One of the major uses of a BGP table is conversion from IP addresses to ASes via best-matching prefixes for IPs and origin ASes for prefixes. It turns out, however, that a fraction of prefixes are originated by more than one AS and therefore do not lend themselvet to unique conversion. This stands in the way of comparing BGP AS graphs with skitter traceroute AS graphs and other analysis. In this section, we try to answer a simple question: why do these prefixes exist?

We call a prefix multiorigin if it has more than one origin. A cursory look at data confirms that multiorigins are normal mainstream prefixes, mostly from the üpper middle class" of prefix hierarchy. It seems fit that multiorigins, deemed worth announcing by more than one AS, are generally (even if slightly) more important than single origin prefixes en masse.

The number of multiorigins depends upon the selected set of peer tables. This is not surprising. The more peers we have, the higher is the chance of some disagreeing with the others about a prefix origin. This intuition is corroborated by peer count stats given below.

There are 1264 multiorigins in the all-peer data of Nov. 01, 2001, compared to 1152 in 39 backbone tables and 1123 in 26 full-size backbone tables. Most of them are global (1053 for 26 tables) or semiglobal (1078 for 26 tables, 85% of all-peer set) Semiglobal multiorigins are dominated by standalones (59%) and have larger fraction of roots (7.6%) and smaller fraction of more specifics (33.4%) than semiglobals in general (52% more specifics.)

The multiorigins' prefix length distribution deviates from the general profile in /16, which account for full 16% of multiorigins, as opposed to 7.7% in all semiglobals. The excess is likely to be caused by auto-summarization, i.e. aggregating subnets to /16 blocks announced at AS boundaries (even in cases when the /16 is not owned by the summarizing AS), which is the default configuration on some routers. It may therefore indicate a number of misconfigurations. Otherwise, the multiorigins prefix lengths distribution is close to that of all semiglobals, even though there are no /8-/12s, /15s are about twice as frequent (0.74%) and fractions of those in /17-/24 range are slightly lower than expected. It appears that collision in AS ownership resulting from aggregation (other than auto-summary) is not a major source of multiorigins.

Most multiorigins (96.2%) are double origins, even though one can find 8-origin prefixes in all-peer data, and 6-origin semiglobals in 26 tables. Many of these double origins are numerically close to a single origin in the sense that most peers see just one of two origins. In particular, for 26 full-size backbone tables of Nov. 01, 2001, half of the global multiorigins have less frequent origin present only in 1, 2 or 3 peer tables:

Same relation (less frequent origin seen by 1-3 peers for half of multiorigins) holds for 41 backbone tables of Oct. 01, 2001 with 1226 global multiorigins out of 1339 semiglobal ones. The bias in peer counts is not too strong though since another half of multiorigins is evenly spread across all peer counts. There may be in fact two different sources of multiorigins, one with a strong bias (perhaps pointing to an anomaly), and another with more equal peer split.

Two ASes announcing same origin are often related through the BGP AS graph so that one is an upstream of the other. In the partial order represented by AS graph, one AS is "less" than the other i.e. there is a unidirectional path between them (equivalently, one is in the cone of the other.) This in most cases translates into direct of indirect relation between a provider and customer. For example, double origins of Nov. 01, 2001 (26 tables) make up 583 AS pairs; for 177 (30%) of them, one is in the cone of the other. There are total of 71364 AS pairs for which one is an upstream of the other. Therefore, chances are 0.1% that in an AS pair chosen at random among N(N-1)/2= 74M pairs (N=12155), one AS is an upstream of another. This is 300 times less than observed (expectation for 583 would be less than one pair.) The 177 AS pairs are origins for 327 prefixes, which accounts for 30% of 1078 semiglobal multiorigins. That proves beyond any doubt that many multiorigins combine a customer who owns a block with an upstream originating it on behalf of a customer or customer's customer. (Having a static route in provider's table is one possible scenario.) The actual number of multiorigins of that type can be higher, but we do not expect it to be much higher because BGP AS graph is likely to capture the majority of upstream-downstream relations.

