BGP Zombies: An Analysis of Beacons Stuck Routes

  • Romain FontugneEmail author
  • Esteban Bautista
  • Colin Petrie
  • Yutaro Nomura
  • Patrice Abry
  • Paulo Goncalves
  • Kensuke Fukuda
  • Emile Aben
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11419)


Network operators use the Border Gateway Protocol (BGP) to control the global visibility of their networks. When withdrawing an IP prefix from the Internet, an origin network sends BGP withdraw messages, which are expected to propagate to all BGP routers that hold an entry for that IP prefix in their routing table. Yet network operators occasionally report issues where routers maintain routes to IP prefixes withdrawn by their origin network. We refer to this problem as BGP zombies and characterize their appearance using RIS BGP beacons, a set of prefixes withdrawn every four hours. Across the 27 monitored beacon prefixes, we observe usually more than one zombie outbreak per day. But their presence is highly volatile, on average a monitored peer misses 1.8% withdraws for an IPv4 beacon (2.7% for IPv6). We also discovered that BGP zombies can propagate to other ASes, for example, zombies in a transit network are inevitably affecting its customer networks. We employ a graph-based semi-supervised machine learning technique to estimate the scope of zombies propagation, and found that most of the observed zombie outbreaks are small (i.e. on average 10% of monitored ASes for IPv4 and 17% for IPv6). We also report some large zombie outbreaks with almost all monitored ASes affected.


  1. 1.
  2. 2.
    Isolario Project.
  3. 3.
    RIPE NCC, Atlas.
  4. 4.
  5. 5.
    RIPE NCC, RIPEstat: BGP Looking Glass.
  6. 6.
  7. 7.
    The RouteViews Project.
  8. 8.
    AS Hegemony Results (2017).
  9. 9.
    Asturiano, V.: The Shape of a BGP Update.
  10. 10.
    Avrachenkov, K., Gonçalves, P., Legout, A., Sokol, M.: Classification of content and users in BitTorrent by semi-supervised learning methods. In: 8th International Wireless Communications and Mobile Computing Conference (IWCMC), pp. 625–630, August 2012Google Scholar
  11. 11.
    Avrachenkov, K., Mishenin, A., Gonçalves, P., Sokol, M.: Generalized optimization framework for graph-based semi-supervised learning. In: Proceedings of the 2012 SIAM International Conference on Data Mining, pp. 966–974 (2012)Google Scholar
  12. 12.
    Fontugne, R., Shah, A., Aben, E.: The (thin) bridges of AS connectivity: measuring dependency using AS hegemony. In: Beverly, R., Smaragdakis, G., Feldmann, A. (eds.) PAM 2018. LNCS, vol. 10771, pp. 216–227. Springer, Cham (2018). Scholar
  13. 13.
    Luckie, M., Dhamdhere, A., Huffaker, B., Clark, D., Claffy, K.: bdrmap: Inference of borders between IP networks. In: Proceedings of the 2016 Internet Measurement Conference, IMC 2016, pp. 381–396. ACM, New York (2016)Google Scholar
  14. 14.
    Mao, Z.M., Bush, R., Griffin, T.G., Roughan, M.: BGP beacons. In: Proceedings of the 3rd ACM SIGCOMM Conference on Internet Measurement, pp. 1–14. ACM (2003)Google Scholar
  15. 15.
    Marder, A., Smith, J.M.: MAP-IT: multipass accurate passive inferences from traceroute. In: Proceedings of the 2016 Internet Measurement Conference, IMC 2016, pp.397–411. ACM, New York (2016)Google Scholar
  16. 16.
    Orsini, C., King, A., Giordano, D., Giotsas, V., Dainotti, A.: BGPStream: a software framework for live and historical BGP data analysis. In: IMC, pp. 429–444. ACM (2016)Google Scholar
  17. 17.
    Sangli, S., Chen, E., Systems, C., Fernando, R., Scudder, J., Rekhter, Y.: Graceful restart mechanism for BGP (No. RFC 4724). Technical report (2007)Google Scholar
  18. 18.
    Subramanya, A., Bilmes, J.: Soft-supervised learning for text classification. In: Proceedings of the Conference on Empirical Methods in Natural Language Processing, pp. 1090–1099 (2008)Google Scholar
  19. 19.
    Subramanya, A., Talukdar, P.P.: Graph-Based Semi-supervised Learning. Morgan & Claypool Publishers, San Rafael (2014)CrossRefGoogle Scholar
  20. 20.
    Villamizar, C., Chandra, R., Govindan, R.: BGP route flap damping (No. RFC 2439). Technical report (1998)Google Scholar
  21. 21.
    Zhao, M., Chan, R.H.M., Chow, T.W.S., Tang, P.: Compact graph based semi-supervised learning for medical diagnosis in Alzheimer’s disease. IEEE Sig. Process. Lett. 21(10), 1192–1196 (2014)CrossRefGoogle Scholar

Copyright information

© Springer Nature Switzerland AG 2019

Authors and Affiliations

  • Romain Fontugne
    • 1
    Email author
  • Esteban Bautista
    • 2
  • Colin Petrie
    • 3
  • Yutaro Nomura
    • 4
  • Patrice Abry
    • 5
    • 6
  • Paulo Goncalves
    • 2
  • Kensuke Fukuda
    • 6
  • Emile Aben
    • 3
  1. 1.IIJ Research LabTokyoJapan
  2. 2.Univ Lyon, Ens de Lyon, Inria, CNRS, UCB Lyon 1LyonFrance
  3. 3.RIPE NCCAmsterdamNetherlands
  4. 4.The University of TokyoTokyoJapan
  5. 5.Univ Lyon, Ens de Lyon, Univ Claude Bernard, CNRS, Laboratoire de PhysiqueLyonFrance
  6. 6.NII/SokendaiTokyoJapan

Personalised recommendations