Sorry, quick flurry of notes all at once now that things
are wrapping up. ^_^;;
2008.02.19 Aftershocks from Taiwan Earthquake
Two presentations, and the IPv6 hour is starting
Randy Bush has some things to say about the IPv6
The IPv4 LANs have been turned off; you will note
that you don't have good v6 connectivity even if
you're a v6 expert. Failure is as good as success
Thunderbird and Firefox have v6 DNS resolution turned
off by default.
Macintosh--if you put in v6 DNS server IP address, if
you have capital A in it, it drops it!
ISC DHCPv6 has issues
Cisco NAT-PT has issues
Linux based NAT-PT substituted in isn't scaling.
So, we've learned a LOT already! The experiment
has already been an excellent success as far as
Randy is concerned.
So, on to the talk.
Martin Brown from Renesys will talk about the
Taiwan earthquake analysis.
With contributions from Alin, Todd, and Earl, all
Will look at shape of aftereffects, and then will
look at fallout, the shift in transit patterns.
Large earthquake hit Luzon Strait, south of
Taiwan on 26 Dec 2006
7 of 9 cables were severed in strait
reviewed at APRICOT in Bali in 2007
2 not cut: Asia Netcom's EAC, and Guam-Philippines
All cables reported reported on Feb 14, 2007.
Renesys is like route views, but they do way more
processing on the data.
Adjacent or 1 hop away from 65% of all internet
Focus on prefixes geo-located in Asia region.
Defines what a network outage is, what unreachable
means, and what unstable/flapping networks are.
Pattern of taiwan earthquakes; shape of impact.
ramping up of outages and spikes in instabilities.
smaller quake on dec 27th
Recovery pattern is typically noisy
Outages/immediate aftermath of the quake, 10 days.
4 or 5 big quakes on the 26th, but outage ramps up
slowly; the 27th quake has huge spike after that,
much like last stick in Jenga.
Almost 4000 networks suffered an outage due to the
China, Indonesia, India hit very hard by it.
Instabilities, same basic shape, more noisyness to it.
same countries hit for outages and instability.
Looked at the severity of impact; factor out baseline
instability and outage for each country; compare that
median to the peak;
china/hong kong hit worst.
About 70 times more outages in peak at hong kong as a
result of the outage, 55 times more in taiwan
For instability, china showed 1300 times more
instability in 10 days after quake as in 2 weeks
before the quake.
what did it look like after the event, who went
to new providers?
Looked at transit relationships, mapped them into
market regions, and ranked them based on size.
So, score first, then rank.
they geolocate all prefixes first of all, give it a
give score to prefix based on length
pre-cidr are discounted, probably less well utilized
also look at transit patterns for that prefix.
ignore any more specifics that share same transit
Now looking at all AS-to-AS relationship; they track
all adjacencies on net. Will categorize the nature
of the edge.
computationally expensive, but lets them track all the
gives a way to sum a score to a geo location or market.
relationship between scores is important for ranking,
the raw score doesn't matter.
Don't show traffic volumes, profit, customer satisfaction,
If you have a retail score, if you show up adjacent in
a market. probably in the region. Sprint is biggest
transit for Sprint; but not much of a retail edge there.
Can look at trend, see who gains or loses market share.
coloured countries on map are most affected by quake.
Look at the changes in the region since quake.
compare by size, by deltas, and who gains, and who lost?
India gained, Vietnam more than doubled in size
four of 22 countries affected, look at the breakdown
of who serves them.
Can see which edges are interesting, and see who is
CW, tiscali, seabone/TI
Fairly clear the transit patterns shifted as result of
Chunghua provided transit during the aftermath until
ATT lost Hanaro at quake, then VSNL dropped during
time of repair, lost a bit of Asia Netcom, did well
SingTel did very well; picked up China Netcom towards
end of year; Vietnam Telecom chose singtel
PCCW jumped 10 points, picked up starhub out of
singapore close to cable repair point.
telecom italia jumped 15 places in ranking; they got
singtel, but no sharp jump in prefixes.
simple metric of prefixes over time doesn't show
Need to also see how *many* people chose the prefix
So new edge score is PPT (prefix, peers, time)
sum the amount of time the peer saw the prefix
routed on the edge during a time interval
all prefixes have same weight
cannot distinguish between an edge with a lot of
prefixes seen by a few, and an edge with a few
prefixes seen by many.
In the aftermath of the quake, world prefers to
use telecom italia to reach singtel.
CW gains big in India, Bharti, TM net,
jumps huge in the chart.
Tiscali gains from Asia Netcom, 6000 prefixes,
and wins providers in Hong Kong, Philippines
Chinese providers grew, but didn't grow relative
to other providers, so they dropped ranks.
Still living with fragile internet, in asia and
middle east; the cuts in mediterranean region
from yesterday highlight that. Need more
diversity in the region, both east and
Q: CNET networks--were you able to detect
partitioning, where japan could get to
china, but not US, for example?
Most likely, but they didn't focus on
looking for that in this analysis.
Q: Alin, Renesys, Telecom Italia and Singtel
were peering before quake; after quake,
relationship changed to transit, the
prefixes shifted, and were picked up
by rest of net.
Q: Paul Ferguson, can you draw 30,000 foot
view of impact of quake to the middle east
cuts, to show relative impact of outages?
They can can do that.
Taiwan outages were 2.5x as bad as Alexandria,
but press impact was higher.
After taiwan quake, huge drop in spam and
botnet attacks. Todd asks if that means
he doesn't think the middle east is as good
at spamming as Asia?