Thomas Holterbach

BGP data collected from operational routers by platforms such as RIPE RIS or RouteViews is essential to address connectivity issues and analyze the global Internet's structure. However, the vast and ever-growing volume of this data makes deriving useful insights challenging: Existing APIs and dashboards offer limited perspectives, while analyzing large archives of MRT files is slow and cumbersome. We present ChatBGP, a domain-specific chatbot that turns plain-English questions about BGP data into Python code that runs swiftly and returns accurate answers. ChatBGP is enabled by four contributions: (i) a measurement study showing that BGP data is highly redundant and therefore highly compressible; (ii) a database scheme that exploits this redundancy to compress BGP data while enabling fast retrieval of specific data elements; (iii) an expressive API that exposes this database through a simple interface; and (iv) a prompt-engineering scheme that guides ChatGPT to synthesize optimized Python code that uses this API to accurately answer user queries, while retrieving only the data needed to answer each query. With ChatBGP, gaining insights into BGP data becomes effortless and significantly faster—e.g., delivering results in seconds instead of hours with existing tools. Network operators can rapidly diagnose connectivity issues, including security threats, researchers can analyze larger datasets while improving reproducibility, and students can engage with BGP monitoring in a more intuitive and interactive way.

BGP data collection platforms as currently architected face fundamental challenges that threaten their long-term sustainability. Inspired by recent work, we analyze, prototype, and evaluate a new optimization paradigm for BGP collection. Our system scales data collection with two components: analyzing redundancy between BGP updates and using it to optimize sampling of the incoming streams of BGP data. An appropriate definition of redundancy across updates depends on the analysis objective. Our contributions include: a survey, measurements, and simulations to demonstrate the limitations of current systems; a general framework and algorithms to assess and remove redundancy in BGP observations; and quantitative analysis of the benefit of our approach in terms of accuracy and coverage for several canonical BGP routing analyses such as hijack detection and topology mapping. Finally, we implement and deploy a new BGP peering collection system that automates peering expansion using our redundancy analytics, which provides a path forward for more thorough evaluation of this approach.

Dramatic growth in Internet connectivity poses a challenge for the resource-constrained data collection efforts that support scientific and operational analysis of interdomain routing. Inspired by tradeoffs made in other disciplines, we explore a fundamental reconceptualization to how we design public BGP data collection architectures: an overshoot-and-discard approach that can accommodate an order of magnitude increase in vantage points by discarding redundant data shortly after its collection. As defining redundant depends on the context, we design algorithms that filter redundant updates without optimizing for one objective, and evaluate our approach in terms of detecting two noteworthy phenomena using BGP data: AS-topology mapping and hijacks. Our approach can generalize to other types of Internet data (e.g., traceroute, traffic). We offer this study as a first step to a potentially new area of Internet measurement research.

It is a challenge to select the most appropriate vantage points in a measurement platform with a wide selection. RIPE Atlas [2], for example currently has over 9600 active measurement vantage points, with selections based on AS, country, etc. A user is limited to how many vantage points they can use in a measurement. This is not only due to limitations the measurement platform imposes, but data from a large number of vantage points would produce a large volume to analyse and store. So it makes sense to optimize for a minimal set of vantage points with a maximum chance of observing the phenomenon in which the user is interested. Network operators often need to debug with only limited information about the problem (\"Our network is slow for users in France!\"). doing a minimal set of measurements that would allow testing through a wide diversity of networks could be a valuable add-on to the tools available to network operators. Given platforms with numerous vantage points, we have the luxury of testing a large set of end-customer outgoing paths. A diversity metric would allow selection of the most dissimilar vantage points, while exploring from as diverse angles as possible, even with a limited probing budget. If one finds an interesting network phenomenon, one could use the similarity metric to advantage by selecting the most similar vantage points to the one exhibiting the phenomenon, to validate the phenomenon from multiple vantage points. We propose a novel means of selecting vantage points, not based on categorical properties such as origin AS, or geographic location, but rather on topological (dis)similarity between vantage points. We describe a similarity metric across RIPE Atlas probes, and show how it performs better for the purpose of topology discovery than the default probe selection mechanism built into RIPE Atlas.