|
|
|
@ -1,7 +1,7 @@
|
|
|
|
|
\chapter{Analysis}\label{ch:analysis}
|
|
|
|
|
|
|
|
|
|
In order to avoid as many problems as possible when visualising and
|
|
|
|
|
analysing a OSPF topology, we need to understand several aspects of networking,
|
|
|
|
|
analysing an OSPF topology, we need to understand several aspects of networking,
|
|
|
|
|
the OSPF protocol and its implementation in BIRD. However, the aim of this
|
|
|
|
|
thesis is not to be a complete guide to OSPF nor BIRD, therefore, for the sake
|
|
|
|
|
of brevity, we skip many details which do not influence our project.
|
|
|
|
@ -15,7 +15,7 @@ BIRD routing daemon.
|
|
|
|
|
|
|
|
|
|
OSPF~\cite{rfc2328,rfc5340} is a link-state routing protocol, which means that routers try to understand
|
|
|
|
|
the whole topology of the network and find the best path using an algorithm for
|
|
|
|
|
finding the shortest paths. Usually, Dijkstra's algorithm \X{ref?} is used.
|
|
|
|
|
finding the shortest paths. Usually, Dijkstra's algorithm is used.
|
|
|
|
|
OSPF was designed to provide dynamic routing in an entire autonomous system, but
|
|
|
|
|
running it on a much smaller scale is also possible.
|
|
|
|
|
|
|
|
|
@ -25,7 +25,7 @@ contain information about which network segments are incident to which
|
|
|
|
|
router on which interfaces and with which routers it is possible to communicate
|
|
|
|
|
on those interfaces. To distinguish between routers, each router is assigned a
|
|
|
|
|
32-bit number called \emph{Router ID} by the network administrator.
|
|
|
|
|
Router IDs are usually written in a quad-dotted notation \X{glos}.
|
|
|
|
|
Router IDs are usually written in a quad-dotted notation.
|
|
|
|
|
|
|
|
|
|
The LSAs are flooded throughout the system in order to let all the routers know
|
|
|
|
|
about the current topology. To avoid overloading the system just with this
|
|
|
|
@ -43,7 +43,7 @@ The area 0.0.0.0 is called the \emph{backbone area} and all other areas must be
|
|
|
|
|
incident to it, so that it has all the routing information. When this is
|
|
|
|
|
impractical, OSPF allows two routers to be connected using a \emph{virtual
|
|
|
|
|
link}. From the routing perspective, this is a point-to-point connection
|
|
|
|
|
between the routers in the backbone area. which allows to forward LSAs through
|
|
|
|
|
between the routers in the backbone area, which allows to forward LSAs through
|
|
|
|
|
other areas even when these LSAs would not normally leave those areas.
|
|
|
|
|
|
|
|
|
|
There are several types of networks that emerge in OSPF topologies. The
|
|
|
|
@ -77,48 +77,48 @@ implemented). There are no edges starting at the external, extra-area or stub
|
|
|
|
|
networks, so that the shortest path DAG calculation does not find paths
|
|
|
|
|
through them.
|
|
|
|
|
|
|
|
|
|
The cost of the edge to an external network can be of two types. Type 1 cost is
|
|
|
|
|
specified in the same units as the internal costs, Type 2 cost is larger than
|
|
|
|
|
any internal or type 1 cost.
|
|
|
|
|
The cost of the edge to an external network can be of two types. A type~1 cost
|
|
|
|
|
uses the same units as the internal costs, whereas any type~2 cost is larger than
|
|
|
|
|
all internal or type~1 costs.
|
|
|
|
|
|
|
|
|
|
The OSPF family of routing protocols has undergone long evolution since the
|
|
|
|
|
first specification in 1989~\cite{rfc1131}, There are currently two versions of
|
|
|
|
|
first specification in 1989~\cite{rfc1131}. There are currently two versions of
|
|
|
|
|
the protocol in use -- versions 2 and 3. While the basic idea is still the
|
|
|
|
|
same, OSPFv2 can only handle IPv4 systems. Although OSPFv3 claims to be
|
|
|
|
|
network-protocol-independent, it is usually only used with IPv6 systems and in
|
|
|
|
|
network-protocol-independent, it is usually only used with IPv6 systems and, in
|
|
|
|
|
fact, features like virtual links can only be used with that network
|
|
|
|
|
protocol~\cite{rfc5838}.
