1

Wheel + Ring = Reel: the Impact of RouteFiltering on the Stability of Policy Routing

Luca Cittadini Giuseppe Di Battista Massimo Rimondini Stefano VissicchioDept. of Computer Science and Automation, Roma Tre University{ratm,gdb,rimondin,vissicch}@dia.uniroma3.it

Abstract—BGP allows providers to express complex routingpolicies preserving high degrees of autonomy. However, unre-stricted routing policies can adversely impact routing stability.A key concept to understand the interplay between autonomyand expressiveness on one side, and stability on the other side, issafety under filtering, i.e., guaranteed stability under autonomoususage of route filters. BGP route filters are used to selectivelyadvertise specific routes to specific neighbors.

In this paper, we provide a characterization of safety underfiltering, filling the large gap between previously known neces-sary and sufficient conditions. Our characterization is based onthe absence of a particular kind of dispute wheel, a structureinvolving circular dependencies among routing preferences. Weexploit our result to show that networks admitting multiple stablestates are provably unsafe under filtering, and the troublesomeportion of the configuration can be pinpointed starting fromthe stable states alone. This is especially interesting from anoperational point of view, since networks with multiple stablestates actually happen in practice (BGP wedgies). Finally, weshow that adding filters to an existing configuration may lead tooscillations even if the configuration is safe under any link failure.Unexpectedly, we find policy configurations where misconfiguredfilters can do more harm than network faults.

Index Terms—Routing, BGP, Stability, Safety under filtering,Dispute reel, Characterization.

I. INTRODUCTION AND RELATED WORK

Network operators can control interdomain routing at afine grained level by relying on the policy-based BorderGateway Protocol (BGP) [2]. BGP provides AutonomousSystems (ASes) with the autonomy to set routing policiesindependent of each other, and with the expressiveness tospecify extremely complex configurations. However, auton-omy and expressiveness come at the expense of guaranteedconvergence. In particular, a BGP configuration could neverreach a stable routing, either because a stable state for thatconfiguration does not exist at all, or because the protocol gets“trapped” into bad event timings. This is highly undesirable,since it has been observed that interdomain routing changescan cause performance degradation and packet loss [3], andcontinuously changing routing can severely affect the avail-ability of services [4]. The need to avoid such disadvantageshas spurred significant research efforts on BGP stability.

Varadhan et al. [5] showed that autonomy in configuringrouting policies can lead to persistent routing oscillations, and

This work is partially supported by the Italian Ministry of Research(MIUR), FIRB project “Advanced tracking system in intermodal freighttransportation” – Grant number RBIP06BZW8, and PRIN project AlgoDEEPno. 2008TFBWL4. A preliminary version of this paper appeared in [1].

ip as-path access-list 1 deny _31337_

ip as-path access-list 1 permit .*route-map fooFilter permit 10

match as-path 1

← route filtering

ip as-path access-list 2 permit _1$

route-map fooRank permit 10

match as-path 2

set local-preference 120

route-map fooRank permit 20

! other paths have default pref.

← route ranking

Fig. 1. Sample fragment of a quite common router configuration highlightingthe separation between the filtering and ranking components of routingpolicies. In this configuration, the filtering component is such as to acceptall the BGP announcements but those that traversed AS 31337. The rankingcomponent applies a higher preference to BGP announcements that have beenoriginated by AS 1.

proposed constraints to be applied to routing policies in orderto achieve safety, i.e., stability under any timings of routingevents. A number of fundamental contributions on this topicare due to Griffin et al. [6], [7], [8], [9]. Among the results theypresented, those works showed how the dynamic behavior ofBGP can be related to characteristics of the BGP configurationthat can be statically analyzed. In particular, in [9] it is shownthat the absence of a dispute wheel (DW), a cyclic pattern ofrouting preferences, is sufficient to guarantee safety.

The “no DW” condition is a cornerstone in the literature onBGP stability. As an example, Gao et al. [10], [11] used theabsence of DWs to prove that, if routing policies are specifiedconsistently with the commercial relationships between ASes(see, e.g., [12], [13]), then safety is guaranteed.

The stability of path vector protocols has also been studiedusing algebraic approaches in [14], [15], [16], [17]. Theseworks described convergence conditions that are based onproperties of path rankings, and showed that the no DWcondition finds a counterpart also in algebraic models. Inparticular, in [16] the authors proposed a relaxation of theguidelines presented in [10].

In [18] Chau took into account the general case in whichnon-strict path rankings can be expressed. Even in this case,the absence of DWs is fundamental to guarantee safety.

Feamster et al. [19], [20] explored the impact of autonomyand expressiveness on the stability of the BGP protocol. Inthose papers the roles of the ranking and filtering componentsof routing policies are clearly distinguished. Ranking allowsan AS to specify preferences over multiple candidate routes

2

to the same destination, while filtering allows an AS toselectively advertise specific routes to specific neighbors. Tofurther confirm their distinction, the ranking and filteringcomponents of routing policies are often specified in routerconfigurations by using separate statements. Fig. 1 showsa sample fragment of such a configuration. About rankingand filtering, a crucial question is posed in [20]: “providedthat each AS retains complete autonomy and complete fil-tering expressiveness, how expressive can rankings be whileguaranteeing stable routing?”. This question is formalized bythe concept of safety under filtering. A configuration is safeunder filtering if it is safe under any combination of routefilters. Therefore, on one hand studying safety under filteringis important to answer the above question. On the other hand,achieving safety under filtering guarantees that configurationchanges cannot adversely impact the operation of a network.Hence, devising conditions that allow to determine whether anetwork is safe under filtering is relevant to attain both goals.A necessary condition for safety under filtering is the absenceof a particular subclass of DWs, called dispute rings [20].

In this paper, we make three main contributions. First, weshow a necessary and sufficient condition for safety underfiltering, filling the large gap between previously knownnecessary and sufficient conditions. While there have beena number of results in this research field, to the best ofour knowledge this is the first tight characterization of astability problem in policy routing (e.g., BGP). In particular,we characterize safety of a policy-based routing configurationunder realistic assumptions about the autonomy of ASes. Ourresult is based on the presence of a structure called disputereel (DR), which is both a special case of a DW and ageneralization of a dispute ring. Dispute reels inherit fromDWs the interesting property of depending on routing policiesalone. Hence, checking for the presence of a DR does notrequire to delve into the details of the BGP protocol dynamics.

Second, we show that, in a network admitting multiplestable routing states, safety under filtering is provably compro-mised. Indeed, it has been shown in [21] that the existenceof a unique stable state is a necessary condition for safety.Besides independently asserting the necessity of this conditionbased on the presence of dispute reels in the network, wetake this result one step further. Namely, we show a simpletechnique that, taking multiple stable states as input, pinpointsthe portions of the BGP configuration which define a DR(thus making the configuration not safe under filtering). Froma practical point of view this implies that the existence ofthe so-called BGP wedgies [22] is a sufficient condition formaking a network unsafe under filtering.

Third, we show that robustness does not necessarily im-ply safety under filtering. Robustness is the property of aconfiguration to be safe under any combination of link/nodefailures [9]. It is known that safety under filtering impliesrobustness [20]. We explore the relationship between thosetwo properties by showing that the opposite does not hold.In a sense, this proves that the autonomy of adding (possiblymisconfigured) filters can do more harm than network faults.

The popularity of DWs in the literature on the stabilityof policy-based protocols is mostly due to the fact that the

“no DW” condition implies the existence of a unique stablerouting state [9], safety [9], robustness [9], and safety underfiltering [20]. As a side effect of our work, we show that DRscan replace DWs, giving rise to less constraining sufficientconditions for all those properties.

The paper is organized as follows. Section II introducesSPP, which is a commonly adopted model to study BGPstability. Section III defines the concept of dispute reel.Sections IV and V respectively present the necessary andsufficient conditions of our characterization of safety underfiltering. In Section VI we discuss the relationship betweensafety under filtering and robustness. Conclusions are drawnin Section VII.

II. A MODEL FOR POLICY-BASED PATH VECTORROUTING PROTOCOLS

In this section we describe the formalism of the Stable PathsProblem (SPP), a model that is widely used [7], [11], [9] tostudy BGP stability and that we adopt throughout the paper.

In the SPP model the topology of an interdomain routingsystem is modeled as a graph. Let G = (V,E) be a simpleundirected graph with vertex set V = {0, 1, . . . , n} and edgeset E. A path P in G is either the empty path, denoted byε, or a sequence of k + 1 vertices P = (vk vk−1 . . . v0),vi ∈ V such that (vi, vi−1) ∈ E for 0 < i ≤ k. Whenit is clear from the context, we will treat sequences as sets,e.g., we will use v ∈ P to denote that v appears in path P .Vertex vk−1 is the next hop of vk in P . If k = 0 then (v0)is a path consisting of a single vertex v0. The concatenationof two nonempty paths P = (vk vk−1 . . . vi), k ≥ i, andQ = (vi vi−1 . . . v0), i ≥ 0, denoted as PQ, is the path(vk vk−1 . . . vi vi−1 . . . v0). Since the empty path representsunreachability, it can never be extended, that is, Pε = εP = ε.

