1

Lecture 1: Introduction to routing

Networks and concepts

Olof Hagsand KTH CSC

DD2490 p4 2011

2

Click to add title

● Click to add an outline

Enterprise network example: KTH Intranet

View of KTH internal network drawn by Anders Hillbo, manager of IT-enheten at KTH.

The KTH network is an example of an organisation / enterprise network with no external customers. KTHLAN users are the institutions and students of KTH.

Most parts of KTHLAN is a switched Layer 2 network leading to a few aggregation routers which in turn lead to the up-link routers connecting KTH to the outside world. Note the redundant links from departments to the routers. The transit uplink operator for KTHLAN is SUNET.

KTHLAN runs OSPF as internal routing protocol. It runs BGP only on the two border routers with SUNET.

3

Transit network: Nordunet

Nordunet is an example of a network provider - a transit network. Such a transit network uses an internal routing protocol (in this case IS-IS) to compute routes within the network and between its BGP speakers. Actually, all routers run both IS-IS (for internal routes) and BGP (for external routes).

Nordunet has other networks as customers: SUNET(Sweden), FUNET (Finland), Uninet(Norway), Forskningsnet (Denmark). Some of those networks are in turn network providers: SUNET, for example, has the swedish universities as customers.

Nordunet uses GEANT, and TeliaSonera as transit providers, but it has expanded in recent years with presence in London, New York and Amsterdam in order to peer directly to other operators in order to reduce costs.

It also peers locally via Netnod to networks in Sweden, as well as directly with Google and (swedish) Telia, etc.

This is a load-map. The colors indicate how much traffic traverses the links. The width of the links indicate bandwidth, up to 40Gbps.

4

Mobile network example

Transport/Aggregation(IP/Ethernet/Microwave)

Transport/Aggregation(IP/Ethernet/Microwave)

Core(IP MPLS)

Core(IP MPLS)

Base stations

Radio Network Controller/BSC

(Very) simplified example of a mobile network. There are many generations and several competing technologies, the newest being 4G /LTE which is packet-switched with no traditional time-slot multiplexing (TDM). A mobile backhaul aggregates telephony and data traffic from the cell sites (base stations) to a radio network controller or base station controller(BSC). Core networks often based on IP and MPLS is used for interconnection.

A mobile network is from an IP perspective an internal network and therefore runs an internal routing protocol, such as OSPF. Typically, IP/MPLS is also used to extend the internal routing with traffic engineering. That is, so that non-trivial routing and load-distribition can be made within the network.

5

Autonomous systems - RFC1930•An Autonomous system is an independent routing domain

typically administered by a single entity.•AS:s are either directly connected or use Internet exchange

points (IX:s) for connection•An AS contains an arbitrary complex network sub-structure.•Each autonomous system selects the routing protocol to be

used within the AS.•Policies or updates within an AS are not propagated to other

AS:s.•An AS-number used to be a 16-bit unique identifier but are

now being upgraded to 32-bits.•A contract (Service-layer agreement - SLA) regulates the

interaction between AS:s. Often one part pays the other to access parts of the Internet it does not have access to (paying for transit).

Autonomous systems represents an engineering principle of modularity: sub-divide a large complex system into smaller sub-systems with well-defined interfaces.

In this way, we can focus on one problem (one internal network) at a time while keeping the interfaces (inter-domain routing - BGP) intact.

Note that there is no 'Internet police': there is no central authority that regulates how individual autonomous systems behave.

6

Example of AS:s: US universities

AS-paths to US universities from NORDUnetDaniel Åman, KTHNOC 2006

Nordunet

Internet2

This is an example of autonomous systems as seen from Nordunet. Each node in the graph represents one AS. An edge in a graph represents peering relations (connections between AS:s) as visible from Nordunet. There are other connections but they are not 'visible' from this viewpoint. This information was used to create the new peering policies that can be seen in the earlier slide.

