MAT Working Group

i have some small thoughts on add-path and BMP in RIPE/RIS.  this may
hinder more than help, unfortunately.

as a researcher, of course i would love a wider view into the AS graph
and the views of as many ASs as possible.  nom nom.  but ...

add-path, if not done very carefully, and documented in detail for each
peer, will produce views i will not understand.  it is analogous to not
knowing what view a BGP peer gives RIS today.  did it give me a full Nth
view into peer X?  is the path that of a peer, a customer, a provider?
and add-path is worse because it prunes in configuration and vendor-
dependent and otherwise unpredictable ways.

and, as an operator

if P is a RIS peer, and they give RIS BMP showing their input from their
peers, upstreams, and customers, those peers, upstreams, and customers
have not given thir consent to have their internals published!  if they
want to have RIS publish their internals, they would peer with RIS and
choose what view they present.

and, of course, the researcher does not know what view, peer, upstream,
or customer P's BMP peer is giving them.  same problem as above under
add-path.

randy

Dear Randy,

I'm glad you brought ADDPATH topic up! Up to 2019 I was running the now-defunct-Isolario project with my colleague Luca at IIT-CNR, and we did set up an ADDPATH-capable route collector.

First, my 2 cents on your operator consideration on the consent from original data sources. I'm far from being a legal, but I don't think ADDPATH differs much from collecting regular BGP sessions. After all, at the moment a BGP peer connected with RIS shares pieces of tables (sometimes close to a full table)... if it was sharing data with ADDPATH it would share all the pieces of the tables. I believe that the very same consideration/concern could apply on both case.

Here a few random considerations on our Isolario experience with ADDPATH. Sorry in advance for the long post!

  1.  Overall, we had about 25-30 peers in Isolario sharing data in ADDPATH. One major peer was sharing ~80 different full routing tables coming from different ASes and was particularly interesting for us. Most of the peers using ADDPATH were using Bird to share their data, and the configuration was trivial
  2.  The size of data collected - RIB snapshots in particular - was very large wrt regular collectors. I recall having RIB snapshots compressed in bz2 of ~1GB and 20MB in average of UPDATE files. It gets of uttermost importance to have high-perfomance MRT data readers to parse these data. Sometimes it is simply not possible to keep the number of peers low on each collector (see the 80 full routes from one single peer case). This is why we deployed - and presented at one of the RIPE meetings - bgpscanner with Lorenzo Cogotti back in time. As far as I know, Lorenzo improved bgpscanner furthermore developing Micro BGP suite (https://labs.ripe.net/author/lorenzo_cogotti/micro-bgp-suite-the-swiss-army-knife-of-routing-analysis/).
  3.  Data was often redundant, but never fully redundant. That was a reasonable price to pay to have more data.
  4.  ADDPATH hides to the collector the possibility to see the full routing table of the direct peer. You have all the tables that contribute in building the table, but you don't have the result of the BGP decision process of the peer. Depending on the kind of application and monitoring done, this could be a problem. In Isolario, we asked to set up a regular BGP session + an ADDPATH session from each peer that shared data with ADDPATH. Of course, this is not an ideal solution and there was nothing that could enforce the binding between the two sessions
  5.  Back in 2018, there were two separate way of interpreting ADDPATH - both compliant to RFCs. The first - implemented by Bird - consisted in keeping a single path ID for each table shared. Hence it was trivial to map the table to one single source and re-create the table from a reader perspective (e.g. 1.0.0.0/24 1 from table 1, 1.0.0.0/24 2 from table 2, 1.0.1.0/24 1 from table 1). The second - implemented by FRR - consisted in using many different path IDs for each table - still keeping the possibility to distinguish whether the same network was belonging to a different table (e.g. 1.0.0.0/24 1 from table 1, 1.0.0.0/24 2 from table 2, 1.0.1.0/24 3 from table 1). See https://github.com/FRRouting/frr/issues/1743. Of course, this latter approach was creating big headaches to us in matching tables, path IDs and "original peer"... hence in Isolario allowed only ADDPATH from Bird-like data sources.
  6.  If I recall well - and I may be wrong here - the only way to recognize that the BGP session between the BGP peer and one its peers/providers/customers went down was to search for a storm of withdrawn messages

I hope this may be helpful to anyone working around this topic!