In SPP every vertex attempts to establish a path to vertex 0,relying on the paths used by its neighbors. Each vertex v ∈ Vis assigned a set of permitted paths Pv . All these paths startfrom v and end in 0 and represent the paths that v can use toreach 0. Sets Pv account for the possibility of each vertex toarbitrarily filter paths. Let P0 = {(0)} and let P =

⋃v∈V Pv .

For each vertex v ∈ V , a ranking function λv : Pv → Ndetermines the relative level of preference λv(P ) assigned byv to path P . If P1, P2 ∈ Pv and λv(P2) < λv(P1), then P2

is preferred over P1. Let Λ = {λv|v ∈ V }.For each v ∈ V −{0}, the following conditions are assumed

to hold on the paths:i) ε ∈ Pv;

ii) ∀P ∈ Pv with P 6= ε: λv(ε) > λv(P );iii) ∀P1, P2 ∈ Pv, P1 6= P2 : λv(P1) = λv(P2) ⇒ P1 =

(v u)P ′1, P2 = (v u)P ′2, i.e., v has the same next hop inP1 and in P2; and

iv) ∀P ∈ Pv: P is simple (i.e., has no repeated vertices).Since the empty path represents unreachability of 0, Condi-tion i states that all vertices but 0 may be unable to reachthe destination. Unreachability is the last chance for a vertex(Condition ii). Condition iii states that function λv induces atotal order on all the paths of Pv but those that begin withthe same pair of vertices. Such paths reach 0 via the same

3

10

120 210

201 2

0

0 1 2π1 (0) (1 0) (2 1 0)π2 (0) (1 2 0) (2 0)

Fig. 2. Instance DISAGREE (on the left) admits two distinct stable states π1and π2 (on the right). Each row of the table represents a state. Each columnspecifies the path selected by every vertex in this state.

neighbor of v, and can therefore be considered equivalent.Condition iv accounts for acyclic routing.

An instance of SPP is a triple S = (G,P,Λ), whereG = (V,E) is a simple undirected graph, P is the setof permitted paths, and Λ is the set of ranking functions.Fig. 2 shows an instance of SPP, called DISAGREE [9]. Thegraphical convention we use in this figure will be adoptedthroughout the paper. Namely, each vertex v is equipped witha list of paths representing Pv sorted by increasing values ofλv . The empty path and P0 are omitted for brevity.

An instance of SPP provides a good abstraction of aninterdomain routing system. In fact, vertices can be mappedto Autonomous Systems, edges can be interpreted as peeringsessions, and permitted paths, together with the rankings, canrepresent routing policies.

The dynamic behavior of BGP is modeled by a distributedasynchronous algorithm known as Simple Path Vector Proto-col (SPVP) [8], [7] and shown in Fig. 3. In order to establisha path to 0, in the SPVP algorithm vertices exchange mes-sages containing permitted paths. It is assumed that messageexchanges are reliable and edges introduce an arbitrary finitedelay. Communication between vertices takes place in a totallyasynchronous way.

To describe the SPVP algorithm in Fig. 3 we need a fewmore definitions. Let neighbors(v) be the set of neighbors ofv. Two data structures are used at each vertex v to representthe information v is aware of at time t: the path ribt(v) thatis used to reach 0 and a table rib-int(v ⇐ u) that stores thelatest path received from u ∈ neighbors(v). Thus, vertex vcan select a path to 0 among the choices available in

choicest(v) = {(v u)P ∈ Pv | P = rib-int(v ⇐ u)}Let W be a subset of the permitted paths Pv at vertex v,

such that each path in W has a distinct next hop. Then thebest path at v in W is

best(W, v) =

{P ∈W |P = arg min λv(P ) (W 6= �)

ε (W = �)

and the overall best path v is aware of at time t is bestt(v) =best(choicest(v), v).

In SPVP each vertex executes an instance of the algorithmin Fig. 3. When a vertex v receives a path P from one of itsneighbors u, it stores P in the local data structure rib-int(v ⇐u) and recomputes its best path. If the computed best path Qdiffers from the previously selected path, u sends a messagecontaining P to all of its neighbors.

We say that an instance S of SPP is consistent if, forany u ∈ V and P ∈ Pu, we have that P = (u v)P ′ andP ′ ∈ Pv . We stress that the presence of a path violating this

process spvp(v)

1: while receive P from u do2: rib-int(v ⇐ u) := P3: ribt(v) := bestt(v)4: if ribt(v) 6= bestt−1(v) then5: for all v ∈ neighbors(v) do6: send ribt(v) to v7: end for8: end if9: end while

Fig. 3. A distributed asynchronous algorithm (SPVP) for modeling thedynamic behavior of BGP.

condition cannot affect the behavior of the SPVP algorithm onS. Therefore, without loss of generality we assume throughoutthe paper that all SPP instances are consistent.

A path assignment is a function π that maps each vertexv ∈ V to a path π(v) ∈ Pv . We have that π(0) = (0) and, ifπ(v) = ε, then v cannot reach vertex 0. In the following, wewill refer to π as the state of the SPP instance. Observe that,at any time t, the algorithm in Fig. 3 defines a path assignmentπt where πt(v) = ribt(v) and each vertex always selects thebest available path.

We say that an edge (u, v) is activated at time t fromu to v if v executes the algorithm in Fig. 3 to process thelatest message received from u. The order in which protocolmessages are exchanged needs not to be total, i.e., at agiven instant more than one message can be processed. Thisorder is represented using activation sequences. An activationsequence σ is a (possibly infinite) sequence of sets σ =(A0 A1 . . . Ai . . . ) in which each set At contains the edgesthat are activated at time t. Each edge in At is consideredoriented according to the direction of the activation. Givenan SPP instance S, we say that an activation sequence σ onS leads to path assignment πt2 starting from path assignmentπt1 , denoted by πt1

σ πt2 , if, after activating edges according

to σ, S changes its state from πt1 to πt2 .We say that an activation sequence is fair [9] if, whenever

vertex u sends a message at time t (Step 6 of SPVP), thereexists a time t′ > t at which the message is delivered andprocessed by its recipient. This means that edge (u, v) iseventually activated when u sends a message to v.

Observe that there exist variants of the SPVP algorithm(e.g., considered in [23], [8], [10], [20]) where only someclasses of activation sequences are allowed. For the sake ofcompleteness, we base our study on the original version ofthe algorithm, in which edges are activated independently andsimultaneous activations are allowed. It has been shown [24]that any relaxed version of this model is only able to capturea strictly smaller set of routing oscillations.

A state πt of an SPP instance is a stable state if ∀v ∈ V :πt(v) = bestt(v). This means that every vertex has settledto the best available path and will never change its selection.For example, two stable states for DISAGREE are describedin Fig. 2.

There are SPP instances that do not have any stable states.Indeed, deciding whether an SPP instance admits a stable

4

210

20

320

30

130

10

2 3

0

1

Fig. 4. BAD-GADGET, an SPP instance described in [6] that does not haveany stable states.

t At 1 2 31 {(0, 1), (0, 2), (0, 3)} (1 0 ) (2 0 ) (3 0 )

2 {(3, 1), (1, 2)} (1 3 0 )(1 0)

(2 1 0 )(2 0)

(3 0 )

3 {(1, 2)} (1 3 0 )(1 0)

(2 0 ) (3 0 )

4 {(2, 3)} (1 3 0 )(1 0)

(2 0 )(3 2 0 )(3 0)

5 {(3, 1)} (1 0 ) (2 0 )(3 2 0 )(3 0)

6 {(1, 2)} (1 0 )(2 1 0 )(2 0)

(3 2 0 )(3 0)

7 {(2, 3)} (1 0 )(2 1 0 )(2 0)

(3 0 )

8 {(3, 1)} (1 3 0 )(1 0)

(2 1 0 )(2 0)

(3 0 )

TABLE IAN INFINITE FAIR ACTIVATION SEQUENCE FOR BAD-GADGET (FIG. 4).

path assignment is NP-complete [9]. An example of instancewith no stable states is BAD-GADGET [6] in Fig. 4. Thereis no fair activation sequence that, starting from an arbitrarystate, leads BAD-GADGET to a stable state. Intuitively, thisdepends on the fact that all vertices prefer their clockwiseneighbor instead of the direct path to 0, leading to a cycleof preferences. An infinite fair activation sequence on BAD-GADGET is described in Tab. I in a tabular notation: each rowcorresponds to an activation, the first column represents time,the second one specifies activated edges, and the remainingcolumns represent the current rib-int at each vertex, with thecurrently selected best path highlighted using italic face. Theinitial state is assumed to be π0(v) = ε ∀v ∈ V − {0}. Aftervertices 1 and 2 have succeeded in choosing their preferredpath at t = 2, edges (1, 2), (2, 3), and (3, 1) can be activatedin turn in counter-clockwise order to obtain an infinite fairactivation sequence.

