Avoiding traceroute anomalies with Paris Traceroute

1
Avoiding traceroute anomalies with Paris
Traceroute

• Brice Augustin
• (Université Pierre et Marie Curie-LIP6/CNRS)
• Xavier Cuvellier, Timur Friedman, Renata Teixeira
  
• (Université Pierre et Marie Curie-LIP6/CNRS)
• Fabien Viger, Benjamin Orgogozo, Matthieu Latapy
• (Université Denis Diderot-LIAFA/CNRS)
• Clémence Magnien
• (Ecole Polytechnique-CREA/CNRS)

2
Problem ?

• Identified traceroute deficiencies on load
  balanced paths
• Measured paths are inaccurate and incomplete
• False diamonds, false loops and false cycles
• Built a new traceroute Paris traceroute

3
Traceroute under load balancing
Actual topology
A
C
Dst
E
Src
L
TTL 2
B
D
TTL 3
Inferred topology
A
C
False link
Dst
E
Src
L
D
B
Missing nodes and links
4
Anomalies happen even under per-flow load
balancing
Port 2
Flow 1
A
C
Port 1
Dst
E
Src
L
TTL 2
Port 3
B
D
TTL 1
TTL 3

• Traceroute uses the destination port as
  identifier
• Per-flow load balancers use the destination port
  as part of the flow identifier

5
Paris traceroute

• Solves the problem with per-flow load balancing
• Probes to a destination belong to same flow
• How to identify probes?
• Use the UDP checksum
• Does not address per-packet load balancing

Checksum 3
Checksum 2
Port 1
Port 1
A
C
Checksum 1
Port 1
Dst
E
Src
L
TTL 2
TTL 3
B
D
TTL 1
6
Anomalies false loops and cycles
TTL 3
A
Actual topology
Src
Dst
L
D
B
C
TTL 4
TTL 2
Inferred topology
Src
Dst
L
D
B
7
Anomalies false diamonds
A
C
Actual topology
Dst
E
Src
L
B
D
Inferred topology
A
C
Dst
E
Src
L
D
B
8
Measurement artifacts are common
From our LIP6 vantage point

• Diamonds appear in 30 of the destinations
• Paris traceroute removes 10,662 from 19,159 (56)
• Loops appear in 4.5 of the measured routes
• Paris traceroute removes 5,047 from 5,795 (87)
• Cycles appear in 0.25 of the measured routes
• Paris traceroute removes 3,886 from 5,674 (68)
• Other causes
• Routing changes
• NAT boxes
• Buggy routers
• Per-packet load balancing

9
AnomaliesLoops caused by buggy routers
-bash traceroute Dst traceroute to Dst 1 B
0.289 ms 2 B 0.278 ms 3 Dst 0.578 ms
Dst
Src
A
B
X
Forwards the probe with TTL equal to 0
Rejects the probe with a TTL of 0 and sends it
back to the source
TTL 1
TTL 2
TTL 1
Rejects the probe with a TTL of 0 and sends it
back to the source
Forwards the probe with TTL equal to 0
-bash traceroute-paris Dst traceroute to Dst 1
B 0.289 ms !T0 2 B 0.278 ms 3 Dst
0.578 ms
Src
Dst
B
10
AnomaliesLoops caused by NAT boxes
Response TTL 254 IP Identifier 12375
Response TTL 252 IP Identifier 9356

Dst (NAT)
Src
B
C
A
Dst
B
TTL 2
TTL 3
TTL 3
Response TTL 253 IP Identifier 5286
2
Dst
Src
A
11
Conclusion

• Classic traceroute leads to anomalies
• False diamonds, false loops and false cycles
• Per-flow load balancers cause most of the
  anomalies
• Paris traceroute reports more precise paths

12
More information
www.paris-traceroute.net