Best Regards,

Alessandro Improta
Engineering manager
p. +393488077654
e. aimprota _at_ catchpoint _dot_ comaimprota _at_ catchpoint _dot_ com>
a. Via Oberdan 53, Pietrasanta (LU)
[cid:dc32a76e-0073-4695-9722-21fe3edb8e0a]
Learn more about Catchpoint $B"*(B Watch this 2-minute video!
[linkedin]             [twitter]               [facebook]                [youtube] 


________________________________
From: mat-wg <mat-wg-bounces _at_ ripe _dot_ net> on behalf of Randy Bush <randy _at_ psg _dot_ com>
Sent: Monday, January 23, 2023 1:23 PM
To: Measurement Analysis and Tools Working Group <mat-wg _at_ ripe _dot_ net>
Subject: [mat-wg] some thoughts on add-path and bmp at ripe/ris

i have some small thoughts on add-path and BMP in RIPE/RIS.  this may
hinder more than help, unfortunately.

as a researcher, of course i would love a wider view into the AS graph
and the views of as many ASs as possible.  nom nom.  but ...

add-path, if not done very carefully, and documented in detail for each
peer, will produce views i will not understand.  it is analogous to not
knowing what view a BGP peer gives RIS today.  did it give me a full Nth
view into peer X?  is the path that of a peer, a customer, a provider?
and add-path is worse because it prunes in configuration and vendor-
dependent and otherwise unpredictable ways.

and, as an operator

if P is a RIS peer, and they give RIS BMP showing their input from their
peers, upstreams, and customers, those peers, upstreams, and customers
have not given thir consent to have their internals published!  if they
want to have RIS publish their internals, they would peer with RIS and
choose what view they present.

and, of course, the researcher does not know what view, peer, upstream,
or customer P's BMP peer is giving them.  same problem as above under
add-path.

randy

--

To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.ripe.net%2Fmailman%2Flistinfo%2Fmat-wg&data=05%7C01%7Caimprota%40catchpoint.com%7C4a3f6f03586545bb0cb808dafd3cb095%7C0c927d7e38e74a3fa4f2e746ec8a0842%7C0%7C0%7C638100734353256868%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=NRPYomHv8cur3RN0%2B6P2y748SXw6E86fOUdojz%2BTNCM%3D&reserved=0

alessandro,

real data and experience deeply appreciated.  a few questions.

  o once a collector commits to ADD-PATH, it's a promise to keep
    the data forever; well, it's been 26 years of RV and a few
    less for RIS.

    - Did operators find the ADD-PATH data sufficiently useful
      to be worth the cost?  How did they use the ADD-PATH data
      and how often?

    - Did researchers find the ADD-PATH data sufficiently useful
      to be worth the cost?  How did they use the ADD-PATH data
      and how often?

    - Did folk develop special tools to take advantage of
      ADD-PATH data?

  o On the problem of stream/peer identification.  You describe
    the divergence of BIRD and FRR.  What about commercial
    router vendors?

  o You say data were often redundant, though not fully.  Did
    you investigate mechanisms to reduce the storage, or did you
    see that as a path to complexity and fragility merely to
    save some spinning rust?

  o You mention the withdraw storm between your peer and their
    peer (and later an announcment storm, I presume).  For peers
    with large out-degree, this could be likely.  Were these
    data interesting in any way, or just more storage?

again, thanks so much for real experience.  gives me a bit more
clue.

randy

Let's see...

>>  o once a collector commits to ADD-PATH, it's a promise to keep
>>    the data forever; well, it's been 26 years of RV and a few
>>    less for RIS.
>>    - Did operators find the ADD-PATH data sufficiently useful
>>      to be worth the cost?  How did they use the ADD-PATH data
>>      and how often?
>>    - Did researchers find the ADD-PATH data sufficiently useful
>>      to be worth the cost?  How did they use the ADD-PATH data
>>      and how often?
>>    - Did folk develop special tools to take advantage of
>>      ADD-PATH data?

