Visualizing and Troubleshooting BGP Routing
Ricardo Oliveira, CTO Nick Kephart, Director of Product
Marketing
1
• Radically simplify how organizations troubleshoot, monitor and analyze performance for modern networks
ThousandEyes Overview
• 15 in the Fortune 500, including 3 of top 5 firms • 4 of top 6 US financials; 6 of top 10 SaaS firms
Mission
Customers
• Founding team with network research background Company
Recognition
2
How BGP Works
AS 100 1.1.1.0/24
AS 300 3.3.3.4/22
AS 400 4.4.0.0/16
AS 200 2.2.2.0/24
Border Router
Origin Dest.
Autonomous System
Internal Router
BGP Routing Table: 4.4.0.0/16 300 400 3.3.3.4/22 300 2.2.2.0/24 300 400 200
BGP peers exchange routes, within and among
ASes
Each AS can use BGP attributes and filtering to
affect how preferable each route is
BGP is… • Defines
reachability between Autonomous Systems
• Defined by AS Path vector with incremental updates
• Applies policies to inter-networking
3
• Policy changes • Peering changes • Maintenance • Intentional handovers
(DDoS)
What Must Be Managed with BGP
• Local misconfigurations – Attribute confusion
• Upstream ISP issues – Flapping
• Equipment failures • Route hijacking and leaks – Others broadcasting your
prefixes – Or more specific prefixes
The Expected And Unexpected
4
• See inbound routing to your prefixes
Collecting BGP Data
• See outbound routing to key services and endpoints
Public Monitors Private Monitors
Your BGP speaker
ThousandEyes collector
5
Visualizing BGP Routing
Destination AS (Comcast)
Public vantage point
Upstream ISP (Level3)
Upstream ISP (NTT)
Github prefix
6
Visualizing BGP Routing: Route Changes
Withdrawn routes to Level3
7
Inside-Out Visibility: Private BGP Monitors
8
Scenario Test Type Threshold Prefix Hijacking BGP Origin ASN not in ___
Covered Prefix exists
Peering Changes, Route Flaps BGP Path Changes > 1 Reachability < 100%
DDoS Mitigation Activation BGP Origin ASN in ___ Prefix not in ___
Prepending Errors BGP Next Hop ASN not in ___
Tuning Your BGP Alerts
Demo
10
Set Up a BGP Test
Or create a BGP-only test
BGP included in Network, Web and
Voice tests
Select the prefix
Choose the monitors
Configure alerts
11
Set Up a Range of BGP Alerts
Alert on reachability, ASNs, prefixes and AS-Path changes
Make alerts contingent to reduce false positives
12
International Connectivity Issue
Packet loss spikes
SuccessFactors
But only from international locations
13
Issues with Tinet
Packet loss occurring in Tinet SuccessFactors
14
Prior to Issue: 5 Upstream Providers
Hosted in Internap
AboveNet
Tinet
Telia
Qwest
Cogent
Tokyo
London
Internap prefix
15
During the Issue: Tinet Rerouted via Cogent
Tinet
Cogent
Withdrawn Routes
Newly Advertised Routes
16
BGP Leak: Spotify Routes Leaked by Enzu
New /23 route leaked
Visible for almost 3 hours
Leaked by Enzu (AS18978)
Spotify (AS43650) Propagated at LAIX (AS40633
Seen by 5 monitors
17
BGP Prepending Error: Country Financial
Country Financial (AS10511)
Upstream Qwest (AS209)
Routes include AS15011, a
prepending error
18
BGP Hijack: Normal Routes to PayPal
PayPal / Akamai prefix
Akamai AS
Comcast upstream
19
BGP Hijack: Routes Advertised from Indosat
PayPal / Akamai prefix
Correct AS
Hijacked AS
Locations with completely hijacked routes
20
BGP Hijack: PCCW Has No Routes to PayPal
Only connected to Indosat
21
BGP Hijack: Causing All Traffic to Drop
Traffic transiting PCCW has no routes
It’s time to see the entire picture. It’s time to see the entire picture.