Even if a stable state exists, routing protocols can still gettrapped [6], [9] into persistent oscillations. An SPP instance Sis safe if any fair activation sequence on S eventually leads toa stable state. Determining whether an SPP instance is safe isreferred to as the safety problem. For example, DISAGREE isnot safe, since there exists an infinite fair activation sequence,detailed in Tab. II, never leading to a stable state.

We can now formally define the concept of safety underfiltering, already discussed in the Introduction.

Definition 2.1: An SPP instance S = (G,P,Λ) is safeunder filtering (SUF) if, for any P ′ ⊆ P , the instance

t At 1 21 {(0, 1), (0, 2)} (1 0 ) (2 0 )

2 {(1, 2), (2, 1)} (1 2 0 )(1 0)

(2 1 0 )(2 0)

3 {(1, 2), (2, 1)} (1 0 ) (2 0 )

TABLE IIAN INFINITE FAIR ACTIVATION SEQUENCE FOR DISAGREE (FIG. 2).

(G,P ′,Λ) is safe.Observe that the notion of “under filtering” is conveyed by thesubsets P ′: the definition states that the instance must remainsafe under any combination of filters applied on the paths.

III. WHEEL + RING = REEL

It is shown in [20] that safety under filtering can be studiedby analyzing structural properties of the policy configuration,without the need to deal with the details of dynamic evalu-ation. The main known structural properties that are relatedto safety under filtering are based on the absence of cyclicdependencies among routing preferences, which are calleddispute wheels and dispute rings.

A dispute wheel (DW) [9] Π = (~U , ~Q, ~R) is a tripleconsisting of a sequence of nodes ~U = (u0 u1 . . . uk−1) andtwo sequences of nonempty paths ~Q = (Q0 Q1 . . . Qk−1) and~R = (R0 R1 . . . Rk−1) such that for each i = 0, . . . , k − 1we have:

i) Ri is a path from ui to ui+1

ii) Qi ∈ Pui

iii) RiQi+1 ∈ Pui

iv) λui(RiQi+1) ≤ λui(Qi).We call vertices ui pivot vertices, paths Qi spoke paths,

and paths Ri rim paths. Throughout the paper, we intendsubscripts of vertices and paths in a dispute wheel to beinterpreted modulo k where k = |~U|.

The elements that constitute a dispute wheel are graphicallydepicted in Fig. 5(a). Observe that the DISAGREE instancein Fig. 2 is a simple example of dispute wheel, with pivotvertices ~U = (1 2), spoke paths ~Q = ((1 0) (2 0)), andrim paths ~R = ((1 2) (2 1)). In general, dispute wheelsoccurring in SPP instances can be much more complex, sincespoke and rim paths can arbitrarily cross each other. Fig. 5(b)shows a sketch of a complex dispute wheel where there areintersections between spoke paths Q0 and Q1, spoke path Q1

and rim path R0, and rim paths R0 and R1.The absence of a dispute wheel has been proved [9], [20]

to be a sufficient condition for safety under filtering. On theother hand, Feamster et al. show in [20] that the absence ofa particular class of dispute wheels, called dispute rings, isa necessary condition for safety under filtering. A disputering is defined in [20] as a dispute wheel having at leastthree pivot vertices, and such that each vertex appears onlyonce in the wheel. Fig. 5(a) can be considered as an abstractrepresentation of a dispute ring. Fig. 6(a) shows how the“no dispute wheel” and “no dispute ring” conditions relateto the properties of an SPP instance. We stress that there is alarge gap between the two conditions (gray zones with thick

5

has a

statestable

no dispute ring

safeSUFno DW

(a) The absence of a dispute ring (wheel) is a necessary(sufficient) condition for safety under filtering [20].There is a large gap between SUF and these twoconditions (gray zones with thick border).

has a

statestablesafeNO DR ≡ SUF

(b) The absence of a dispute reel is a necessary andsufficient condition for safety under filtering.

Fig. 6. Fundamental relationships between classes of SPP instances before (a) and after (b) our contribution.

u0

Q0: spokepath fromu0 to 0

R0: rim pathfrom u0 to u1

R1: rim pathfrom u1 to u2

u2

u1

pivotvertex0

(a)

u0

Q0

R1

u2

u1

Q1

0

R0

(b)

Fig. 5. Structure of a dispute wheel (a). In real SPP instances, disputewheels may likely exhibit complex intersections among paths. In (b), spokepaths Q0 and Q1 share a vertex, and rim path R0 intersects with rim pathR1 and spoke path Q1.

border in the figure), as the absence of a dispute ring doesnot guarantee safety, and does not even imply that the SPPinstance admits a stable path assignment.

We now define a dispute reel as a special case of disputewheel. Intuitively, a reel is a dispute wheel such that the spokepaths form a tree T and each rim path Ri contains no vertex inT except ui and ui+1. In other words, out of all the crossingsrepresented in Fig. 5(b), only those between rim paths (R0

and R1 in the figure) are allowed in a dispute reel. Indeed,a dispute reel looks much like the wheel in Fig. 5(a), exceptthat it can contain arbitrary intersections between rim paths.

In order to formally define the dispute reel, we use thenotation P [v] to denote the subpath of P starting at vertex v,that is, P = (u . . . v)P [v]. This implies P [0] = (0) for anyP .

Definition 3.1: A dispute reel (DR) is a dispute wheelwhich satisfies the following conditions:

i) (Pivot vertices appear in exactly three paths) – for eachui ∈ ~U , ui only appears in paths Qi, Ri and Ri−1.

ii) (Spoke and rim paths do not intersect) – for each u 6∈ ~U ,if u ∈ Qi for some i, then no j exists such that u ∈ Rj .

iii) (Spoke paths form a tree) – for each distinct Qi, Qj ∈ ~Q,if v ∈ Qi ∩Qj , then Qi[v] = Qj [v].

We stress that the existence of a DR does not depend atall on the protocol dynamics, i.e., it is a structural propertyof the policy configuration that can be statically checked. It

20

210

2130

30

320

3210

10

130

1320

0

31

2

Fig. 7. An SPP instance, showed in [20], which is safe under filtering butcontains DWs. However, none of these DWs is a DR.

is easy to verify that DISAGREE (Fig. 2) is an example of aDR. Conversely, the instance in Fig. 7, first used in [20] toshow that the presence of a DW does not prevent an instancefrom being safe under filtering, does not contain any DRs. Asan example, a DW Π exists in Fig. 7 where pivot vertices are~U = (1 2 3), spoke paths are ~Q = ((1 0) (2 0) (3 0)), andrim paths are ~R = ((1 3 2) (2 1 3) (3 2 1)). However, pivotvertex 1 appears in all rim paths, thus violating Condition iof Definition 3.1. On the other hand, the instance in Fig. 7also contains the DW Π′ where pivot vertices are u0 = 1 andu1 = 2, spoke paths are Q0 = (1 3 0) and Q1 = (2 0), andrim paths are R0 = (1 3 2) and R1 = (2 1). Π′ too is not aDR because Condition ii is not satisfied, as vertex 3 appearsboth in Q0 and in R0. Similar arguments can be applied tothe other DWs in the instance in Fig. 7.

In the remainder of this section we introduce some conceptsand formal definitions that will be extensively used in theproofs in Sections IV and V.

Definition 3.2: A dispute duo is a dispute reel such that|~U| = 2 and R0 ∩R1 = {u0, u1}.

Instance DISAGREE in Fig. 2 is an example of dispute duo.The simple structure of DRs allows us to identify two

classes of activation sequences leading to two “natural” classesof path assignments. Given an SPP instance S containing aDW Π, the supporting instance S[Π] of Π is the minimalSPP instance which contains vertices, edges, and paths of Π.Intuitively, S[Π] can be obtained from S by filtering all pathsbut those used in the DW. Observe that, if Π is a DR, thenin S[Π] pivot vertices have exactly two permitted paths, andvertices along the spoke paths (except pivots) have exactlyone permitted path.

Let S be an SPP instance containing a DR Π and let S[Π] bethe supporting instance of Π. The all-spoke path assignment(see Fig. 8(a)) is a path assignment π such that π(u) = Qi[u]if u ∈ Qi, π(u) = ε otherwise. Since spoke paths form a tree,

6

0

u1u0

vkv0

w1

v1

wj w0

(a)

0

u1u0

vkv0

w1

v1

wj w0

(b)

0

u1u0

vk

w1

v1

wj w0

v0

(c)

0

u1u0

vk

w1

v1

wj w0

v0

(d)

0

u1u0

vkv0

w1

v1

wj w0

(e)

Fig. 9. Five snapshots of the oscillation of a dispute duo constructed in the proof of Lemma 4.1.