This is hard to answer... I know for sure that a couple of research groups used Isolario data for their studies, in particular researchers at Max Planck Institute where studying ADD-PATH data we collected, but I'm not sure on the final outcome of their research. Also, data was used by Hurricane Electric for their bgp.he.net tool. Besides that, I am not aware of operators that used the data, but I never focused my attention on access logs back in the days.

>> o On the problem of stream/peer identification.  You describe
>>     the divergence of BIRD and FRR.  What about commercial
>>     router vendors?

This may be totally wrong, but I remember that Cisco was not allowing ADDPATH for eBGP. Not sure about other vendors though.

>>  o You say data were often redundant, though not fully.  Did
>>    you investigate mechanisms to reduce the storage, or did you
>>    see that as a path to complexity and fragility merely to
>>    save some spinning rust?

We did investigate that. Memory-wise, we studied methodologies to exploit compressing technique such as LZW (see Interactive Collector Engine (ripe.net)). However, the routing engine we devised for route collecting + the amount of RAM we had in the collectors were enough and never required us to turn that feature on. Disk-wise, we found out that xz was a great candidate to replace bz2 and gz as the next compressing methodology for route collecting. I don't remember the results to be honest, but that should be easy to reproduce. However, we decided to not compress data in xz because only bgpscanner was able to read xz data - hence anyone that wanted to use other tools such as bgpdump would not have been able to read them.

>>  o You mention the withdraw storm between your peer and their
>>    peer (and later an announcment storm, I presume).  For peers
>>    with large out-degree, this could be likely.  Were these
>>    data interesting in any way, or just more storage?

Yes, you presume correct. I honestly didn't find that really useful... A simple "Peer down" message would have been sufficient in those cases to replace the withdrawn storm, while the announcement storm caused by the RIB transfer of peers was inevitable.

>>  again, thanks so much for real experience.  gives me a bit more
>>  clue.

You're most welcome!

Best Regards,

Alessandro Improta
Engineering manager
p. +393488077654
e. aimprota _at_ catchpoint _dot_ comaimprota _at_ catchpoint _dot_ com>
a. Via Oberdan 53, Pietrasanta (LU)
[cid:64b79133-76ac-486c-8aea-c2984ec6f4ab]
Learn more about Catchpoint $B"*(B Watch this 2-minute video!
[linkedin]             [twitter]               [facebook]                [youtube] 


________________________________
From: Randy Bush <randy _at_ psg _dot_ com>
Sent: Friday, March 17, 2023 5:15 PM
To: Alessandro Improta <aimprota _at_ catchpoint _dot_ com>
Cc: Measurement Analysis and Tools Working Group <mat-wg _at_ ripe _dot_ net>
Subject: Re: [mat-wg] some thoughts on add-path and bmp at ripe/ris

alessandro,

real data and experience deeply appreciated.  a few questions.

  o once a collector commits to ADD-PATH, it's a promise to keep
    the data forever; well, it's been 26 years of RV and a few
    less for RIS.

    - Did operators find the ADD-PATH data sufficiently useful
      to be worth the cost?  How did they use the ADD-PATH data
      and how often?

    - Did researchers find the ADD-PATH data sufficiently useful
      to be worth the cost?  How did they use the ADD-PATH data
      and how often?

    - Did folk develop special tools to take advantage of
      ADD-PATH data?

  o On the problem of stream/peer identification.  You describe
    the divergence of BIRD and FRR.  What about commercial
    router vendors?

  o You say data were often redundant, though not fully.  Did
    you investigate mechanisms to reduce the storage, or did you
    see that as a path to complexity and fragility merely to
    save some spinning rust?

  o You mention the withdraw storm between your peer and their
    peer (and later an announcment storm, I presume).  For peers
    with large out-degree, this could be likely.  Were these
    data interesting in any way, or just more storage?

again, thanks so much for real experience.  gives me a bit more
clue.

randy