Routing Information Proto col in HOLSPIN Karthikeyan Bhargavan Carl A Gunter and Davor Obradovic UniversityofPennsylvania Abstract Weprovide a pro of using HOL and SPIN of convergence for the Routing Information Proto col RIP an internet proto col based on distance vector routing We also calculate a sharp realtime b ound for this convergence This extends existing results to deal with the RIP standard itself which has complexities not accounted for in theorems ab out ab stract versions of the proto col Our work also provides a case study in the combined use of a higherorder theorem prover and a mo del checker The former is used to express abstraction prop erties and inductions and structure the highlevel pro of while the latter deals eciently with case analysis of nitary prop erties Intro duction The high connectivity on which the Internet relies is enabled by scalable and robust proto cols that enable routers connecting dierent physical networks to forward packets toward destinations describ ed in a uniform addressing system The rst Internet routing proto cols were based on distance vector routing which uses information ab out distance and direction to a destination to route packets The rst such proto col standardized by the Internet Engineering Task Force IETF was the Routing Information Proto col RIP and this proto col remains in widespread use to day Although the correctness of distance vector routing has b een proved for theoretical versions of the algorithm the RIP standard itself has never b een proved to have some of the prop erties it is exp ected to p ossess Since there exist nontrivial dierences between the abstract version and the standard itself pro ofs of some key prop erties of the standard are worthwhile In this pap er we carry out the pro of of convergence using a combination of the HOL higherorder theorem prover and the SPIN mo del checker The automated assistance reduces the burden of case analysis in parts of the standard where manual analysis would prove tedious Moreover the HOLSPIN pro of provides high condence for RIP and insights into the techniques needed to address other routing proto cols most of which are more complex than RIP Routing proto cols are meant to b e robust with resp ect to failures of links and routers If there is a failure then the routers communicate this information and routing tables are up dated to route around the failed link or router This pro cess takes some time since routers cannot p ossess instantaneous global knowledge Email addresses bkarthiksaulcisupennedu guntercisupennedu davorsaulcisupennedu of network characteristics They therefore pass information that is incomplete and if the proto col has the rightcharacteristics they eventually converge on a suitable set of alternative routes We have two results we show that the RIP proto col will converge after a failure and we calculate a sharp realtime b ound on the time this will take as a function of the radius of the network Both results are based on assumptions ab out network reliability and timing assumptions sp ecied in the RIP proto col The rst pro of concerns the convergence of the asynchronous distributed BellmanFord proto col as sp ecied in the IETF RIP standard The classic pro of of a pure form of the proto col is given in Our result covers additional features included in the standard to improve realtime resp onse times eg split horizons and p oison reverse These features add additional cases to b e consid ered in the pro of but the automated supp ort reduces the impact of this complex ity Adding these extensions makes the theory b etter match the standard and hence also its implementations Our pro of also uses a dierent technique from the one in providing some noteworthy prop erties ab out network stability Our second pro of provides a sharp realtime convergence b ound on RIP in terms of the radius of the network around its no des In the worst case the BellmanFord proto col has a convergence time as bad as the number of nodes in the network However if the maximum number of hops any source needs to traverse to reach a destination is k the radius around the destination and there are no link changes then RIP will converge in k timeout intervals for this destination From our rst pro of of convergence it is easy to see that this o ccurs within k intervals but the pro of of the sharp b ound of k is complicated by the numb er of cases that need to b e checked weshowhow to use automated supp ort to do this verication based on the approach develop ed in the previous case study supplemented byanewinvariant Thus if a network has a maximum radius of around each of its destinations then it will converge in at most intervals even if the network has no des Assuming the timing intervals in the RIP standard such a network will converge within minutes if there are no link changes The basis of our verication is the RIP standard Early implementations of distance vector routing were incompatible so all of the routers running RIP in a domain needed to use the same implementation Users and implementors were led to correct this problem byproviding a sp ecication that would dene precise proto cols and packet formats leading to the rst version of the standard In time this standard was revised to a second version Atthelevel of abstraction we use here our pro of is applicable to b oth of these versions There havebeena variety of successful formal studies of communication pro to cols However most of the studies to date havefocusedon endpoint proto cols that is proto cols b etween pairs of hosts using mo dels that involvetwo or three pro cesses representing the endp oints or the endp oints and an adversary for instance Studies of routing proto cols must have a dierentavor since a pro of that works for two or three routers is not interesting unless it can b e general ized Routing proto cols generally have the following attributes which inuence the way formal verication techniques can b e applied An essentially unb ounded numb er of replicated simple pro cesses execute concurrently Dynamic connectivity is assumed and fault tolerance is required Pro cesses are reactive systems with a discrete interface of mo dest complexity Real time is imp ortant and many actions are carried out with some timeout limit or in resp onse to a timeout Most routing proto cols have other attributes such as latencies of information ow limiting for example the feasibility of a global concept of time and the need to protect network resources These attributes sometimes make the proto cols more complex For instance the asynchronous version of the BellmanFord proto col is much harder to prove correct than the synchronous version and the RIP standard is still harder to prove correct b ecause of the addition of complicating optimizations intended to reduce latencies Following this intro duction wegive a description of the Routing Information Proto col as sp ecied in its standard We then describ e our formalization of RIP in HOL and SPIN In the fourth and fth sections we show the convergence of RIP and derive a sharp realtime b ound for the convergence In the sixth section weprovide some analysis of our metho dology including a discussion of the b enets of automation and some crude measurements of the complexityof the pro ofs as viewed by the automated to ols and the p erson carrying out the verication resp ectively Our nal section summarizes the conclusions Routing Information Proto col The RIP proto col sp ecication is given in and a go o d exp osition can b e found in Westartby describing the general networking environment and the task of a routing proto col Then wegive a brief description of the RIP proto col including its pseudo co de App endices A A Finallywe discuss dierences between the standard and the underlying theory and the way they aect proto col requirements Routing in Internetworks An internet is a family of networks connected by routers Figure illustrates an internetwork with four networks shown as clouds and four routers shown as black squares The goal of the routers is to forward packets b etween hosts shown as circles that are attached to the networks The routers use routing tables which they develop through running a distributed routing protocolPackets from hosts travel in hops across networks linked by routers Each router cho oses a link on whichtoforward the packet based on the packets destination address and other parameters In order to b e able to make good forwarding decisions routers need to maintain partial top ology information in the routing tables n1 i1 r1 i3 r4 h1 n3 n4 h2 i2 r2 r3 n2 Fig An Internet The aim of a routing proto col is to establish a pro cedure for up dating these tables In most cases routing information can be exchanged only local ly ie between neighb oring routers However the overall goal of a routing proto col is to establish good global paths b etween distant hosts on the internet An interface is the link between a router and a network In this example router r has interfaces i i and i which connect it to the networks n n and n resp ectively Hosts h and h b elong to the network n Routers are said to be neighbors if they haveinterfaces to a common network In our example all routers are neighb ors of r but r and r are not neighb ors Routing Information Proto col Each RIP router maintains a routing table A routing table contains one entry p er destination network representing the current b est route to the destination An entry corresp onding to destination d has the following elds hopsnumber