Qi+1

Qi

ui

ui+1

Q0

u0R0

Q1

u1

Ri

(a) All-spoke path assignment π.

Qi+1

Qi

ui

ui+1

Q0

u0R0

Q1

u1

Ri

(b) One-rim path assignment πi.

Fig. 8. Two special path assignments of a dispute reel. The selected pathsare highlighted using solid stroke. Note that in πi, ui is the only vertex inQi which is not selecting a subpath of Qi.

by activating the edges of each spoke path Qi in reverse order(starting from 0) it is easy to construct an activation sequenceσspoke leading to an all-spoke path assignment.

Similarly, we define the one-rim path assignment for pivotui (see Fig. 8(b)) as a path assignment πi such that:

πi(u) =

Qj [u] if u ∈ Qj , u 6= ui,∀jRi[u]Qi+1 if u ∈ Riε otherwise.

In order to build an activation sequence that leads to πi,we can extend σspoke by activating the edges of Ri in reverseorder (starting from ui+1). This is always possible becauserim paths never intersect spoke paths and, for each non-pivotvertex v along Ri, π(v) = ε.

IV. SAFETY UNDER FILTERING IMPLIES NO DR

In this section we show that the absence of DRs is anecessary condition for safety under filtering. We do this byshowing that the presence of a DR in an SPP instance Smakes S not safe under filtering. The proof consists of threeparts. First, we show that if S contains a dispute duo, thenS is not SUF (Lemma 4.1). Second, we generalize this resultby stating that if S contains a DR consisting of two pivotvertices, then S is not SUF (Lemma 4.2). Last, we show thatif an instance S contains a DR Π, then an oscillation canalways be constructed, either by cycling through one-rim pathassignments on Π (Lemma 4.3), or by exploiting a differentDR consisting of two pivot vertices (Lemma 4.4). Thus, S isnot safe under filtering.

A. Dispute Reels with 2 Pivots

We start by showing that the presence of a dispute reelhaving 2 pivot vertices makes an SPP instance not safe underfiltering. First, we generalize the routing oscillation showedin Tab. II for DISAGREE to the broader class of dispute duos.

Lemma 4.1: An SPP instance that contains a dispute duois not safe under filtering.

Proof: Let S be an SPP instance containing a dispute duoΠ = (~U , ~Q, ~R) and consider S[Π]. We now construct a fairactivation sequence that induces an oscillation on S[Π]. Fig. 9depicts the most relevant path assignments in the activationsequence we build on S[Π]. The main idea is that vertices u0and u1 can simultaneously select paths π(u0) = R0Q1 andπ(u1) = R1Q0. Path assignment π is clearly not stable, sothe two pivot vertices will eventually fall back on their spokepaths Q0 and Q1. By iterating this argument, we are able toshow an infinite fair activation sequence.

First of all, since Π is a DR, we can construct on S[Π] anactivation sequence that leads to the all-spoke path assignmentπt1 at some time t1. The resulting path assignment is shownin Fig. 9(a). We now propagate the announcement of pathQ1 (respectively, Q0) by activating the edges along R0 (R1)in reverse order. Since R0 and R1 have no shared verticesother than u0 and u1, the two announcements cannot interferewith each other. We halt one hop before the announcementof Q1 (Q0) reaches u0 (u1), obtaining the path assignmentrepresented in Fig. 9(b). Formally, let R0 = (v0 v1 . . . vk),where v0 = u0 and vk = u1. We activate edges in R0 inreverse order until we hit v1, that is,

σR0 = ({(vk, vk−1)} {(vk−1, vk−2)} . . . {(v2, v1)}).Symmetrically, let R1 = (w0 w1 . . . wj), and consider thesequence

σR1 = ({(wj , wj−1)} {(wj−1, wj−2)} . . . {(w2, w1)}).We activate edges according to σR0 , and then according toσR1

. Then, we simultaneously activate edges (v1, v0) and(w1, w0). Observe that the simultaneous activation of edges(v1, v0) and (w1, w0) makes path R0Q1 available at u0, andpath R1Q0 available at u1. It is easy to check that theseactivations lead to a path assignment πt2 (see Fig. 9(c)) suchthat, for i ∈ {0, 1}:

πt2(u) =

{Qi[u] if u ∈ Qi, u 6= ui

Ri[u]Qi+1 if u ∈ Ri

7

10

1XYZ20 XY10

XYZ20

2ZXY10

20

ZXY10

Z20Y10

YZ20

0

1 X 2Y Z

Fig. 10. An SPP instance containing a DR consisting of two pivot vertices(1 and 2) and whose rim paths intersect at vertices X , Y , and Z.

We now activate edges in R0 (R1) in reverse order, againhalting at v1 (w1), thus reaching the path assignment depictedin Fig. 9(d), and then we simultaneously activate edges(v1, v0) and (w1, w0). By doing so, vertex u0 (u1) withdrawsthe availability of path Q0 (Q1). Since R0 and R1 do not havevertices in common other than u0 and u1, the withdrawal willeventually reach vertex u1 (u0). Vertex u1 (u0) will then fallback on path Q1 (Q0). Observe that we have now reached anall-spoke path assignment πt3 , which implies πt3(u) = πt1(u)for every vertex u, as shown in Fig. 9(e). Since we can iteratethis argument, it is clear that there exists an infinite activationsequence. Moreover, no announcement is delayed indefinitely,i.e., the activation sequence is also fair on S[Π]. The proof iscompleted by noting that S[Π] can be obtained by S throughpath filtering, hence we conclude that S is not SUF.

Lemma 4.1 can be generalized, as DRs having two pivotvertices always imply the existence of a dispute duo. As anexample, consider the instance in Fig. 10. Clearly, this instancecontains a DR having u0 = 1 and u1 = 2 as pivot vertices,Q0 = (1 0) and Q1 = (2 0) as spoke paths, and R0 =(1 X Y Z 2) and R1 = (2 Z X Y 1) as rim paths. Noticethat both rim paths traverse vertices X , Y , and Z. We nowsearch for a dispute duo. Walk along R1 and stop at the lastvertex which is in R1 ∩ R0, that is, Y . By analyzing λY , itis easy to see that there exists another DR having Y and 2 aspivot vertices, (Y 1 0) and (2 0) as spoke paths, and (Y Z 2)and (2 Z X Y ) as rim paths. Note that the rim paths of thisDR do not intersect at vertex X . We now repeat the process onthe new DR, considering vertex Z. It is easy to see that thereexists a dispute duo having Z and Y as pivot vertices. Thefollowing lemma generalizes the approach we just showed toany DR having two pivot vertices.

Lemma 4.2: An SPP instance that contains a dispute reelhaving exactly 2 pivot vertices is not safe under filtering.

Proof: Let S be an SPP instance containing a disputereel Π = (~U , ~Q, ~R), with |~U| = 2. First, we show that thepresence of Π implies that S contains a dispute duo Π′, thenwe use Lemma 4.1 to argue that S is not SUF.

If R0 and R1 do not share any vertices except u0 and u1,then Π is a dispute duo and the statement directly followsfrom Lemma 4.1. Otherwise, we show that either there is adispute duo involving u0 as one of the pivots, or it is possibleto construct another dispute reel with 2 pivot vertices andstrictly less intersections between rim paths than in Π. In thelatter case, we can iteratively apply the same arguments untilwe find a dispute duo.

Let {v1, . . . vk} be the vertices in R0 ∩ R1 − {u0, u1},in the same order as they appear in R0. That is, R0 =(u0 . . . v1 . . . vk . . . u1), where ∀i vi ∈ R1. Let vj ∈

u1

0

P

A

Q

Q0 Q1

R

vi vj vku0

Fig. 11. A dispute reel having 2 pivot vertices. Rim paths R0 = RQ andR1 = AP are split as explained in the proof of Lemma 4.2. Different pathsare represented using different strokes. In particular, spoke paths Q0 and Q1

are in thicker stroke.

{v1, . . . , vk} be the vertex of R1 that is “farthest away” fromu1, and let P = R1[vj ]. More formally, vj is such that vi 6∈ P∀i 6= j. We now show that either there exists a dispute duo Π′

having u0 and vj as pivot vertices, or there exists a DR Π′′

consisting of two pivot vertices vj and u1 and having strictlyless intersections between its rim paths than Π.

Refer to Fig. 11. Split R1 and R0 such that R1 = A(vj)Pand R0 = R(vj)Q.

