autonomous System (AS) using only passive monitoring of BGP messages. By clustering these prefixes based upon similarities between their update times, we create a hierarchy linking the prefixes within the larger AS. We can frequently identify groups of prefixes routed to the same ISP Point of Presence (PoP), despite the lack of identifying information in the BGP messages. Similarly, we observe disparate prefixes under common organizational control, or with long shared network paths. In addition to discovering interesting network characteristics, our passive method facilitates topology discovery by potentially reducing the number of active probes required in traditional traceroute-based Internet mapping mechanisms.
Datasets:	BGP announcements were collected from a router which peered with MIT's border router. Data was collected from June 28, 2001. MIT obtains upstream connectivity from Genuity (AS 1) and the Northeast Exchange (via AS 10578). On April 18, 2002, a private link between MIT and AT&T Broadband (AS 7015) was established. Clustering (see Results below) was performed on prefixes announced by UUNET (AS 701) and AT&T (AS 7018). A static routing table snapshot was taken at MIT on April 11, 2000. This table was used to perform further selection of prefixes from the above set.
Results:	Presents a fully passive, BGP-based topology inference method. Prefixes are grouped based upon how frequently BGP updates for each pair of prefixes are observed within the same time window. A standard clustering algorithm is then applied to join these prefixes into successively larger groups. The authors claim that their temporal clustering produces higher-fidelity topologies than other passive, BGP-based approaches. An example of a drawback of other approaches is that many large ISPs announce a large number of prefixes under the same AS path.
References:	"Skitter," http://www.caida.org/tools/measurement/skitter/, 2002. Ramesh Govindan and Hongsuda Tangmunarunkit, "Heuristics for Internet Map Discovery," in IEEE INFOCOM 2000. IEEE, Mar. 2000, pp. 1371-1380. Balachander Krishnamurthy and Jia Wang, "On network-aware clustering of web clients," in Proc. ACM SIGCOMM, 2000. Neil Spring, Ratul Mahajan, and David Wetherall, "Measuring ISP Topologies with Rocketfuel," in Proc. ACM SIGCOMM, Aug. 2002.