Implementation Of BGP Packets Collection And Reconstruction System Based On Traffic Analysis

BGP,as an inter-domain routing protocol,plays an important role in the complex Internet environments.Since BGP lacks of the authentication of source or path,anomaly events such as hijacking and outage will occur when BGP routes are under attack or misconfigured,which affects the performance of the internet and services seriously.Collecting BGP packets becomes extremely important as the anomaly events can be detected and located by analyzing the BGP update packets.Previous studies of collecting BGP data are mainly based on simulating BGP routes and cloning BGP traffic.The former can only collect the Loc-RIB information while the latter can collect both Adj-RIBs-In and Adj-RIBs-Out information.These collecting methods have failed to reconstruct the Adj-RIBs-In and Adj-RIBs-Out tables by traffic collecting.Furthermore,it can not support scalability,dumping multiple data,online retrieval and monitoring at the same time.Based on the previous problems,this paper proposed a Peer-Routing-Studying module for reconstructing the BGP peers net,Adj-RIBS-In and Adj-RIBs-Out tables by traffic mirroring.Firstly,by cloning the BGP traffic,this system has implemented the collecting and analysis of the BGP traffic.Secondly,the Peer-Routing-Studying module implemented the reconstruction and storage of the BGP peers net,Adj-RIBs-In and Adj-RIBs-Out tables by analyzing the BGP traffic data.Meanwhile,the system provided some interfaces for retrieving the routing information and the statistic of the traffic information,dumping the offline data with MRT format and the real-time data with the XML format.Finally,this system was tested by a simulating BGP network,which has proved the reliability and the scalability of the system.And it is also proved that the IPv4 and IPv6 addresses are all supported in the system.