Since we are considering S[Π] and vj ∈ R0 ∩ R1,Pvj = {PQ0, QQ1}. Depending on the ranking at vertexvj and since (by construction) we cannot have λvj (PQ0) =λvj (QQ1), we have two possible cases.

i) λvj (PQ0) < λvj (QQ1). We now show that Π′ =((u0 vj), (Q0 QQ1), (R P )) is a dispute duo. By con-struction, Π′ has only two pivot vertices, and P ∩ R ={u0, vj}. Observe that u0 appears only in Q0, R andP , while vj appears only in QQ1, R, and P . Therefore,Condition i of Definition 3.1 is satisfied. Condition iiis also satisfied, since Q0 ∩ R = Q0 ∩ P = {u0} andQ1∩R = Q1∩P = � are guaranteed by the fact that Π isa DR. Moreover, by construction, Q∩R = Q∩P = {vj}.Finally, Condition iii holds for paths Q0 and Q1 since Πis a DR, and Q ∩Q0 = �.

ii) λvj (PQ0) > λvj (QQ1). We now show that Π′′ =((vj u1), (PQ0 Q1), (Q A)) is a dispute reel. Sincevj 6= u0 by construction, Π′′ has strictly less intersectionsbetween rim paths than Π. Observe that vj appears onlyin PQ0, Q, and A, while u1 appears only in Q1, Q,and A. Hence, Condition i of Definition 3.1 is satisfied.Condition ii is also satisfied, since Q0∩Q = Q0∩A = �and Q1 ∩ Q = Q1 ∩ A = {u1} are guaranteed by thefact that Π is a dispute reel. By construction, P ∩ Q =P ∩A = {vj}. Finally, Condition iii holds for paths Q0

and Q1 since Π is a DR, and P ∩Q1 = �.

Hence, in the first case we find a dispute duo Π′. In the secondcase, we find another dispute reel Π′′ having two pivot verticesand having strictly less intersections between rim paths thanΠ. By iterating this argument, we eventually end up finding adispute duo. We then use the result from Lemma 4.1 to provethat an instance containing a DR with two pivot vertices isnot safe under filtering.

8

10

1XYWZ20 2ZWXY30

20

XY30

XYWZ20

YWZ20

Y30 WZ20

WXY30

Z20

ZWXY30

30

3101 2

X Y W Z

3

Fig. 12. A DR which is not rim-by-rim. Vertex 0 is omitted for brevity.

B. Dispute Reels with more than 2 Pivots

The next step is to show that the presence of a dispute reelhaving more than two pivot vertices makes an SPP instancenot safe under filtering. We prove that in two parts. First, weintroduce the concept of a “rim-by-rim” dispute reel, that is,a DR for which it is easy to construct a routing oscillation.Second, we show that the presence of a dispute reel which isnot rim-by-rim implies the existence of a dispute reel havingonly two pivot vertices.

Given a DR Π = (~U , ~Q, ~R), with |~U| = k > 2, we saythat Π is rim-by-rim if ∀i ∈ {0, . . . , k − 1} there exists anactivation sequence σi on S[Π] such that πi σi πi+1. Thatis, starting from the one-rim path assignment for any pivotui, σi leads to the one-rim path assignment for pivot ui+1

(see Fig. 8(b)). The following property is a straightforwardconsequence of the definition of rim-by-rim DR.

Property 4.1: σi activates all the edges in Ri+1 at leastonce.Observe that the well known instance BAD-GADGET, depictedin Fig. 4, is a trivial rim-by-rim DR. More generally, anydispute ring can be viewed as a special case of rim-by-rimDR. Feamster et al. show in [20] that it is particularly easyto find an oscillation on a dispute ring. We are now able togeneralize that result to the broader class of rim-by-rim DRs.

Lemma 4.3: An SPP instance containing a rim-by-rim dis-pute reel is not safe under filtering.

Proof: Let S be an SPP instance containing a rim-by-rim dispute reel Π. Using the fact that Π is rim-by-rim, webuild an infinite fair activation sequence in the supportinginstance S[Π] that cycles indefinitely among one-rim path as-signments. The activation sequence is based on the convenientpropagation of announcements from one pivot vertex to itspredecessor.

As we have already seen, since Π is a dispute reel thereexists an activation sequence on S[Π] that induces a one-rimpath assignment πi for an arbitrary pivot ui.

Since Π is rim-by-rim, there exist activation sequencesσj such that πi σi πi+1 σi+1

· · · σi−1 πi. Note that the

initial and final path assignments are the same, thus wecan iterate the same set of activations in order to create aninfinite activation sequence σ on S[Π]. By Property 4.1, edgestraversed by rim paths are activated at least once per iteration.To ensure fairness, at the end of each iteration we activateedges according to σspoke (as defined in Section III) withoutaltering the current path assignment. This implies that thereexists an infinite fair activation sequence on S[Π], hence S isnot safe under filtering.

Now consider the instance in Fig. 12. Clearly, this instancecontains a DR Π where pivot vertices are u0 = 1, u1 = 2,and u2 = 3; spoke paths are Q0 = (1 0), Q1 = (2 0), and

R0

R1

Q0

Q2

Q1

u0 vj

u2

0

vi vk−1 vk = u1

Fig. 13. A portion of a dispute reel which is not rim-by-rim, used in theproof of Lemma 4.4. Different paths are represented using different strokes.Spoke paths Q0, Q1, and Q2 are in thicker stroke.

Q2 = (3 0); and rim paths are R0 = (1 X Y W Z 2),R1 = (2 Z W X Y 3), and R2 = (3 1). Π is not rim-by-rim: in particular, no activation sequence exists that, startingfrom the one-rim path assignment for pivot u0 = 1 (π0),makes path R1Q2 available at vertex 2. In fact, assume thatthe instance is in state π0, that is, vertices 2 and 3 selecttheir spoke paths, while vertices on R0 select a subpath ofR0Q1. In particular, vertex 1 selects path (1 X Y W Z 2 0).We now explore how far the announcement of path (3 0)can be propagated along rim path R1. Suppose that vertex 3announces path (3 0) to Y . Since path (Y 3 0) is preferred,Y selects the new path and propagates the announcement toX . Observe that, even if X does not prefer path (X Y 3 0),Y ’s announcement withdraws the availability of the previouslyselected path (X Y W Z 2 0). Hence, X propagates theannouncement further to W . Now, W does not change itschoice, since path (W X Y 3 0) is less preferred. It is easyto see that there is no way to propagate the announcementfurther than vertex W . Nevertheless, the rankings at vertexW are such that there exists a DR having W and 2 as pivotvertices. The following lemma shows that the presence of aDR having two pivot vertices is actually a general property ofany DR which is not rim-by-rim. By using Lemma 4.2, weare then able to show an oscillation even on DRs that are notrim-by-rim.

Lemma 4.4: An SPP instance containing a dispute reelwhich is not rim-by-rim is not safe under filtering.

Proof: Let S be an SPP instance containing a disputereel Π = (~U , ~Q, ~R) which is not rim-by-rim. If |~U| = 2, thestatement follows from Lemma 4.2. Otherwise, consider S[Π].Since Π is not rim-by-rim by hypothesis, there are at least πi

and πi+1 such that @σ : πiσ πi+1. Assume, without loss of

generality, that i = 0. Now, this means that it is impossible topass from a one-rim path assignment to another. Intuitively,this happens because the announcements traveling along therim paths of Π get stuck at some intermediate vertex betweenpivots. In the rest of the proof we show that, in this case, itis possible to find a dispute reel with two pivot vertices. ByLemma 4.2, this proves that S is not safe under filtering.

Let {v1, . . . vk} be the vertices of R0 ∩ R1, in the sameorder as they appear in R0, that is, R0 = (u0 . . . v1 . . . vk),where vk = u1, as shown in Fig. 13.

First of all, we show that the announcement of path Q2 getsstuck before reaching u1. Let Σ be the set of all the activationsequences that, starting from the one-rim path assignment π0,make path Q2 available in the set of choices of some vertex

9

vm. More formally, ∀σ ∈ Σ, π0 σ πt, where R1[vm]Q2 ∈

choicest(vm) for some m and t. Note that Σ contains at leastthe activation sequence obtained by activating the edges ofR1 in reverse order. Such activation sequence would lead toR1[vj ]Q2 ∈ choicest(vj), where vj is the common vertex thatis “farthest away” from u1 in R1, that is, ∀i 6= j, vi 6∈ R1[vj ].Consider the activation sequence σ′ ∈ Σ such that vm has thehighest index. We now show that, if the announcement of pathQ2 reaches vertex u1, then we have a contradiction. In fact,if vm = u1, we would have π0 σ′

πt, where πt(u1) = R1Q2.This enables us to activate the edges in R0 in reverse order,withdrawing the availability of path Q1 on all the verticesalong R0, and eventually reaching state π1. This contradictsthe hypothesis that @σ : π0 σ