The fraction of multiorigins was relatively stable in the last few years (1250, or 1.9% in Nov. 1999 semiglobals, 1037, or 1.2% in Nov.2000) with a few spikes in between. Multiorigins also churned at a slower pace than semiglobals as a whole.

Among 89K prefixes present in Nov.2000, 26K, or 30% disappeared by Nov.2001. Out of 1037 multiorigins, only 161 (15.5%) disappeared, about half the disappearance rate for all semiglobals. Among surving 63K prefixes, 9939, or 16% changed origin(s) in one year. Multiorigins, however, had much higher origin change rate.

The following table counts multiorigins common among semiglobals in any two snapshots of Nov.1999, 2000, 2001 (upper triangle) and those with the same set of origins in both years (lower triangle.)

There is a 20-25% chance of a multiorigin remaining as such after one year and if so, about 2/3 chance to have the same set of origins. Some of multiorigins are quite persistent as they are present in all three 1999-2001 tables (110 of them) and have the same set of origins throughout (62 of those).

876 multiorigins of Nov.2000 survive till Nov.2001. Among them, 131, or 15% multiorigins have changed to a completely new single origin. This is comparable to the origin change rate for all semiglobals. Furthermore, 483 of those survived changed to a single origin which was among the origins of a year ago. We conclude that the majority of multiorigins remain in that state for less than a year, and that up to 1/2 of them resolve into one of the origins in the meantime. This conclusion is confirmed by analysis with finer time granularity.

We tracked origin changes for semiglobals in 711 2-hour snapshots from Oct. 01 - Nov. 31, 2001. It turned out that 6588 prefixes (4.8%) out of 137374 changed origin in 2 months time. 4220 of all prefixes were multiorigins at some point, and 3861 (91.5% of all) multiorigin prefixes changed origin or group of origins in two months.

Among prefixes that changed origin group one or more times in two months and at least one of the groups contained multiple origins, 2196 had only two different origin groups. In 2188 cases (99.6%) one of the groups was a single AS and another was a double origin including this AS.

Yet another 1479 prefixes have had three different orgin groups in 2 months and at least one of them was a multiple origin.Note.Among those, 1406 (95%) had only one multi-origin group. All those groups were double origins. In 1361 cases (92%) this group included both single origins which were otherwise present in the origin history for the prefix. 940 (69% of 1361) prefixes encountered double origin after one, but before another of two single origins, indicating that is might have been a transition from one origin to another captured by snapshot(s).

It should be noted that our data preserves only the order in which the origins appeared first time and they might have appeared more times over the whole 711 files covering these 2 months. Furthermore, some of the transitions can be artifacts of semiglobal prefix set evolution, whereby a number of peers carrying a prefix oscillates and some of the origins become invisible (see discussion of peer disparity above.) However, in that case we would expect three combinations of two single ASes and one double-AS group to be more evenly distributed, which is not the case; combinations A   A_B   B are two times more likely to appear than uniform distribution would predict, while there are only 167 triples (12.3% of 1361) in which double origin group appears first time before single origins, and 254 (18.7% of 1361) in which it appears first time after them.

We conclude that despite objections listed above, it is quite likely that the majority of multiorigin prefixes in any single snapshot of BGP table consists of ündecided" origins captured at the moment of convergence, i.e. transition between one origin and another.

For more information:

R.Mahajan. A study of BGP misconfigurations http://www.caida.org/outreach/isma/0112/ISMAagenda.xml#ratul

X.Zhao, D.Pei, L.Wang, D.Massey, A.Mankin, S.F.Wu, L.Zhang. An analysis of BGP multiple origin AS conflicts. Proceedings of the first ACM SIGCOMM measurement workshop. IMW 2001. San Francisco, Nov. 1-2, 2001. http://www.acm.org/sigcomm/measworkshop2001.htmlG

Footnotes:

Note that 2196+1479=3675 which is 95% of all prefixes which have ever been a multiorigin in these 2 months. Prefixes which had more than three origin groups are a small minority.A

File translated from T_EX by T_TH, version 2.92.
On 9 Jan 2002, 17:35.