|
|
|
|
|
|
|
|
|
|
Both OSPF versions have numerous extensions, as can be seen by the number of
|
|
|
|
|
RFCs that update the base specifications~\cite{rfc2328,rfc5340}. Therefore, we
|
|
|
|
|
do not implement the protocol ourself, but rather find a suitable routing
|
|
|
|
|
daemon \X{glos} to determine the current topology.
|
|
|
|
|
daemon to determine the current topology for us.
|
|
|
|
|
|
|
|
|
|
Many improvements of the protocol only affect the topology construction (e.g.
|
|
|
|
|
NSSA areas~\cite{rfc3101}) or change the data exchange between routers
|
|
|
|
|
(Multi-instance extensions~\cite{rfc6549}, authentication~\cite{rfc5709}, \dots).
|
|
|
|
|
(multi-instance extensions~\cite{rfc6549}, authentication~\cite{rfc5709}, \dots).
|
|
|
|
|
By extracting the topology from a routing daemon, we can support many OSPF
|
|
|
|
|
extensions for free. For this reason, it is mostly sufficient to only consider
|
|
|
|
|
the base specifications of OSPF.
|
|
|
|
|
|
|
|
|
|
\section{Routing daemon selection}
|
|
|
|
|
|
|
|
|
|
While we were mostly determined to use BIRD~\cite{bird} from the start, since we already
|
|
|
|
|
While we were mostly determined to use BIRD~\cite{bird} from the start, because we already
|
|
|
|
|
had some experience with it, let us present here a short summary of other
|
|
|
|
|
possibilities. Note that the particular choice does not affect interoperability
|
|
|
|
|
with other routers as long as the chosen routing daemon supports extensions
|
|
|
|
|
used in the network system.
|
|
|
|
|
|
|
|
|
|
There are several implementations of both versions of the OSPF protocol.
|
|
|
|
|
However, many of them are tied to the specific router hardware, which makes it
|
|
|
|
|
impractical to connect to a graphical visualisation. Moreover, even evaulating
|
|
|
|
|
However, many of them are tied to the specific router hardware, which makes them
|
|
|
|
|
impractical to connect to a graphical visualisation. Moreover, even evaluating
|
|
|
|
|
the feasibility would require us to obtain the specific hardware. Therefore, we
|
|
|
|
|
only consider hardware-independent solutions.
|
|
|
|
|
|
|
|
|
|
While we are aware of several software implementations, many of these do not
|
|
|
|
|
seem to be developed anymore (Quagga~\cite{quagga}, XORP~\cite{xorp},
|
|
|
|
|
OpenOSPFd~\cite{openospfd}). Apart from BIRD, we only found FRRouting~\cite{frr}
|
|
|
|
|
to be maintained, meaning that it had a release in the past year. While being
|
|
|
|
|
to be maintained, meaning that a new version has been released in the past year. While being
|
|
|
|
|
maintained is not a strict requirement, it would allow us to use that
|
|
|
|
|
implementation in case OSPF is extended again.
|
|
|
|
|
|
|
|
|
@ -132,15 +132,15 @@ line-based protocol slightly resembling SMTP. The client may send
|
|
|
|
|
commands to the daemon, which provides responses. The response may be long and
|
|
|
|
|
possibly formatted into a table. This interface is primarily aimed at human
|
|
|
|
|
users, so a rather simple client, \texttt{birdc}, is provided in the BIRD's
|
|
|
|
|
package\X{glos?}.
|
|
|
|
|
package.
|
|
|
|
|
|
|
|
|
|
While there is a note of a machine-readable protocol in the
|
|
|
|
|
\texttt{doc/roadmap.md} file in BIRD's source code~\cite{bird-src}, it is not
|
|
|
|
|
\texttt{doc/roadmap.md} file in BIRD's source code~\cite{bird-src}, it has not been
|
|
|
|
|
implemented, so we will need to interface using the socket. This has following
|
|
|
|
|
consequences, most of which are not very pleasant:
|
|
|
|
|
|
|
|
|
|
\begin{itemize}
|
|
|
|
|
\item The responses to different formats often have completely different
|
|
|
|
|
\item The responses to different commands often have completely different
|
|
|
|
|
formats. This necessitates creating a dedicated parsing routines for each kind
|
|
|
|
|
of command we want to use.