π1.Hence, vm 6= u1. We now prove that, if the announcement

of path Q2 cannot be propagated further than vm, then wehave a dispute reel having two pivot vertices. Consider thepath ranking at vertex vm. We have two possible cases:

i) λvm(R1[vm]Q2) ≤ λvm(R0[vm]Q1). We now show thatthere exists an activation sequence σ ∈ Σ that makes pathQ2 available in the set of choices of vm′ , with m′ > m,hence a contradiction. Intuitively, vm can announce pathR1[vm]Q2 to withdraw the availability of path R0[vm]Q1

to the vertices on R0. This allows the announcement ofpath Q2 to be propagated beyond vertex vm. Observethat, since path R1[vm]Q2 is in choicest(vm) and it ispreferred, we must have πt(vm) = R1[vm]Q2 after acti-vation sequence σ′. Let σ1 consist of the activations of allthe edges in R0 in reverse order, starting from vm. Let πt1be the path assignment after σ1, that is, πt

σ1 πt1 . Notethat πt1 is such that path R0[vh]Q1 has been withdrawnat each vh, h < m. We now construct σ2 by activatingthe edges along R1 in reverse order. In this way, vmpropagates the announcement of path R1[vm]Q2. Clearly,if a vertex vh, h < m, receives the announcement, itwill select path R1[vh]Q2, since the set of choices atvh is currently empty. Hence, the announcement will bepropagated further. This implies that the message willeventually reach vertex vm′ , m′ > m.

ii) λvm(R1[vm]Q2) > λvm(R0[vm]Q1). We now show thatthere exists a dispute reel having vm and u1 as pivotvertices. Let R be the subpath of R1 from u1 to vm,that is, R1 = RR1[vm]. Now consider the dispute wheelΠ′ = ((vm u1), (R1[vm]Q2 Q1), (R0[vm] R)). We nowshow that Π′ is a DR. Being Π a DR, Condition i ofDefinition 3.1 holds since vm 6∈ Q1 and u1 6∈ R1[vm]Q2.Condition ii is trivially satisfied by vertices on paths Q1

and Q2, because both are spoke paths in Π. By definition,R ∩ R1[vm] = {vm}. Moreover, R1[vm] ∩ R0[vm] ={vm}, since, by definition of vm, vj 6∈ R1[vm] if j >m, and vj 6∈ R0[vm] if j < m. Again, being Π a DR,Condition iii holds for paths Q1 and Q2, and we haveR1[vm] ∩Q1 = �.

We then conclude that if Π is not rim-by-rim, then it con-tains a dispute reel having two pivot vertices. By Lemma 4.2,instance S is not safe under filtering.

By combining Lemmas 4.2, 4.3, and 4.4, we can state the

following theorem.Theorem 4.1: An SPP instance containing a dispute reel is

not safe under filtering.

C. Multiple Solutions and Safety Under Filtering

We now exploit Theorem 4.1 to show that networks ad-mitting multiple stable states are not safe under filtering.Since multiple stable states happen in practice (see, e.g.,BGP wedgies [22]), this is especially interesting from anoperational perspective. We highlight that uniqueness of thestable state has already been proved to be a necessary con-dition for safety [21]. Besides independently asserting thenecessity of this condition for safety under filtering based onthe presence of dispute reels in the SPP instance, we provide away for network operators to pinpoint the portions of the BGPconfiguration that are responsible for the potential instability.

Theorem 4.2: If an SPP instance S admits two stable states,then S is not safe under filtering.

Proof: Theorem V.4 in [9] proves that S must containa dispute wheel Π. Π is derived by merging two stable pathassignments π1 and π2. Let T1 and T2 be the routing treesinduced by π1 and π2, and let T = T1 ∩ T2. Each spoke pathin Π is composed by a path along T plus a final edge whichdoes not connect two vertices in T . Hence, spoke paths forma tree (Condition iii of Definition 3.1). Rim paths are built upby vertices which are not in the intersection of π1 and π2, thusCondition ii is also satisfied. Each pivot vertex ui can onlyappear in Qi, Ri, and Ri−1 (Condition i), since the disputewheel is built using only π1(ui) and π2(ui). Therefore, Π isa dispute reel. By Theorem 4.1, the presence of a dispute reelin S is enough to conclude that S is not SUF.

An important consequence of Theorem 4.2 is that observingmultiple different stable routing states in a network indi-cates that its stability may be definitively compromised bythe application of route filters. Therefore, the existence ofmultiple stable states in a network constitutes an importantalert to consider for a network operator, because it impliesthe existence of a dispute reel. Observe that, even if a disputereel might require a specific ordering of routing messages totrigger a routing oscillation, the conflicting routing policiesidentified by the dispute reel might as well create transientrouting problems that are very hard to prevent and debug.

As a final remark, we stress that the construction presentedin Theorem V.4 of [9] can be exploited to identify a portionof the network which can potentially lead to oscillationsunder filtering. Moreover, given a pair of stable routing states,implementing that construction is straightforward and canbe done efficiently without any knowledge of the routingpolicies. We here summarize a possible procedure. Considerthe intersection T of the routing trees T1 and T2 correspondingto the two stable states. As shown in the proof of Theorem 4.2,every vertex not in T but having a direct link to a vertex inT is a pivot vertex of at least one dispute reel. Therefore, tofully identify a dispute reel, we need to arbitrarily choose apivot vertex u0 as a starting point. Without loss of generality,we assume that u0 is in T1. Since u0 is not in T , the path thatu0 selects in T2 must lead to another pivot vertex (say u1)

10

which is not in T but has a direct link to a vertex in T : wepick the portion of this path that connects u0 to u1 as the rimpath of u0, and the portion of the same path that connectsu1 to 0 as the spoke path of u1. We then consider u1 anditeratively apply the same procedure, until we get back to u0.

Network operators can use this technique to disclose apolicy dispute among the pivot vertices in the routing config-uration. Our results prove that the presence of such a policydispute makes the network not SUF.

Observe that it is not necessary to enumerate (i.e., observe)all the stable states that could potentially exist in the network:it is sufficient to collect two of them. This could be done, e.g.,by deploying route collectors such as those employed by theRIPE NCC’s RIS project [25].

V. NO DR IMPLIES SAFETY UNDER FILTERING

We now show that the absence of a dispute reel is asufficient condition for safety under filtering. Combined withthe result from the previous section, we can conclude that thepresence of a DR is a necessary and sufficient condition forunsafety under filtering. We prove the sufficient condition byshowing that if an SPP instance is not SUF, then it containsa DR. First, we use the same technique as in [9] to showthat a routing oscillation implies the existence of a particularkind of dispute wheel, which satisfies a slightly different setof conditions than those in Definition 3.1. Then, we show thatthe presence of such a dispute wheel implies the existence ofa dispute reel.

Lemma 5.1: Consider an SPP instance S. If S is not safeunder filtering, then there exists a dispute wheel Π whichsatisfies the following conditions:

i) Conditions ii and iii of Definition 3.1.ii) For all ui ∈ ~U , ui cannot appear in Qj , j 6= i.

iii) If ui ∈ Rj , then Rj [ui]Qj+1 is preferred to Qi.Proof: Since S is not SUF, there exists a combination of

filters inducing an instance S′ such that S′ is not safe. We canthen apply the technique described in Theorem V.9 of [9] toshow that S′ contains a dispute wheel Π satisfying the aboveconditions. The statement follows by noting that Π must alsobe present in S.

Observe that the dispute wheel of Lemma 5.1 is not a DR.In particular, it could be the case that a pivot vertex ui appearsin a rim path Rm with m 6∈ {i− 1, i}. The following lemmashows that such a DW implies the existence of a DR.

Lemma 5.2: Given an instance S, suppose it contains adispute wheel Π = (~U , ~Q, ~R) satisfying the conditions in thestatement of Lemma 5.1. Then, S contains a dispute reel.

Proof: If Π is already a DR, the statement trivially holds.Otherwise, for Π not to be a reel (while still satisfying theconditions in the statement of Lemma 5.1), there must existat least a pivot vertex ui such that ui ∈ Rm with m 6∈ {i −1, i}. That is, ui must appear in some other rim paths besidesRi−1 and Ri. We now show that in the resulting structure(shown in Fig. 14) it is possible to build other dispute wheelsobtained by “chopping away” vertices of Π and still satisfyingthe conditions of Lemma 5.1. Moreover, for every “chop” weforce one more pivot vertex to appear in exactly three paths

Rik Rij

uiui−1 ui+1

uik+1

uik

uij

uij+1

Qi

RiQi+1

. . .

. . .

Fig. 14. A dispute wheel where pivot vertex ui appears in rim paths otherthan Ri and Ri−1. By Lemma 5.2, another dispute wheel can be constructedsuch that ui appears in exactly 3 paths.

(Condition i of Definition 3.1). By iterating this process weeventually end up with a dispute reel.

