KT The Value Networking Company

KT The Value Networking Company IRIMS (Internet Routing Information Management System) 2005. 9 Y.D. KIM, G.E.KIM, C.K.Hwang, J.H.YOO (webman, gekim, ckhwang, styoo@kt kt.co..co.kr) Abstract An AS (Autonomous System) consists of routers and links that managed by an operations organization, which uses a single IGP (Interior Gateway Protocol) for its internal routing. The Internet is composed of many independent ASs that exchange reachability information to destinations using BGP(Border Gateway Protocol). These routing protocols are used to determine the path of packets and control traffic via routing policies. For the effective management and stable operation of service and network, the existing management platform based on physical port management is needed to add the way to manage the logical routing information of network. Especially, routing instability that is informally defined as the rapid change of network reachability and topology is caused by the inflow and error of abnormal routing information, which critically affects the operation of the entire network causing forwarding loops, packet loss, delayed convergence time and unintended creation of paths between hosts. Therefore, it is necessary for ISPs to monitor and analyze Internet routing information. This paper describes the design and implementation of IRIMS, the Internet Routing Information Management System, a system that manages routing information (prefix). It has an on-line measurement function which collects route update and flaps information on peered routers. It analyzes routing information from PDU which has a lot of additional attributes such as origin, community, originator-id, local-pref and nexthop etc. 226

I. Introduction Conceptual Model Hello, My Name is IRIMS! I peer with routers in service, and I collect real-time Routing Information. I look into IS-IS and BGP so that make logical topology in the AS and session topology for BGP. If The Traffic is overflowed in service networks, I search for reason then make report for this. 2 1. Introduction The analysis of BGP routing information and Internet routing instabilities have been well studied in the last few years. The studies have been published examining the issues of Internet instability utilizing trace routing information[1][2][3][4]. In these studies, detailed research was conducted on Routing Instability and Route Oscillation, where they defined those as the rapid change of network reachability and topology information. They concluded that Internet routing instability has three primary effects: increased packet loss, delays in network convergence, and additional resource overheard within the Internet infrastructure. However, these studies didn t look into IGP. Among the IGPs, LSP (Link State Protocol) such as IS-IS and OSPF, fixes many of the issues with RIP(Routing Information Protocol) and allows routes to be selected dynamically based on the state of network, not just a static picture of how routers are connected. For the performance improvements to the network convergence times of the customer's network, LSP(IS-IS) prevents flooding from using CSNPs for database synchronization, and simplifies SPF (shortest path first) computations. The LSP is so swift that the SNMP that is the de facto standard for collecting data in today s Internet is not fit for management of LSP. Because of depending on the periodic method of polling, the SNMP has limitation to collect and express by real-time link s status that is dynamically changing of logical routing informations. In order to overcome this, The IRIMS directly interconnected to the routers of Internet service provider using routing S/W, collects routing information from routing protocol packets (IS-IS, BGP), and analyzes the routing packet collected, stores in Database, and then manages the statistic information based on the Database. Furthermore, using SNMP, The IRIMS manages whether the connection between BGP sessions is on or not by the collecting of BGP session information, and also using CLI, it performs the additional function of collecting and analyzing router configuration file for policy information. 227

II. Overview of IRIMS Key Features Manage Real-Time system Topology of The Logical Network with Peering. Monitor The Internet Routing Information by Real- Time System and Detect Abnormal Routing information through History Management. Analyze The Internet Routing Stability and The Property of Routing Protocol Traffic. Support Network s s Designer and Operator to determine Network Design and Policy 3 2. Features of IRIMS The IRIMS has engineered a full suite of high-performance features for analyzing routing information and managing logical network topology as part of its main purposes. These features are designed to provide a flexible end-to-end solution for analyzing routing information with high levels of monitoring capabilities to detect any abnormal routing information. These features include: Manage Real-Time system Topology of The Logical Network with Peering for real-time monitoring. Monitor The Internet Routing Information by Real-Time System and Detect Abnormal Routing information from historical analysis. Analyze The Internet Routing Stability and The Property of Routing Protocol Traffic. Support Network s designer and operator to determine Network Design and Policy that is important in keeping network healthy. 228

