Binding constraint: survivability — the network must work despite failures (Baran, 1964)

This is fundamentally different from ARPANET:

The tool at hand is OSPF. Is it the right tool?

Look at OSPF’s four invariant answers. Which one becomes impossible when separate commercial organizations must route between each other?

Would AT&T flood its internal topology to Sprint? Its 500 routers, link capacities, traffic engineering policies?

No. Commercial competitors treat topology as a trade secret. OSPF’s State answer — share everything honestly — requires trust that no longer exists.

OSPF can still work inside each organization — single admin, full trust. But it fails across organizations. This means routing has to split: one system inside, a different system between.

What does this separation create? Who handles the boundary?

Now: what does the gateway router advertise to other ASes?

OSPF advertises link states: "Link A-B, cost 10" — router-level. But we’re hiding internal routers. The outside world doesn’t know AT&T’s router names. What’s the right unit?

→ Prefixes — groups of IP addresses the AS is responsible for: 208.65.152.0/22

Plus the AS-level path for loop detection: [AS7018, AS3356, AS15169]

This is a path vector — more than a distance (DV), less than a topology (OSPF). The maximum competitors will disclose.

Is this the same type of gap as bufferbloat (accidentally noisy)? As count-to-infinity (circular belief)? Or something fundamentally different?

Time ← the loop runs across thousands of ASes exchanging prefix+path updates. How fast? DV ran at 128ms and oscillated. OSPF floods in seconds inside one admin.

→ Slow — 30-second minimum between updates for the same prefix. Stability over speed. Cost: 3-15 min convergence after failures. (Closed-loop: learned from DV’s mistake)

Selection ← OSPF picks shortest path. But commercial ASes have business preferences — a paying customer’s longer path beats a competitor’s shorter path.

→ Business preference (LOCAL_PREF) overrides shortest path. The protocol enforces business relationships, not optimal routing. (Decision placement: each AS applies local policy)

OSPF → BGP: State broke because trust changed. Every other answer adapted.

Stability comes from economic structure, not protocol design. The E-M-B gap is permanent. The system works because institutional constraints — the market hierarchy — keep policies aligned.

Consequence of no verification: Pakistan Telecom announces YouTube’s prefix (2008). BGP accepts it — no origin authentication. YouTube goes dark globally for 2 hours. RPKI (2012) partially fixes origin validation — same deployability meta-constraint.

A tension is forming. BGP selects one best path per prefix — stability demands simplicity. Yet operators want finer control: route video one way, bulk transfers another. Every additional policy rule (communities, route maps, prefix-list filters) adds complexity per device — and complexity threatens the stability Gao-Rexford guarantees. Precision competes with stability. Control competes with cost. This same tension will reappear inside organizations — and it will break the architecture.

:::

Three forces converged:

Which invariant is that? And if it’s the problem — what’s the alternative?

But wait — in Lecture 3, Baran proved distributed coordination was essential for survivability. Doesn’t centralizing routing create a single point of failure?

Baran’s context (1964): a national network across hostile territory. Survive nuclear attack. Centralization = one bomb destroys routing.

SDN’s context (2004): a datacenter or campus you fully control. You own every device, every link, every power supply.

Inside your own domain: you can replicate controllers, add fast failover, monitor health. Logically centralized ≠ physically centralized.

And the data showed: distributed configuration caused more downtime (62% from human error) than centralization risked. The real threat was no longer physical destruction — it was operational complexity.

Heart separated forwarding from routing in 1969 — same box, different processes. What’s the equivalent separation here?

Coordination ← single admin, full authority → centralized controller. The survivability tradeoff is acceptable because you control the domain and can replicate for redundancy.

State ← controller sees full topology (no secrets — you own everything). Switches hold only forwarding rules pushed to them. No Dijkstra, no link-state database on the switch.

Time ← controller pushes rules directly → sub-second. No distributed convergence. No path exploration.

Interface ← match-action rules: match on any header field (not just IP prefix). Video traffic? Match on port 443 + specific server IPs. This is the flexibility OSPF lacked — without inflating every device.

Heart (1969): separated forwarding from routing — same box, different processes.

SDN (2008): separated control plane from data plane — different devices entirely.

Same disaggregation principle. Applied more aggressively because the cost constraint demanded it.

BGP: trust changes → State answer changes, coordination stays distributed.

SDN: cost + flexibility changes → deeper disaggregation, coordination centralizes.

Next week: wireless medium access — binding constraint is physics (shared spectrum). Same framework, new substrate. Read Ch 3.