Let Ri1 , . . . , Rik be the rim paths traversing ui, whereij 6∈ {i−1, i} (see Fig. 14). Without loss of generality, assumethat ik < i is the closest index to i in the order inducedby ~U . Condition iii of Lemma 5.1 ensures that ui preferspath Rik [ui]Qik+1 to Qi. Now consider the dispute wheelΠ′ = (~U ′, ~Q′, ~R′), where ~U ′ = (ui uik+1 . . . ui−1), ~Q′ =(Qi Qik+1 . . . Qi−1), and ~R′ = (Rik [ui] Rik+1 . . . Ri−1).Intuitively, Π′ is obtained by “chopping” Π, using path Rik [ui]as the new rim path associated with vertex ui. Observe thatevery spoke path in Π′ is a also spoke path in Π. Moreover,every rim path in Π′ except Rik [ui] is also a rim path in Π, andRik [ui] is a subpath of Rik . Therefore, Π′ trivially satisfies allthe conditions of Lemma 5.1. Moreover, by the definition ofindex ik, we know that Π′ is such that ui only appears in Qi,Rik [ui] and Ri−1. By applying this construction, we force onepivot vertex at a time to satisfy Condition i of Definition 3.1,even if Rik contains other pivot vertices than ui. Hence, afteriterating the construction at most |~U| times, we eventually endup with a dispute reel.

We stress that Condition iii of Lemma 5.1 is strictly neces-sary to apply the construction in Lemma 5.2. As a counterex-ample, consider again the instance in Fig. 7. In this instance,the DW ((1 2 3), ((1 0) (2 0) (3 0)), ((1 3 2) (2 1 3) (3 2 1)))only violates Condition iii of Lemma 5.1. In fact, rim path(1 3 2) traverses pivot vertex 3, but λ3((3 2 0)) > λ3((3 0)).It is easy to check that, in this case, no DR can be constructedstarting from the DW.

Theorem 5.1: If an SPP instance S is not safe underfiltering, then it contains a dispute reel.

Proof: Lemma 5.1 ensures that S contains a disputewheel satisfying some particular constraints. We can thenapply Lemma 5.2 to find a dispute reel in S.

By combining Theorems 4.1 and 5.1, we conclude that theabsence of a dispute reel is a sufficient and necessarycondition for safety under filtering.

Researchers have deemed the dispute wheel concept im-portant because it only depends on the routing policies. Assuch, it allows us to prove fundamental properties of the SPVP

11

protocol using just static analysis, i.e., without having to copewith the details of routing dynamics. In fact, the absence ofa dispute wheel implies that an SPP instance is safe underfiltering (Corollary 1 of [20]) and has a unique stable state(Theorem V.4 of [9]). Obviously, as safety can be viewedas a special case of safety under filtering, the absence of adispute wheel also implies that an SPP instance is safe (alsostated in Theorem V.9 of [9]). Fig. 6(a) is a Venn diagramthat effectively displays those implications.

As a side effect of our findings, we show that a “no DR”condition can replace the well known “no DW” one in all theabove results: in fact, “no DR” is a strictly less constrainingcondition to show that an SPP instance is safe, SUF, has aunique stable state, and is also robust. Moreover, this conditionstill depends only on the structure of routing policies.

Corollary 5.1: The absence of a DR in an SPP instance Simplies that S has a unique stable state, is safe, and is robust.

Proof: From Theorem 4.2 we know that S must have aunique stable state. Since safety and robustness are specialcases of safety under filtering, Theorem 5.1 proves the rest ofthe statement.

After stating the above results, relationships between classesof SPP instances change as shown in Fig. 6(b). Robustness isseparately discussed in the following section.

VI. SAFETY UNDER FILTERING AND ROBUSTNESS

Safety under filtering is an extremely useful concept tostudy the impact of route filters on routing stability. Aninteresting related problem is the impact of link and/or routerfailures on the safety of BGP. The property of being safe afterremoving any subset of the vertices or edges from an SPPinstance is referred to as robustness [9]. More formally, wesay that an instance S = (G = (V,E),P,Λ) is robust if everyinstance S′ = (G′ = (V ′, E′),P,Λ) such that V ′ ⊆ V andE′ ⊆ E is safe. Without loss of generality, in the followingwe only consider link failures.

As pointed out in [20], the removal of edges and verticeshas the same effect as filtering all the paths that traverse thoseedges and vertices. As a consequence, an instance that isSUF is also robust. Following the findings of Section V, wenow show that the class of robust SPP instances is strictlylarger than the class of instances that are SUF. Considerinstance FILTHY-GADGET in Fig. 15. This instance is clearlynot SUF since it contains a DR Π = (U , Q, R), whereU = (1 2 3 4), Q = ((1 0) (2 0) (3 0) (4 0)), andR = ((1 X Y 2) (2 3) (3 Z X 4) (4 Y Z 1)). Yet, FILTHY-GADGET is robust. We prove the latter statement in two parts:first, we show that FILTHY-GADGET is safe; second, we showthat any combination of link failures produces a safe instance.

To prove the first part, we need the following definition. Avertex v is said to be prevented from selecting path P if, forevery fair activation sequence, there exists a time t′ such thatv does not select P (i.e., πt(v) 6= P ) for any t > t′.

Lemma 6.1: Instance FILTHY-GADGET is safe.Proof: Let σ be any fair activation sequence. Given that

πt(0) = (0) for all t, by the fairness of σ each neighbor of0 is prevented from selecting path ε. In particular, after some

XY20

X40

Y230

Y20

YZ10 230

20

3ZX40

30Z10

ZX40

10

1XY20

4YZ10

40

X Y 2

3Z1

4

Fig. 15. FILTHY-GADGET: an instance which is robust but not safe underfiltering. Vertex 0 is omitted for brevity.

time vertex 2 can only use paths (2 3 0) or (2 0). SinceY accepts both paths from vertex 2, Y is prevented fromselecting path (Y Z 1 0), which is less preferred. Vertex 4 istherefore prevented from selecting path (4 Y Z 1 0). Since 4is a neighbor of 0, it is also prevented from selecting ε. Hence,by the fairness of σ, vertex 4 will end up selecting path (4 0)permanently, in turn forcing vertex X to permanently choosepath (X 4 0). Since path (X Y 2 0) will not be advertisedby X , vertex 1 is prevented from selecting path (1 X Y 2 0).Also, being 1 a neighbor of 0, it will end up selecting path(1 0) permanently. Vertex Z, in turn, will be forced to selectpath (Z 1 0), preventing vertex 3 from selecting (3 Z X 4 0).By applying the same argument as above, we conclude thatvertex 3 will permanently select path (3 0). Hence, vertex2 will select path (2 3 0), in turn forcing vertex Y to select(Y 2 3 0). It is easy to check that the path assignment inducedby σ is stable. Since we did not make any hypothesis on σ,we conclude that FILTHY-GADGET is guaranteed to reach thisstable path assignment for any fair activation sequences, thatis, FILTHY-GADGET is safe.

Lemma 6.2: Instance FILTHY-GADGET is robust.Proof: By the previous lemma, we know that FILTHY-

GADGET is safe. We now show that any instance S′ obtainedby removing one or more links from FILTHY-GADGET con-tains no DR, hence it is safe. Recall that FILTHY-GADGETcontains the DR Π we described above. It is easy to seethat its supporting instance S[Π] is built on the same graphas FILTHY-GADGET. Hence, removing one or more linksforcedly creates an instance where Π does not exist anymore.In order to complete the proof, we need to demonstrate thatΠ is the only DR in FILTHY-GADGET. Observe that this istrivially true if vertices X , Y and Z are not pivot vertices.We now show that no DR Π′ = (~U ′, ~Q′, ~R′) exists having X ,Y , or Z as a pivot vertex.

i) Assume that X is a pivot vertex of Π′. Without loss ofgenerality, we say X = u′0. Then Q′0 = (X Y 2 0) andR′0 = (X 4), which implies u′1 = 4. Since (Z 1 0) isthe best ranked path at vertex Z, we have either u′2 = Yor u′2 = 1. The former case results in a dispute wheelwhere spoke path Q′0 contains a pivot node u′2 = Y . Thelatter case results in a DW where spoke path Q′0 sharesvertex Y with rim path R′1. In both cases, Π′ cannot bea DR.

ii) Consider vertex Y instead and assume it is a pivot vertexof Π′. Without loss of generality, we say Y = u′i.

12

has a

statestablerobust safeNO DR ≡ SUF

Fig. 16. Relationships between classes of SPP instances, showing the strictinclusion between SUF and robust.

We have two cases, namely Q′i = (Y Z 1 0) orQ′i = (Y 2 0).• if Q′i = (Y Z 1 0), then u′i−1 = 4. We now have eitheru′i−2 = X or u′i−2 = 3. The former case implies thatQ′i−2 contains pivot vertex Y . The latter case impliesthat R′i−2 intersects Q′i at vertex Z. Hence, Π′ cannotbe a DR.

