IP-AS mappings

July 28th, 2010 by Amogh Dhamdhere

We have performed an analysis of the IP-AS mapping obtained from Routeviews/RIPE collectors.

A crucial step in various research efforts that study the Internet infrastructure is to map an IP address to the Autonomous System (AS) to which it is assigned. The most common approach to map IP addresses to ASes is by using BGP table dumps from public repositories such as Routeviews and RIPE. We assign “ownership” of an IP address to the AS that originates the longest BGP prefix that matches the IP address. Routeviews and RIPE, however, have multiple collectors, each of which peers with a diverse set of ASes. Consequently, the IP-AS mapping obtained by using the BGP table dump from one collector could be different from that obtained from a different collector. The obvious solution is to aggregate views from as many vantage points as possible to obtain the most complete IP-AS mapping possible. In practice, however, it is common to use data from just one or two collectors, as it greatly simplifies the process of collecting and pre-processing data. The goal of our analysis is to compare different collectors, in terms of the different metrics that we are interested in, viz. address space coverage, IP-AS mapping, unique ASes, unique prefixes, unique more specific prefixes, AS links, and AS paths. Further, we study the utility of adding data from more collectors, in terms of the resulting change in the aforementioned metrics. Finally, we compare the IP-AS mapping from Routeviews and RIPE tables with that obtained from Team Cymru’s whois service.

The figures above show the relative changes in address space coverage when we start with table dumps from Routeviews’ LINX collector (which we choose as the base table, as it provides the largest coverage of IPv4 address space of any single table in Routeviews), and successively add data from collectors in decreasing order of address space coverage. The first plot above shows that data from additional collectors results in less than 1% increase in address space coverage, and the second plot shows that additional collectors incur a change in the IP-AS mapping for fewer than 1% of addresses represented in the tables.

We repeated the same analysis for other metrics of interest – unique prefixes, unique more-specific prefixes, unique ASes, unique origin ASes, and unique AS links. We find that additional table dumps yield fewer than 1% additional (previously unseen) ASes and origin ASes, confirming previous reports that most ASes are observable from even a few vantage points. However, for other metrics, additional table dumps matter: adding a table dump can yield up to 4.8% more AS links (shown in the above figure), up to 4.6% more prefixes and 4.7% more specific prefixes than seen in the base table. Furthermore, between 10% and 70% of the more specific prefixes seen in additional table dumps are originated by a different origin AS than in the base table.

We also compared the IP-AS mapping obtained from Routeviews/RIPE table dumps with that obtained from Team Cymru’s whois service. We find that the difference between the IP-AS mapping from Cymru and that obtained by combining data from all Routeviews and RIPE collectors is small (0.7% of queried addresses returned a different origin AS). 56% of these IP-AS mismatches are due to cases where Cymru and the table dumps return a single, but different AS. A significant number (41%) of mismatches are due to Multi-Origin ASes (MOASes). In particular, 34% of IP-AS mismatches are due to MOASes where the Cymru mapping does not contain one of the ASes returned by the table dumps.

In summary, our findings are reassuring. In terms of IP-AS mapping, using data from just a few of the largest Routeviews/RIPE collectors is sufficient; adding data from more collectors does not significantly change the IP-AS mapping or coverage of IPv4 address space. Also, using data from Routeviews/RIPE is not significantly different from using Team Cymru’s whois service. In fact, in the data we compared, the combination of table dumps from all Routeviews/RIPE collectors gave a better view of MOAS prefixes than Cymru’s lookup service.

2 Responses to “IP-AS mappings”

  1. Benson Schliesser Says:

    Interesting and useful data.

    Given that none of the collectors vary significantly from your baseline, and the end result is similar to the Cymru whois data, it seems implied that the worst case variation isn’t actually that bad. Can you confirm this? For instance, if you look at each collector individually compared to Cymru whois (as opposed to comparing the complete table, based on successively added collector data) what is the worst-case variation?

  2. amogh Says:

    Hi Benson,

    Thanks for the interest. I took a look at the difference between Cymru and the routing table dump from each collector individually (without combining data from any collectors). It is indeed the case that the worst-case variation is small. The largest difference I saw was 0.7% between Cymru and the Routeviews collector at WIDE. I excluded the Routeviews collector at KIXP for this analysis, as that collector does not seem to be carrying a full table.

    Amogh

Leave a Reply