Some ASNs in the graph:

2603 Nordunet

1299 TeliaSonera

20963 GEANT

3356 Level3

101 Pacific nortwest

11537 Internet2

2914 NTT

3549 Global crossing

14 Colombia

7

Internet structure

•Ideally, there is a well-defined hierarchy in the Internet – a tree.●A few large “Tier 1” backbone providers – the core of the Internet provides transit for everyone else●Tier 2 regional ISPs, or NSPs (Network Service Providers)●Smaller ISPs●Customers

•A well-defined hierarchy is nice for address aggregation –> smaller IP tables

•However, the hierarchy has broken down due to market forces:●Peering at IXs, direct connections.

•The Internet structure is now more in the form of a graph --> larger routing tables

8

List of Tier 1 networks

Wikipedia: Tier 1 network, March 2011

Name AS number

Qwest 209

Verizon 701

Sprint 1239

TeliaSonera 1299

NTT 2914

Tinet 3257

Deutche Telekom 3320

Level 3 3356

Global Crossing 3549

Savvis 3561

Tata 6453

AT&T 7018

The definition of tier-1 operator is disputed. It is loosely defined as an operator that has connection with all other networks in the Internet without having to pay transit.

According to this definition however, some content networks such as AOL and Google sometimes qualify as Tier 1 although they do not act as transit providers themselves.

9

AS graph and peering relations

AS2

AS4

AS1

AS3

AS8AS7AS6 AS9

AS5

Transit

Peer

Customer

Tier 1: FullInternetconnectivity

NSPsISPs

Stubs/Customers

Based on information exchanged between BGP routers, a graph of Autonomous systems can be constructed (see the AS-graph a few slides back).

The figure above shows business relations between AS:s. A transit relation typically means that the operator needs to pay the other for transit. A peering relation typically means that two operators exchange traffic with no cost. A customer relation means that the operator can charge the customer for traffic (inverse of transit).

These relations mean that in practice the chain of ASs that a single IP packet traverses is quite low. Why?

10

IGP/EGP

Customer

IGP

ISP

IGP

EGP

EGP●Exterior Gateway Protocol.

●Primarily exchanges routes between networks/domains (inter-domain)

●Handles external routes

●Examples: BGP, static routing

●Note: an EGP can handle external routes within a domain (IBGP)

IGP●Interior Gateway Protocol.

●Runs within a network/domain (intra-domain)

●Handles internal routes within a domain

●Examples: RIP, OSPF, IS-IS, MPLS.

EGP can be a confusing term: EGP was actually an inter-domain routing protocols which was replaced by BGP which is the only current inter-domain protocol in use.

11

Static vs dynamic routing

•Static routing●Manually configure routing table●Typically for small networks●Single-homed, default route●Hosts are (almost) always use static routing

•Dynamic routing●As soon as the network is non-trivial, it is too difficult to manually configure a network (see lab1)●Need dynamic routing protocol●Only routers participate in dynamic routing

Surprisingly many inter-domain scenarios can be made with static routing. Intra-domain routing, however, is essentially always dynamically routed.

12

The routing table

•Currently, backbone tables (BGP entries) are around 350000 entries (full feed)

•Virtual private networks (many customer routing tables) the tables are even larger

•Also, a “routing table” is actually many data-structures:●Many different protocols●Forwarding information base (FIBs)●Routing information base (RIBs)

From Geoff Huston , 2011http://www.cidr-report.org

The graph shows the 'BGP table'. If you connect a router to the Internet backbone, this is the number of active BGP entries you will receive.

13

Load balancing and ECMP

•The routing protocol gives several routes to a network•Either select the best•Or load-balance between several links

●Unequal-cost multi-path●Equal-cost multi-path (ECMP)

•Most protocols and routers support ECMP. Few support unequal-cost multi-path

•The forwarding decides how to balance actual traffic:●random (but this break TCP flows)●load balance per flow●load balance per address pairs

•Note that a requirement for load balancing is that it is the same prefix and routes from the same routing protocol.

There are many research approaches with unequal-cost multipath but none used in practice. Unequal-cost multipath tend to cause packet-loops (why?)

Why does random load-balancing break TCP?

