BGPViewer: Using Graph representations to explore BGP routing changes

Abstract

This paper presents BGPViewer, a scheme for visualizing and exploring BGP routing changes. BGPViewer provides two graph based views of the routing changes: AS-view and Country-View. The AS-view utilizes a graph representation of the Internet on per Autonomous System (AS) level, where each node of the graph represents an AS, while the existence of an edge illustrates connectivity between two ASes. By analyzing the BGP announcements from one monitoring point, BGPViewer is able to calculate the amount of traffic change that occurred on a specific, user defined time window. The calculated traffic change refers to the change in each AS prefix ownership, and the change in the number of prefixes used by each link of the graph. Afterwards this information is mapped onto the size of the nodes and the width of the edges of the graph. Furthermore, color is used to illustrate the sign of the traffic change, where red represents negative and green positive change. In addition, the Country-View provides an abstract view by illustrating the same information on a Country level, and aggregating all the ASes that have the same Country of origin together. Thus, the nodes of the graph of the Country-View illustrate Countries, while the edges connectivity between countries. Experimental demonstration of the BGPViewer scheme in real BGP events, demonstrates the analytical power of the proposed approach.