Type of Nodes 1) ES: End System 2) IS: Intermediate System III. Link State Protocol 3) PseudoNode: Broadcast Network (like as LAN) Link Information 1) Link : LSP s Neighbor Information. 2) IP information: LSP s Interface, Prefix Information. 3) SPF(Shortest Path First): Other routers in the area use the pseudonode s LSP in their SPF calculations for networks. 4) DIS: Designated IS (Router): Generate PseudoNode ip 10.1.0.0 255.255.0.0 pseudonode 4 3. Introduction of LSP Link State Protocols such as IS-IS and OSPF are used to communicate routing information between routers within an AS. In this paper, we focus on IS-IS that is introduced into our networks. In the IS-IS s propagation step, a new link-state packet (LSP) reflecting the topology after the change is flooded to all the other routers in the network. The Designated IS (DIS) creates a logical router called a pseudonode when routers connected via broadcast network like as LAN. Each router on the LAN forms an adjacency to the pseudonode, as well as to each other. The DIS generates one advertisement for the entire LAN network, on behalf of the pseudonode, rather than each router s advertising the same LAN network. Other routers in the area use the pseudonode s LSP in their SPF calculations for that network. The DIS also ensures that all the routers on the LAN maintain synchronized databases by sending periodic CSNPs out onto the LAN. Despite the critical role of the DIS in LSP flooding, no backup DIS is elected for either Level 1 or Level 2 in IS-IS protocol. Fortunately, this doesn't turn out to be a contentious problem because of the frequency of periodic database synchronization that occurs on broadcast links. In the shortest path calculation step, each router having received the new LSP computes the new routes using a shortest path tree algorithm. Typically, Dijkstra s Shortest Path First (SPF) algorithm is used in this calculation. 229

IV. Software Architecture of IRIMS Software Architecture IRIMS Domestic ISP Glorbal ISP Domestic ISP Web browsers Glorbal GW Application Services Statistic Report Generator Guro KIX Guro Center Glorbal HUB Aggregator Heahwa Center Heahwa KIX Routing Protocol Manager Routing Protocol Processor BGP Protocol Module Making BGP/IS-IS Neighborhood ISIS Protocol Module DB Mediator SNMP/CLI Collecting Module RIB DB BGP DB IS-IS DB 5 4. Software architecture The IRIMS s software architecture is illustrated in figure. Our designed software architecture for the IRIMS is multi-tier software architecture based on web service technologies that end users use web browser to manage the network. In the following, we briefly explain the behavior of Software Module: 1) Application Service module: This module is built to be interoperable between user s web browsers and server systems. It provides the whole NMS biz logic, including: configuration management, fault management, performance management and so on. Also this module does the security related work. The functions are authorization and access control. 2) Statistic Report Generator: This module generate report files with Excel format for client. 3) Routing Protocol Manager module : This module analyzes task that come from Application Services module and dispatches them to sub modules or just do them by itself. It produce historical routing information that explains what is different between old prefixes and new ones. 4) Routing Protocol Processor module: It is based on the lower layer modules. It has functions of storage Real-time routing information, Managing Sub-modules. 5) DB Mediator: All the database access related actions must use DB Access Module. There are many ways to implement db access module in IRIMS, such as using TP monitor, or Entity Beans for EJB (Enterprise Java Beans). Database access module can also send event messages to given destinations using JMS (Java Message Service). 6) SNMP/CLI Module: This modules use SNMP API to communicate with SNMP agents. To manage configuration files, we design CLI module. We use CLI collecting module to backup configuration files and analyzes policy information. 7) BGP/IS-IS Protocol Module: BGP/IS-IS Protocol Module were implemented as a module for the ZebOS routing software that is commercial version of Zebra and it is adjusted to our project and platforms. The router treats the IRIMS in the same way as other peering routers, hence it forwards to all routing information that it receives from the rest of networks and exchanges routing information. So it is very important to decouple network management from services of network. This problem has been handled by setting of LSP s overload-bit and routing filter in the peering routers. 230 5

V. Implementation of IRIMS 6 5. Implementation of map The IS-IS s update process generates link state packets, based on the adjacency database built by the functions, which the router advertises to all its neighbors in linkstate packets. A router also receives similar link state information from every adjacent neighbor, keeps copies of link state packets received, and re-advertises them to other neighbors. The link state packet s header has many information of links status like as Remaininglifetime, Attached bits, Overload bit, IS Type and it s TLV fields be included in different kinds of routing information that is made of Link-State database. Routers in an area maintain identical Level 1 Link-State databases, which are synchronized using SNPs. This means that routers in an area will have identical views of the area topology, which is necessary for routing consistency within the area. A Level 2 Link-State database contains area prefix information that ties all the areas together for inter-area routing. The IS-IS Forwarding database, which is made up of only best IS-IS routes, is fed into the Routing Information Base, essentially the IP routing table of a router to be used in packet-switching decisions. The DB schema for map is designed to store routing information data from the router to the IRIMS and update topology data. As illustrated in figure, the Nodes table provides linkage of history table and SystemID, SystemName, Area, Level, SystemAlive fields. These fields present router s basic information. The links table s primary key consists of combination systemid and SeudeNodeID. This means that the broadcast medium is modeled as a node like as system nodes. It also manage SystemLocation, OrgID fields that have hierarchical records and Link status field that has add/update/delete types from LSP s update procedure. For the statistic information, The static ORG table has up/down link count and ParentOrg like link list. The BGP session s map is built much like LSP map except it use SNMP polling to collect data. 231