The reason is that packets within a single TCP stream may be re-ordered since they take different paths with different latency. If a reordered TCP segment arrives ahead of another segment, the receiving TCP peer interprets this as a loss (the overtaken segment has not arrived) and will therefore immediately send an extra acknowledgement of the previously received segment. This will cause duplicate acknowledgements that in turn triggers fast-retransmit at the sender (Actually three acks is required). In fast-retransmit/fast recovery, the segment will be resent and the TCP window will be reduced. A lot of duplicated acks will therefore cause a decline in TCP throughput.

14

Example: load-balancing

•IS-IS/OSPF load balancing with two 3ms paths, one slow 20 ms path.

•Hosts from the same LAN (or different flows from same host) may take different routes and thus experience different round-trip times.

3 ms

3 ms

20 ms

A

B

C

D

This is from a real case in a Telia network that had problems with its voice traffic where one load-balanced path went a completely different route within Sweden - some VoIP calls experienced high delays while others did not.

Exercise: which round-trip (ping) delays can be seen and how were they distributed (assuming an even usage of the three links)?

Note that the load-balancing in one direction is independent of the load-balancing in the other.

15

Aggregation

•Also called summarization•The netid part of IPv4 addresses can be aggregated

(summarized) into shorter prefixes.•Summarization is often done manually•Leads to smaller routing tables (fewer prefixes)•Threats: multi-homing and load-balancing

199.1.2.0/24

199.1.1.0/24

199.1.0.0/24199.1.3.0/24

199.1.4.0/24

which aggregations can be made?

In the left case, it is safe to summarize 199.1.0.0/23, and also announce 199.1.2.0/24, thus announcing two networks instead of three. If you announce 199.1.0.0/22, you may attract traffic to 199.1.3.0/24 which is not present in the network. However, if 199.1.3.0/24 is not allocated elsewhere and you own it, you may announce the /22 network and drop (black-hole) 199.1.3.0/24. Furthermore, a /22 is less-specific than a /24 which means that if 199.1.3.0/24 is announced explicitly somewhere else, it will over-ride the /22.

In the right case, the situation is worse. The only option would be to summarize and announce 199.1.0.0/21, but then you have blackholed 199.1.0.0/24-199.1.2.0/24 and 199.1.5.0/24-199.1.7.0/24 which is most probably a bad idea.

16

Asymmetric Routing

•A rule rather than an exception:●To- traffic and from- traffic take different paths

•Hot-potato routing●Send traffic out of your AS as soon as possible

•Cold-potato●Try to keep your traffic as long as possible.

As soon as there are redundant paths, ECMP, or traffic engineering (TE), traffic may take different paths in both directions.

This is especially present (and is the normal case) in inter-domain routing, but may also appear within a domain (ECMP and TE).

It makes it difficult to analyze, filter and firewall traffic in the network since the two directions are separated. For example, an HTTP request and response take different paths and cannot be properly identified - most firewalls use the request to open the firewall for the response in the opposite direction.

Many non-experts have problems grasping the inherent asymmetry of routing,...

17

Fault detection•An important feature in a routing protocol is how to

detect link or node/router failures.•In many cases, a node can directly detect a link failure:

●Directly connected copper Ethernet (loss of signal)●FIber (loss of light)●SDH/TDM has built-in loss detection

•But more often indirect methods must be used●Switched network (failure >1 switch away), ●Node failure●Partially broken link

•Routing protocols have timers / hello protocol●seconds-10s of seconds

•MPLS has fast detection using 'ping' mechanism•Bidirectional Forwarding Detection (BFD)

●MPLS-like mechanism can be used in routing●Send many 'pings' and detect losses●Down (and below) 100ms.

Note the difference between indirect and direct fault detection.

18

Protection switching

•After a failure is detected, the router should re-route around the failures

•Next-hop is changed, so all routes depending on the next-hop need to be re-computed●The control-plane recomputes the routes and pushes them out to the forwarding plane

•Even though the number of next-hops is small, the number of routes with a specific next-hop can be very large, for example in BGP.

•Protection switching time is therefore failure detection + time for computing and pushing out new forwarding entries

•Small forwarding tables are therefore faster, or routing that does not need large tables.

