Extracting Network-Wide Correlated Changes from Longitudinal Configuration Data

  • Yu-Wei Eric Sung
  • Sanjay Rao
  • Subhabrata Sen
  • Stephen Leggett
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5448)


IP network operators face the challenge of making and managing router configuration changes to serve rapidly evolving user and organizational needs. Changes are expressed in low-level languages, and often impact multiple parts of a configuration file and multiple routers. These dependencies make configuration changes difficult for operators to reason about, detect problems in, and troubleshoot. In this paper, we present a methodology to extract network-wide correlations of changes. From longitudinal snapshots of low-level router configuration data, our methodology identifies syntactic configuration blocks that changed, applies data mining techniques to extract correlated changes, and highlights changes of interest via operator feedback. Employing our methodology, we analyze an 11-month archive of router configuration data from 5 different large-scale enterprise Virtual Private Networks (VPNs). Our study shows that our techniques effectively extract correlated configuration changes, within and across individual routers, and shed light on the prevalence and causes of system-wide and intertwined change operations. A deeper understanding of correlated changes has potential applications in the design of an auditing system that can help operators proactively detect errors during change management. To demonstrate this, we conduct an initial study analyzing the prevalence and causes of anomalies in system-wide changes.


Association Rule Data Mining Technique Correlate Change Multi Protocol Label Switching Individual Router 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Mahajan, R., Wetherall, D., Anderson, T.: Understanding BGP misconfiguration. In: SIGCOMM (2002)Google Scholar
  2. 2.
    Kerravala, Z.: Configuration management delivers business resiliency. The Yankee Group (2002)Google Scholar
  3. 3.
    Narain, S.: Network configuration management via model finding. In: LISA (2005)Google Scholar
  4. 4.
  5. 5.
  6. 6.
  7. 7.
    Le, F., Lee, S., Wong, T., Kim, H.S., Newcomb, D.: Minerals: using data mining to detect router misconfigurations. In: MineNet (2006)Google Scholar
  8. 8.
    Feamster, N., Balakrishnan, H.: Detecting BGP configuration faults with static analysis. In: NSDI (2005)Google Scholar
  9. 9.
    Feldmann, A., Rexford, J.: IP network configuration for intradomain traffic engineering. IEEE Network Magazine (2001)Google Scholar
  10. 10.
    Agrawal, R., Srikant, R.: Fast algorithms for mining association rules. In: VLDB (1994)Google Scholar
  11. 11.
    Enck, W., McDaniel, P., Sen, S., Sebos, P., Spoerel, S., Greenberg, A., Rao, S., Aiello, W.: Configuration management at massive scale: System design and experience. In: USENIX (2007)Google Scholar
  12. 12.
    Chen, X., Mao, Z.M., van der Merwe, K.: Towards automated network management: Network operations using dynamic views. In: INM (2007)Google Scholar
  13. 13.
    Gottlieb, J., Greenberg, A., Rexford, J., Wang, J.: Automated provisioning of BGP customers. IEEE Network Magazine (2003)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Yu-Wei Eric Sung
    • 1
  • Sanjay Rao
    • 1
  • Subhabrata Sen
    • 2
  • Stephen Leggett
    • 3
  1. 1.Purdue UniversityUSA
  2. 2.AT&T Labs ResearchUSA
  3. 3.AT&T Inc.USA

Personalised recommendations