V. Implementation of IRIMS IS-IS MAP start Collecting SystemID from ORG Table. Trigger of MAP regeneration (Transport link s Status/Alarm Event that headed SystemID) Analyze LSP s Neighbor, Prefix, Metric, Link s status Analyze Peer Nodes Information Is it redundant? NO Display nodes on Client s Screen YES NO Is there Peer Nodes? YES 7 5. Implementation of map Figure shows the overall process to create a IS-IS map. At this point, we assume that such operator s organizations are pre-defined. In the following, we briefly explain the behavior of the flow chart procedure that create a IS-IS map: [Step 1] First, we collect an all SystemID from pre-defined ORG and follow next steps for generating first MAP. Next time, Link s event and status information that bring about MAP regeneration is transmited from event provider. Then we get information of peer nodes from LSP s neighbor TLV (Type Length and Value). [Step 2] We analyze peer nodes, link s status, prefix, metric, neighbor information from TLVs. [Step 3] If there is some redundance of link, It gets rid of these information. [Step 4] Supposed to hasn t any peer nodes, It displays nodes on client s screen. 232

V. Implementation of IRIMS Fig. 1 Fig. 2 Fig. 3 Fig. 4 Fig. 5 Fig. 6 8 5. Implementations of IRIMS The IRIMS implements following function of management: Logical network connection topology management (Figure 1, 2) - Indicate MAP & monitor condition of ISIS connection topology - Function to manage the condition of BGP session topology - Function to manage the information of AS (Autonomous System) connection - Function to report using SNMP Trap the failure of real-time system - Function to interwork TTA (Traffic Threshold Alarm system) Routing basic information history management ( Figure 3) - Function to manage BGP & ISIS routing information history - Function to maintain, change, and manage BGP/ IS-IS RIB (Routing Information Base) - Function to manage statistical routing & failure information Collection & Analysis of Routing information - Function to directly interconnect using BGP/ IS-IS routing protocol - Function to analyze BGP/ IS-IS routing information - Function to detect abnormal routing information that be caused of BGP/IS-IS flapping - Function to detect overload capacity of BGP/IS-IS prefix Routing protocol traffic analysis ( Figure 4) - Function to manage BGP session traffic - Function to analyze the transition of BGP/IS-IS routing information - TCA (Threshold Cross Alert) Management Router configuration management (Figure 5, 6) - collect/modify the history management of router configuration file - BGP policy management - AS number management - BGP Community management 233

VI. Conclusion & Future Work Enable stable operation of The Internet network through routing information management. Guarantee network service quality through abnormal routing information is recognized by real-time monitoring. Guarantee the stability of network equipment through resolving routing instability. The plan of effective routing policy and effective analysis based on data. When logical network failure occurs by abnormal routing information, analyze cause and administer rapidly. 9 6.Conclusion and Future Work The implementation of IRIMS for KOREA Telecom has two different objectives. The first one is to assist the managing, administrating and operating people for monitoring and controlling the whole KOREA Telecom's network services. The other is to provide routing information for designing and planning networks. Consequently, it makes the provisioning of core network smooth and swift and thus enhances customers' satisfaction in a solid way. It makes benefits in five aspect of ISP. - Enable stable operation of The Internet network through routing information management. - Guarantee network service quality through abnormal routing information is recognized by realtime monitoring. - Guarantee the stability of network equipment through resolving routing instability. - The plan of effective routing policy and effective analysis based on data. - When logical network failure occurs by abnormal routing information, analyze cause and administrate rapidly. We also plan to extend our implementation to in other deployed routing protocols such as OSPF and to simulate traffic s data for analyzing correlation with routing policy. Reference [1] C. Labovitz, A. Ahuja, A. Bose, and F. Jahanian. Delayed internet routing convergence. In SIGCOMM, pages 175 187, 2000. [2] C. Labovitz, G. R. Malan, and F. Jahanian. Internet routing instability. IEEE/ACM Transactions on Networking, 6(5):515 528, 1998. [3]T.Griffin, and G.T.Wilfong. An Analysis of BGP Convergence Properties. ACM SIGCOMM, August 1999. [4] University of Oregon RouteViews project. http://www.routeviews.org 234