|
|
|
|
|
\item There is no guarantee that the output will not change between versions.
|
|
|
|
@ -156,20 +156,20 @@ BIRD provides only a few commands that deal with OSPF:
|
|
|
|
|
|
|
|
|
|
\begin{itemize}
|
|
|
|
|
\item \texttt{show ospf} shows a simple summary of the running instances of
|
|
|
|
|
OSPF, like which areas are they in or how many LSAs does BIRD currently
|
|
|
|
|
OSPF, like which areas are they incident to or how many LSAs does BIRD currently
|
|
|
|
|
consider.
|
|
|
|
|
\item \texttt{show ospf interface} describes a current status of the individual
|
|
|
|
|
\item \texttt{show ospf interface} describes the current status of the individual
|
|
|
|
|
local interfaces: their configuration, designated routers for the incident
|
|
|
|
|
network, etc.
|
|
|
|
|
\item \texttt{show ospf neighbors} provides details about the state of
|
|
|
|
|
communication with adjacent routers.
|
|
|
|
|
\item \texttt{show ospf lsadb} returns details about known LSAs. Unfortunately,
|
|
|
|
|
communication with neighbour routers.
|
|
|
|
|
\item \texttt{show ospf lsadb} returns the details about known LSAs. Unfortunately,
|
|
|
|
|
this contains low-level information like checksums and sequence numbers,
|
|
|
|
|
but not details about networks or routers.
|
|
|
|
|
\item \texttt{show ospf state} shows an overal view of the ospf graph
|
|
|
|
|
\item \texttt{show ospf state} shows an overall view of the OSPF graph
|
|
|
|
|
representation: present routers and networks, costs of links, distances, \dots
|
|
|
|
|
\item \texttt{show ospf topology} seems to only provide a subset of the output
|
|
|
|
|
of \texttt{show ospf state}. For example, it does not provide info about
|
|
|
|
|
of \texttt{show ospf state}. For example, it does not provide information about
|
|
|
|
|
any non-transit networks.
|
|
|
|
|
\end{itemize}
|
|
|
|
|
|
|
|
|
@ -184,14 +184,14 @@ Let us look in depth at the \texttt{show ospf state} command, since we will be
|
|
|
|
|
using it and the format of its output a lot.
|
|
|
|
|
|
|
|
|
|
The command has two optional parameters. First, the flag \texttt{all} may be
|
|
|
|
|
added to show details not only the reachable part of the system, but from all
|
|
|
|
|
added to show details not only about the reachable part of the system, but from all
|
|
|
|
|
the known and non-expired LSAs. The difference between the topologies can be
|
|
|
|
|
used to discover network problems even without configuring the expected state.
|
|
|
|
|
|
|
|
|
|
The second parameter is a name of the OSPF instance. It is only required when
|
|
|
|
|
BIRD is running multiple instances simultaneously. This is unfortunately quite
|
|
|
|
|
common, because in dual-stack\X{glos} systems there needs to be a separate
|
|
|
|
|
instance of OSPF configured for each IP version.
|
|
|
|
|
common, because in dual-stack systems there need to be two separate
|
|
|
|
|
instances of OSPF, each configured for different IP version.
|
|
|
|
|
|
|
|
|
|
The output of the command is a tree of lines representing the topology itself.
|
|
|
|
|
Children of a directive are indented by one more tab. An example output is
|
|
|
|
@ -223,7 +223,7 @@ area 0.0.0.1
|
|
|
|
|
The tree as output by BIRD\footnote{The format was determined by
|
|
|
|
|
experimentation and inspecting of \texttt{proto/ospf/ospf.c} in BIRD's source
|
|
|
|
|
code~\cite{bird-src}.} has three levels, we call them top-level, level-2
|
|
|
|
|
and level-3. The top level only contains directives of form \texttt{area
|
|
|
|
|
and level-3. The top level only contains directives of the form \texttt{area
|
|
|
|
|
AreaID}, with the AreaID being written in the quad-dotted notation.
