Detecting Service Disruptions in Large BGP/MPLS VPN Networks

This paper presents the result of three years of experience in research, design, and deployment of a complete architecture aimed at automatically identifying service disruptions in large BGP/MPLS VPN networks. We present the main components of a comprehensive architecture that can be operated in production environments, highlighting the requirements that led to their design. We describe the data that are collected from the network using IETF standard protocols, the processing that is performed onto them to detect anomalies, and the scaling aspects that need to be considered when ingesting the large amounts of data that is necessary for the purpose at hand. We report on two and a half years of deployment experience on the Swisscom BGP/MPLS VPN Network services, by analyzing the behavior of our system in the face of actual network incidents. After each incident, we systematically performed postmortem analyzes. These investigations led us to conclude that the rule-based approaches that are currently used in deployment, supported by a profiling of the VPN customers to fine-tune rule parameters, enables the detection of service disruptions with the required accuracy.