IP networks have long suffered from bad protection switching in comparison with telephony networks. This is because telephony networks using TDM and SDH has fault-detection in their link-layers (bits in the link layer is used to detect loss-of-signal). But IP due to the layering model (least common denominator) has removed such functionality which may be present in the link since many link technologies (eg Ethernet) lack this.MPLS and Metro Ethernet has mechanisms for failure detection by sending lots of packets and detecting losses. This has been used by BFD and is used by most routing protocols today. Thus routing protocols can in principle use similar protection switching as other technologies.

19

Black-holing

•Black-holing: announce prefix, but traffic to the prefix is dropped (not delivered)

•Loops: circular announcements causing packet loops●TTL is decremented until packet drops -> same symptom as black-holing

•Reasons: ●Transient errors due to long convergence (see count-to-infinity in RIP)●Misconfigurations●Attacks (DOS, man-in-the-middle)●Response to attacks: create a black-hole for attacked prefixes which removes DOS traffic

Announce prefix

Drop traffic

Note that black-holing can be used intentionally, as in announcement of a an aggregated prefix where there are holes in the address space which represent unallocated addresses.

20

Objectives of routing•Routing can be seen as an optimization problem

●Find the 'best path' with respect to some limited resources

•Shortest path: The most common is to find a 'shortest' path with respect to a scalar metric such as link cost

•Distribute load: min of max load in a network●Eg: no link should have more than 50% load

•Battery: Ad-hoc routing and sensor networks●Eg: wake-up radio in certain time-slots, distribute packets evenly between nodes

•Time: Delay-tolerant networks●Eg: send packets speculatively in several directions

•Most solutions based on SPF (Shortest Path First) algorithms that are well known in graph theory.

•Distance-vector protocols use Bellman-Ford •Link-state protocols use Dijkstra

Delay-tolerant networks (DTN) include inter-planetary networks and nomadic networks (eg Sami). Destinations may move making their location unknown in advance. So it makes sense to send the packets in several directions.

21

Traffic engineering•Shortest path routing is of limited use if you want

to control network paths in detail●You can only manipulate link metrics

•Spread traffic over a network to minimize load and cost - eg 'widest path' routing●Use your network more efficiently

•Pin-point traffic along specific paths•Pre-compute alternative routes•Route using other metrics: delay-sensitive, load,

etc.•MPLS is typically used for Traffic engineering.

●Explicit path (eg via nodes B, C)●Constrained routing (eg load)

•More about this in the algorithms lecture

Shortest path routing sets up everything according to SPF, but you have very little control of the traffic once this is made. You rely on traceroute to see how traffic actually goes. The advantage is that 'it just works'.

Note that utilizing a networks links better is sometimes not the most important thing for a network designer. It is often more important that the network works in case of failures. Thus, links can go idle as long as they function when the primary link goes down.

For example, the dual router solution in KTHLAN is not for load balancing, it is primary for redundancy. Secondary, it is for being able to inspect traffic: detecting attacks and illegal downloads,...

22

Routes from several sources

•Direct●Networks on directly connected interfaces

•Local●Example: 127.0.0.1

•Static●Configured static routes

•Aggregate●Manually aggregated routes

•Dynamic routing routes:RIP, OSPF, ISIS, BGP, RSVP,...

direct

local

rip,ospf, isis,...

A router has routes(prefixes) from several sources: dynamic routing protocols and manually configured.

A large part of the complexity in routing has to do with understanding how routes from different protocols interact.

23

Route preference / Administrative distance

•Several protocols may include the same prefix. How do you decide which route to install in your routing table?

•Default preference (on Juniper) is:●Direct > Local > Static > OSPF > ISIS > RIP > Aggregate > BGP

•Example: If 123.3.4.0/24 is both statically configured and seen in RIP, the static route takes precedence.

•Can be changed or overridden with policies

Note that this only applies to the same prefix. A more specific prefix still overrides a less-specific regardless of protocol.