|
|
|
|
|
|
|
|
|
|
On level-2 are mentioned all the routers and networks in the area. This is
|
|
|
|
@ -240,7 +240,7 @@ There is also a level-3 line for each incident host and network. Overview of
|
|
|
|
|
the \uv{tags} (the first words) and parameters is provided by
|
|
|
|
|
table~\ref{tab:ospf-incidences}. Note that networks can only be incident to
|
|
|
|
|
routers, while routers may be incident to anything. The incidences of routers
|
|
|
|
|
have also a metric, after the word \texttt{metric}, or, in case of Type 2
|
|
|
|
|
have also a metric, after the word \texttt{metric}, or, in case of type 2
|
|
|
|
|
external cost, \texttt{metric2}.
|
|
|
|
|
|
|
|
|
|
\begin{table}[h]
|
|
|
|
@ -278,7 +278,7 @@ incidence line for object B in a level-2 block of object A, there exists an
|
|
|
|
|
edge from A to B in the topology used by the Dijkstra's algorithm. This fact
|
|
|
|
|
will later simplify parsing.
|
|
|
|
|
|
|
|
|
|
\section{Test network system: Gennet}
|
|
|
|
|
\section{Test network system: Gennet}\label{s:gennet}
|
|
|
|
|
|
|
|
|
|
To help test Birdvisu and understand network behaviour, we created a simple set
|
|
|
|
|
of scripts called Gennet. Sice it was mainly written to aid Birdvisu, we
|
|
|
|
@ -287,7 +287,7 @@ provide it as attachment~\ref{att:gennet} of this thesis.
|
|
|
|
|
Gennet is a network generator. Using a hard-coded configuration and a set of
|
|
|
|
|
Jinja2~\cite{jinja2} templates, it provides a semi-automatic way of
|
|
|
|
|
creating several virtual machines (their disk images and startup scripts) and
|
|
|
|
|
configuration to connect them using software bridges\X{term?}. This will allow
|
|
|
|
|
configuration to connect them using software bridges. This will allow
|
|
|
|
|
changing the state from the host operating system, simulating various network
|
|
|
|
|
conditions.
|
|
|
|
|
|
|
|
|
@ -295,7 +295,7 @@ We fully admit that Gennet is really just a quick hack. However, since it was
|
|
|
|
|
created specifically to aid the development of Birdvisu and because it provides
|
|
|
|
|
a reproducible environment, we think it makes sense to attach it to this thesis. The
|
|
|
|
|
particular choice of technologies (Jinja2, Python, Bash, QEMU and Alpine
|
|
|
|
|
Linux)\X{refs!} is driven solely by our previous experience with them and
|
|
|
|
|
Linux) is driven solely by our previous experience with them and
|
|
|
|
|
should not affect the behaviour of the generated system in any way.
|
|
|
|
|
|
|
|
|
|
%Gennet is used as follows: the user must first generate a base Linux image,
|
|
|
|
@ -351,7 +351,7 @@ We focus on behaviour of BIRD in following scenarios:
|
|
|
|
|
\item Network split: Hosts in the same network stop being able to
|
|
|
|
|
communicate with some other host in the same network. This is often
|
|
|
|
|
caused by a broken cable or switch malfunction.
|
|
|
|
|
\item Multiple links to same networks: It might make sense to connect a
|
|
|
|
|
\item Multiple links to the same network: It might make sense to connect a
|
|
|
|
|
single router to the same network using multiple links, possibly with
|
|
|
|
|
different costs. This provides redundancy and helps e.g. avoid network
|
|
|
|
|
splits.
|
|
|
|
@ -368,8 +368,8 @@ depending on the version of OSPF.
|
|
|
|
|
Network splits are of particular interest to administrators. Not only are they
|
|
|
|
|
symptoms of a broken part of the infrastructure, but also every netsplit
|
|
|
|
|
inherently means that some addresses from the split network can not be reached
|
|
|
|
|
by some hosts, because there is no hint, to which segment a packet
|
|
|
|
|
should be delivered.
|
|
|
|
|
by some hosts, because there is no hint which segment a packet
|
|
|
|
|
should be delivered to.
|
|
|
|
|
|
|
|
|
|
Splits can also be tricky to spot from systems using topology-unaware approaches,
|
|
|
|
|
because if a link connecting two switches fails, all ports on hosts are still
|
|
|
|
|