• if Q′i = (Y 2 0), then u′i−1 = 1. We now have eitheru′i−2 = Z or u′i−2 = 4. The former case implies thatQ′i−2 and R′i−1 share vertex X . The latter case impliesthat pivot vertex Y also appears in R′i−2. In both cases,Π′ cannot be a DR.

iii) Last, for vertex Z we can apply a similar argument tothat used for vertex X . Assume that Z is a pivot vertexof Π′, namely Z = u′0. Then Q′0 = (Z X 4 0) andR′0 = (Z 1), which implies u′1 = 1. As above, if u′2 = Xor u′2 = 2, we find that Π′ cannot be a DR. The onlyother possibility is u′2 = Y , i.e., Y is also a pivot vertex,which has already been ruled out by the previous case.

We conclude that Π is the only DR in FILTHY-GADGET,hence the instance is robust.

We performed an exhaustive analysis which independentlyconfirmed the result of Lemma 6.2. Namely, we generated allthe possible combinations of failures of one or more links, andthen ran the greedy heuristic algorithm in [9] on the resultinginstance. That algorithm is correct, that is, it never misreportsan instance as safe. Our brute force analysis confirmed thatremoving one or more links from FILTHY-GADGET resultsin a safe instance. Unfortunately, the greedy algorithm is notsmart enough to also prove the safety of the original instance,because it does not fully exploit vertices that are preventedfrom selecting specific paths.

Due to the existence of FILTHY-GADGET, we can concludethat robustness relates to other classes of SPP instances asshown in Fig. 16. In a sense, this means that improperhandling of route filters can impact the stability of BGProuting more than network faults could do.

VII. CONCLUSIONS

Under the realistic assumption that ASes are allowed tofilter routes arbitrarily, the safety of policy-based routing isintrinsically incompatible with unrestricted route rankings.This paper characterizes safety under filtering, determining theamount of autonomy that rankings must sacrifice in order toguarantee stable policy routing. The significance of this resultis twofold: on one hand, we fill the large gap that separatescurrently known necessary and sufficient conditions; on theother hand, we bind safety under filtering to the presence of aparticular structure of routing preferences, called dispute reel,

which can be statically detected. This is summarized in Fig. 6,which compares the state of the art before (Fig. 6(a)) and after(Fig. 6(b)) our contributions.

An interesting consequence of our results is that a net-work admitting multiple stable routing states (e.g., BGPwedgies [22]) is not safe under filtering. In this case we canalso pinpoint the problematic portions of the policy configu-ration, starting from two given stable states and without anyknowledge of the routing policies.

We finally show that a robust instance may not be safe underfiltering, leading to the scenario in Fig. 16. In a sense, thisproves that the autonomy of adding (possibly misconfigured)filters can be more harmful than network faults. Finally, asa side effect of our work, we show that the less constraining“no dispute reel” condition can replace the “no dispute wheel”one in a lot of results in the field of policy routing stability.

REFERENCES

[1] L. Cittadini, G. D. Battista, M. Rimondini, and S. Vissicchio, “Wheel+ ring = reel: the impact of route filtering on the stability of policyrouting,” in Proc. ICNP 2009, 2009.

[2] Y. Rekhter, T. Li, and S. Hares, “A Border Gateway Protocol 4(BGP-4),” RFC 4271, 2006.

[3] F. Wang, Z. M. Mao, J. Wang, L. Gao, and R. Bush, “A measurementstudy on the impact of routing events on end-to-end Internet perfor-mance,” in Proc. SIGCOMM, 2006.

[4] N. Kushman, S. Kandula, and D. Katabi, “Can you hear me now?! Itmust be BGP,” in Computer Communication Review, 2007.

[5] K. Varadhan, R. Govindan, and D. Estrin, “Persistent route oscillationsin inter-domain routing,” Computer Networks, vol. 32, no. 1, 2000.

[6] T. Griffin and G. Wilfong, “An analysis of BGP convergence properties,”in Proc. SIGCOMM, 1999.

[7] ——, “A safe path vector protocol,” in Proc. INFOCOM, 2000.[8] T. Griffin, F. B. Shepherd, and G. Wilfong, “Policy disputes in path-

vector protocols,” in Proc. ICNP, 1999.[9] ——, “The stable paths problem and interdomain routing,” IEEE/ACM

Trans. on Networking, vol. 10, no. 2, pp. 232–243, 2002.[10] L. Gao and J. Rexford, “Stable internet routing without global coordi-

nation,” in Proc. SIGMETRICS, 2000.[11] L. Gao, T. Griffin, and J. Rexford, “Inherently safe backup routing with

BGP,” in Proc. INFOCOM, 2001.[12] L. Gao, “On inferring autonomous system relationships in the internet,”

IEEE/ACM Trans. on Networking, vol. 9, no. 6, pp. 733–745, 2001.[13] G. D. Battista, T. Erlebach, A. Hall, M. Patrignani, M. Pizzonia,

and T. Schank, “Computing the types of the relationthips betweenautonomous systems,” vol. 15, no. 2, pp. 267–280, 2007.

[14] J. L. Sobrinho, “An algebraic theory of dynamic network routing,”IEEE/ACM Trans. on Networking, vol. 13, no. 5, pp. 1160–1173, 2005.

[15] ——, “Network routing with path vector protocols: Theory and appli-cations,” in Proc. SIGCOMM, 2003.

[16] T. Griffin and J. L. Sobrinho, “Metarouting,” in Proc. SIGCOMM, 2005.[17] C. Chau, R. Gibbens, and T. Griffin, “Towards a unified theory of policy-

based routing,” in Proc. INFOCOM, 2006.[18] C. Chau, “Policy-based routing with non-strict preferences,” in Proc.

SIGCOMM, 2006.[19] N. Feamster, R. Johari, and H. Balakrishnan, “Implications of autonomy

for the expressiveness of policy routing,” in Proc. SIGCOMM, 2005.[20] ——, “Implications of autonomy for the expressiveness of policy

routing,” IEEE/ACM Trans. on Networking, vol. 15, no. 6, 2007.[21] R. Sami, M. Schapira, and A. Zohar, “Searching for stability in

interdomain routing,” in Proc. INFOCOM ’09, 2009.[22] T. Griffin and G. Huston, “BGP Wedgies,” RFC 4264, Internet Engi-

neering Task Force, Nov 2005.[23] A. Basu, C. L. Ong, A. Rasala, F. B. Shepherd, and G. Wilfong, “Route

oscillations in I-BGP with route reflection,” in Proc. SIGCOMM, 2002.[24] L. Cittadini, G. Di Battista, and M. Rimondini, “How stable is stable

in interdomain routing: Efficiently detectable oscillation-free config-urations,” Dept. of Computer Science and Automation, Roma TreUniversity, Tech. Rep. RT-DIA-132-2008, Jul 2008.

[25] RIPE NCC, “Routing Information Service (RIS).” [Online]. Available:http://www.ripe.net/ris/

13

Luca Cittadini received his master degree fromthe Roma Tre University in 2006, and a Ph.D.degree in Computer Science and Automation fromthe same institution in 2010, defending the Thesis“Understanding and Detecting BGP Instabilities”.During his Ph.D. he was a teaching assistant inthe computer network research lab. His researchactivity is primarily focused on interdomain routing,including theoretical analysis of the protocol as wellas active and passive measurements.

Giuseppe Di Battista received a Ph.D. in ComputerScience from the University of Rome “La Sapienza”and is currently Professor of Computer Science atthe Dept. of Computer Science and Automationof the Roma Tre University. His research interestsinclude Computer networks, Graph Drawing, andInformation Visualization. He has published morethan 100 papers in the above areas and has givenseveral invited lectures worldwide. He is one of theauthors of a book by Prentice Hall on Graph Draw-ing. He served and chaired program committees of

international symposia and is editor and guest editor of international journals.He is a founding member of the steering committee for the Graph DrawingSymposium. His research has been founded by the Italian National ResearchCouncil, by the EU, and by several industrial sponsors. He has been nationaland/or local coordinator of many Projects of Relevant Italian National Interest(PRIN) of the MIUR.

Massimo Rimondini received a Ph.D. in ComputerScience and Automation at the Roma Tre Universityin 2007, defending the Thesis “Interdomain RoutingPolicies in the Internet: Inference and Analysis”.Since then, he has been a research fellow at theDept. of Computer Science and Automation ofthe Roma Tre University, where he is starting a3-years research contract in 2011. His research inter-ests include: combinatorial problems in interdomainrouting (stability, inference of commercial relation-ships), emulation of computer networks, network

measurements. He is one of the lead developers of the open source networkemulator Netkit.

Stefano Vissicchio received his master degree inComputer Science from the Roma Tre Universityin 2008. Currently, he is a Ph.D. student at theRoma Tre University. His research interests aremainly focused on network management, rangingfrom checking interdomain routing stability to ef-ficient monitoring and effective visualization tech-niques. Some of his research results exploit routerprogrammability.