For example: 123.3.4.0/24 in RIP overrides a static 123.3.0.0/16 route (for destinations in 123.3.4.0/24)

24

Redistribution of routing information

•If several protocols are running on the same router●E.g., an OSPF as interior and BGP as exterior●E.g. static routes into dynamic routing protocol

•The router can distribute routes from one protocol to another●Interior routes need to be advertized to the Internet

• Typically these routes are aggregated●Exterior routes may need to be injected into the interior network

• But only a subset – the backbone tables are very large• Necessary for domain carrying transit traffic• Not necessary for a domain using only a default route

•Typically, redistributed routes are filtered in different ways due to routing policies

Note that redistribution occurs within a single router between protocols and is a local operation.

In contrast., exchange of routes between routers is made using a dynamic routing protocol.

Thus a route may be redistributed from OSPF to BGP in router A, then exchanged (announced) by A to B using BGP.

25

The routing process

Neighbours

Protocols

Neighbours

Protocols

RIB

FIB

ExportImport

FIB FIB

LinecardsForwarding Information Base - FIB

Routing Information Base - RIB

Traffic Traffic

The routing process performed by a single router consists of running routing protocols, enforcing routing policies, compiling the routing information into forwarding information, and forwarding traffic.

Routing policies are made when the default behaviour of the routing protocols needs to be changed.

Routing policies are made by formulating rules when importing and exporting routes. Imports and exports are made either via other protocols internally (redistribution) or via other peers using the same protocol (exchange).

Simple policies include filtering: just dropping unwanted prefixes. More advanced policies include changing and combining routes or route attributes.

The information in the RIBs (one per protocol) are compiled and used in the forwarding information bases. FIBs are optimized for lookup and typically reside on the linecards. In the compilation process, route preference is used to tie-break between routes from different protocols.

More about this in the forwarding lecture.

26

Example: Redistribution in JunOS

•In JunOS, policies are made up of match/action pairs•Announce an aggregated prefix routes in BGP consisting of sub-

routes from OSPF and directly connected networks.•First declare policy, then apply it in the protocol•The aggregated route consists of sub-routes•Non-existent sub-routes cause black-holing

policy­statement MYNETWORK {    term 1 {        from {         # match            protocol aggregate;              route­filter 192.168.2.0/24 exact;        }             then accept;   #action    } }

    protocols bgp {     export MYNETWORK; # Apply policy }

192.168.2.0/24: aggregate

192.168.2.0/24: bgp

192.168.2.0/28: direct

192.168.2.32/28: ospf

Note that this example shows a combination of aggregation, redistribution and exchange of routes:

- The direct route and the OSPF route are aggregated into a common prefix. This prefix is manually configured as an 'aggregated' (variant of static) route. The aggregated route is then redistributed into BGP. BGP then exchanges the route (announces it) with the outside world.

Note that there are blocks in the address space, traffic to these destinations may be black-holed using this solution.

27

Routing instances and tables

inet.0

RIB

Routing Instance: main RIBs

Routing protocol 3

Routing Instance: other RIBs

inet6.0

inet.1

inet.2

inet.3

mpls.0

IPv4 unicast routes

IPv6 unicast routes

IPv4 multicast forwarding cache

IPv4 multicast RPF table

IPv4 routes learnt from MPLS-TE path exploration

MPLS label-switch table

inet.0

Example: main.inet.0 __juniper_private1__.inet.0

Logical routers, VPNs, virtual routers, etc, use routing instances.

inet.4 MSDP routes

Click to add text

This shows the partitioning of routing tables on a Juniper router.

A routing table is partioned into tables (RIBs) of the diferent routing protocols.

The tables are in turn partitioned into routing instances thus allowing several RIBs of the same kind to exist within a router. This is useful in different types of virtualization, such as in VPNs where the table of one instance should be completely isolated from the other.

28

Summary

•This lecture covered networks and generic routing topics

•Internal routing takes place in many different kinds of networks: enterprise, transit, mobile, etc.

•Some of these generic topics are advanced - you should go back and look at these topics again when you have mastered the details of the routing protocols

•Next lecture: routing algorithms