"... In PAGE 3: ... a0 Policy-oriented protocol: Routers can apply complex policies to influence the selection of the best route for each prefix and to decide whether to propagate this route to neighbors. A router applies the decision process shown in Table1 to compare the routes learned from BGP neighbors and select the best route. In the backbone networks, BGP route selection depends on the interaction between three routing protocols: External BGP (eBGP), Internal BGP (iBGP) and Interior Gateway Protocol (IGP).... In PAGE 3: ... IGP determines the routing paths between two routers within the same AS. The routers use the IGP path costs in the seventh step in Table1 to select the closest egress point. eBGP is used to exchange routing information with external ASes, while iBGP is used to re-advertise the routes learned from ex- ternal peers to other routers in the same AS.... ..."

"... In PAGE 3: ... AF Policy-oriented protocol: Routers can apply complex policies to influence the selection of the best route for each prefix and to decide whether to propagate this route to neighbors. A router applies the decision process shown in Table1 to compare the routes learned from BGP neighbors and select the best route. In the backbone networks, BGP route selection depends on the interaction between three routing protocols: External BGP (eBGP), Internal BGP (iBGP) and Interior Gateway Protocol (IGP).... In PAGE 3: ... IGP determines the routing paths between two routers within the same AS. The routers use the IGP path costs in the seventh step in Table1 to select the closest egress point. eBGP is used to exchange routing information with external ASes, while iBGP is used to re-advertise the routes learned from ex- ternal peers to other routers in the same AS.... ..."

"... In PAGE 21: ...Table 7: Axioms for internal actions and abstraction. The natural axiom for internal actions is B1 in Table7 . Using the parallel composition operator (Section 2.... ..."

"... In PAGE 3: ... Each subsection focuses on one or two correctness properties and presents one or two examples of configuration statements that af- fect those properties. Table1 summarizes the effects of many more configuration statements on higher-level properties; a BGP verifier should express constraints related to each of these statements that guarantee that the higher level property holds. For each example that we discuss, we present a potential misconfiguration and spec- ify the constraint that should be satisfied to avoid the error.... In PAGE 3: ... Each BGP route contains a next-hop attribute that tells a router the IP address to forward packets to in order to use that route; con- figuration affects how this attribute is set. eBGP-speaking routers typically enable a configuration option that sets the BGP next- hop attribute to the loopback address of that eBGP-speaking router (rather than the address of the router in another AS) to ensure that the next-hop addresses advertised by iBGP are in the internal rout- ing protocol ( IGP ) and, thus, that internal routers can use the advertised route (see next-hop-self in Table1 ). This option simplifies configuration but is not always appropriate [1].... In PAGE 4: ... Unless an operator has intentionally configured nondeterminism, BGP should satisfy determinism, because it facilitates debugging, as well as the use of traffic engineering tools [7]. Table1 lists several configuration options that should be enabled to ensure that BGP satisfies time immunity. Static analysis can verify these con- straints by checking configurations at individual routers in the AS, as these options do not have dependencies across routers.... ..."

"... In PAGE 3: ... Each subsection focuses on one or two correctness properties and presents one or two examples of configuration statements that af- fect those properties. Table1 summarizes the effects of many more configuration statements on higher-level properties; a BGP verifier should express constraints related to each of these statements that guarantee that the higher level property holds. For each example that we discuss, we present a potential misconfiguration and spec- ify the constraint that should be satisfied to avoid the error.... In PAGE 3: ... Each BGP route contains a next-hop attribute that tells a router the IP address to forward packets to in order to use that route; con- figuration affects how this attribute is set. eBGP-speaking routers typically enable a configuration option that sets the BGP next- hop attribute to the loopback address of that eBGP-speaking router (rather than the address of the router in another AS) to ensure that the next-hop addresses advertised by iBGP are in the internal rout- ing protocol ( IGP ) and, thus, that internal routers can use the advertised route (see next-hop-self in Table1 ). This option simplifies configuration but is not always appropriate [1].... In PAGE 4: ... Unless an operator has intentionally configured nondeterminism, BGP should satisfy determinism, because it facilitates debugging, as well as the use of traffic engineering tools [7]. Table1 lists several configuration options that should be enabled to ensure that BGP satisfies time immunity. Static analysis can verify these con- straints by checking configurations at individual routers in the AS, as these options do not have dependencies across routers.... ..."

"... In PAGE 3: ... For global time we also adopt a discrete representation. Table1 describes dimensions associated to event de nition. Events character- ization and semantics depend largely on their source (dimension 1).... ..."

"... In PAGE 5: ... The IGP for AS1 is OSPF and the IGP for AS2 is RIPv2. BGP routes are redistributed into the IGPs, given in Table4 , for complete connectivity in the network. Table 4.... ..."

"... In PAGE 3: ... This can be updated at any time. Although the abstraction represented in Table1 goes further than the usual menu definition, developers should be enabled to add any extra, possibly unsupported, definition of parameters. Each menu specification is internally stored in XIML (exTensible Interface Markup Language) (Puerta amp; Eisenstein, 2002), which is a UI specification language supporting various models (i.... In PAGE 4: ... Clicking on any other tab automatically closes the previously opened menu. Although this variation may seem very limited, the tool allows the developer to change parameters at a higher level of abstraction (the one proposed in Table1 ) than at the code level. MenuSelector does not automatically generate code for all parameters combinations that can be inferred from Table 1.... ..."

"... In PAGE 3: ... This is not meant to be an exhaustive list, but is limited to the areas where, in our opinion, BGP is in most need of modification. For context, Table1 summarizes the primary distinctions between HLP and BGP across these de- sign issues. 2.... ..."