Internet routing anomaly detection and visualization

Diagnosing inter-domain routing problems in the Internet is hard. BGP, the defacto inter-domain glue, is designed for routing, not diagnosis. It is extremely chatty - the most minor connectivity change produces hundreds of BGP messages and a major peering loss can generate millions - and making sense of the deluge of data remains challenging. We have developed statistical techniques to extract the large-scale structure of BGP events and visualization techniques to display that structure in operationally meaningful ways. These tools can be used to detect routing anomalies in real-time. We show case studies of routing instabilities at a Tier-1 ISP and a large institutional network, automatically diagnosed by our tools. We present drawbacks in using BGP events alone to understand inter-domain routing, and discuss how to solve them through the integration of additional data sources.