A Longitudinal Study of BGP MOAS Prefixes

Quentin Jacquemart (1) , Guillaume Urvoy-Keller (2) , Ernst Biersack (1)

1 Eurecom [Sophia Antipolis]
2 UNS - Université Nice Sophia Antipolis (1965 - 2019)

An IP prefix can be announced on the Internet from multiple endpoints, possibly leading to so-calledMOAS (Multiple-Origin AS) prefixes. Longlived MOASes are traditionally considered to be the result of network topology engineering such as prefix multihoming. Short-lived MOAS are commonly attributed to be the result of router misconfigurations.In this article, we look atMOAS prefixes in the long term and seek the patterns behind these situations. We first revisit previous work by looking at the duration of MOAS events. We group these events according to the prefix announced and show that short-lived MOASes are not due to misconfigurations, but to origin instability or route flapping.We also identify topology patterns that result inMOAS prefixes and use them to classify these events. We show that, contrary to popular belief, multihoming is neither the main use case leading to MOAS, nor the most popular pattern. Finally, we look at the evolution of these observations by analysing data collected 10 years apart.

Domaines: Informatique [cs]; Réseaux et télécommunications [cs.NI]

Quentin Jacquemart, Guillaume Urvoy-Keller, Ernst Biersack. A Longitudinal Study of BGP MOAS Prefixes. 6th International Workshop on Traffic Monitoring and Analysis (TMA), Apr 2014, London, United Kingdom. pp.127-138, ⟨10.1007/978-3-642-54999-1_11⟩. ⟨hal-01396480⟩