Hello everyone, this is Romain Fonthune from IAJ
Research Lab, and today I will present
our latest results on BGP zombies.
So first let me explain what a BGP zombie is.
So this figure represents how one prefix is seen
by RIS routers.
On the y-axis here you have all the RIS routers,
and on the x-axis you have time.
The prefix we are looking at is one of the RIS BGP
beacon prefixes, and the green circles
here show that the prefix is announced by one of
the routers.
Then the green line shows that the prefix is
active in the router routing table, and
the red cross shows that the prefix is withdrawn
by the router.
So here it means the prefix is active for two
hours, then it's withdrawn for two hours,
and then it's announced again for two hours, and
withdrawn again, and announced again,
and this is what we expect from BGP beacons.
But you can see that there are three lines here
that represent three routers that think
that this prefix is active during this time, even
though we know that the prefix was withdrawn
by RIV.
And this is what we call a BGP zombie, so here we
have three zombies.
In summary, a BGP zombie is an active entry in a
routing table that corresponds to a prefix
that is in fact withdrawn by its originators.
So in the past we've looked at these BGP zombies,
and we used BGP beacons to do that.
That was a work we published in PAL in 2019, but
it didn't really tell us anything about
the regular prefixes we're using on the internet.
And this is the goal we set for this work here,
we want to monitor BGP zombies for regular
prefixes and see if it's as bad as what we've
seen for beacons.
So for beacons, finding zombies was very easy
because we knew already when the prefix is
withdrawn and when it's announced again.
But here, because we are looking at any prefix on
the internet, we have to find out when
an originator is going to withdraw a prefix.
And to do that, we are looking at a metric, which
is the number of active routers for
a prefix.
It's shown here in that figure, so that metric
ranges between 0 and 1.
One means that all the routers we are using see
that prefix as active.
So it might decrease a bit, and there's some
noise in this metric, which means that some
routers might withdraw the prefix, there is some
topological change that can happen on
the internet that could cause this noise.
But when we see a significant drop, and it's when
things start to get interesting, is it
when the drop will go down to zero.
In this case, it means that all the routers we
are using, they all withdraw the prefix.
If it goes down and then up again, and then
stabilizes, that means there was some significant
change in the topology.
So maybe that prefix was withdrawn and then re-announced
by the same origin or a different
origin.
But what is interesting for us is to see when
there is a significant change, a significant
drop, and then this metric, the number of active
routers, is stable but at a low value.
Here it means that only a few routers didn't
withdraw that prefix.
And if it lasts for a certain time, then we're
going to say that this is a BGP zombie.
So this is our definition of the BGP zombie.
When we see the majority of the routers have
withdrawn the prefix, we're going to wait
90 minutes.
And after 90 minutes, if we see that the prefix
was not completely withdrawn, or it wasn't
re-announced, then we're going to say this is a
zombie.
You can check the paper for some of the details
why we use 90 minutes.
We have some explanation for that in the paper.
I don't have time to explain it.
So using this very simple zombie detector, we
analyzed six years of BGP data and found
6.5 million of BGP zombies.
And we looked at different things in these
zombies.
First we ran some sanity checks.
I will explain in the next slide.
And we also looked at some of the characteristics
of zombies in the wild.
One of the first sanity checks we've done is to
look at what we call the state covariance
between risk-peers.
So here's an example of a zombie that appears in
AS3.
So AS3 is reporting a pass to a certain prefix.
This pass is AS3, AS2, AS1, and AS0.
So AS3 tells us that it can reach that prefix
through these ASes.
But we have access to one of these ASes through
risk.
And that AS tells us that it has withdrawn this
prefix.
So because those two information are conflicting,
we see that the states here are incorrect.
One of the risk-peers tells us that it has a pass
to a prefix.
But on this pass, we see that one of the ASes has
actually withdrawn the prefix.
After this, Willy tells us that there is in fact
a zombie.
And it's not a misclassification.
So we use that to validate our result.
But to do that, we have to have a zombie pass
with at least two risk-peers in the AS pass.
So about 68% of the zombie pass detected have two
risk-peers.
And for this 68% of pass, we found that almost 95%
of them have incorrect states.
So that means they are really zombies.
And the rest are not really conclusive because it
could be that the two risk-peers we have
access to, both are affected by the zombie.
So we cannot really say if it's a misclassification
or not.
Another thing we looked at is where are the beacons
in our result.
And we found that the risk-BGP beacons account
for 3.2% of all the zombies we detected.
3.2% seems to be a small value, but actually it's
very big because there is only 27 risk-beacon
prefixes out of the 800,000 prefixes we have on
the internet.
So only those few prefixes have created a lot of
zombies.
And one of the questions we had then was, okay,
maybe noisier prefixes like risk-BGP
beacons are more prone to zombies.
And this is what we looked at in this figure.
We took the prefixes that had a lot of zombies
and we looked at the number of updates for
these prefixes.
You can see that as the number of updates is
increasing, the chance to have zombies
is also increasing.
One takeaway from this is that beacons are not
really representative of what we observe
for the regular prefixes.
This was especially true for IPv4.
And we also looked at zombies for popular content
networks.
So we took 42 ASN that are commonly found in the
top 15 Alexa, Umbrella, and Majestic
lists, and we looked at how many zombies they had.
Here's the ranking of this ASN over time, and you
can see that some of them had zombies
almost every month.
We did this only for two years in 2018 and 2019.
And we looked a bit more at this ASN.
We looked at a different characteristic, and what
we found was that the top ASN popular
content networks usually have also either denounced
a lot of prefixes or they have very
long ASN passlines.
And if we think about it, it kind of makes sense.
If we assume that BGP zombies are due to bugs in
routers, then a longer passline means that
it's going to imply more routers and thus more
chance to hit one of these bugs.
And finally in the paper, we looked at some of
the side effects of BGP zombies.
We found that 77,000 zombies created the tools.
For example, it would be cases where the pass
would follow backup links instead of the usual
AS pass we'd see.
And we also found that some zombies have an
origin that is different than its covering
prefix because that route is stuck, then we might
have a wrong origin as information.
I won't give the detail here, but you can look at
the paper.
In some cases, the BGP zombies can create routing
loops, and we found over 400 of potential
routing loops in our result.
I also advise you to look at this presentation
from PLNOT last year, where they give a concrete
example of routing loops and also the truss route
to show that.
Okay, so that concludes my presentation.
In this work, we look at BGP zombies for regular
prefixes.
We found that zombies are widely spread.
We found zombies for very popular content
networks.
Even though it's widely spread, it's not as bad
as what our past study using BGP beacon
was suggesting.
Also, here in this work, we find some interesting
side effects from BGP zombies.
Thank you for listening.
Thank you.