Identifying BGP routing table transfers

BGP routing updates collected by monitoring projects such as RouteViews and RIPE have been a vital source to our understanding of the global routing system. However the collected BGP data contains both the updates generated by actual route changes, and the updates of BGP routing table transfers resulted from BGP session resets between operational routers and the data collection stations. Since the latter is caused by measurement artifact, it is important to accurately separate out the latter from the former. In this paper, we present the design and evaluation of the minimum collection time (MCT) algorithm. Given a BGP update stream, MCT can identify the start and duration of each routing table transfer in the stream with high accuracy. We evaluated MCT performance by using three months of BGP data from all RIPE collectors. Our results show that out of the total 1664 BGP resets with 166 monitors, MCT can identify BGP routing table transfers with over 95% accuracy, and pinpoint the exact starting time of the detected table transfers in 83% of such cases. Accurate detection of BGP table transfers enables users to separate out real BGP routing changes and measurement artifacts, and can be used to measure and diagnose the BGP session failures. (C) 2010 Elsevier B.V. All rights reserved.