TMA 2014, 6th International Workshop on Traffic Monitoring and Analysis, 14 April 2014, London, UK / Also published in LNCS 8406/2014
An IP prefix can be announced on the Internet from multiple endpoints, possibly leading to so-called MOAS (Multiple-Origin AS) prefixes. Long-lived MOASes are traditionally considered
to be the result of network topology engineering such as prefix multihoming. Short-lived MOAS are commonly attributed to be the result of router misconfigurations. In this article, we look at MOAS prefixes in the long term and seek the patterns behind these situations. We first revisit previous work by looking at the duration of MOAS events. We group these events according to the prefix announced and show that shortlived MOASes are not due to misconfigurations, but to origin instability or route flapping. We also identify topology patterns that result in MOAS prefixes and use them to classify these events. We show that, contrary to popular belief, multihoming is neither the main use case leading to MOAS, nor the most popular pattern. Finally, we look at the evolution of these observations by analysing data collected 10 years apart.
Type:
Conférence
City:
London
Date:
2014-04-14
Department:
Sécurité numérique
Eurecom Ref:
4254
Copyright:
© Springer. Personal use of this material is permitted. The definitive version of this paper was published in TMA 2014, 6th International Workshop on Traffic Monitoring and Analysis, 14 April 2014, London, UK / Also published in LNCS 8406/2014 and is available at : http://dx.doi.org/10.1007/978-3-642-54999-1_11
See also:
