Is it possible to roughly estimate network traffic distribution for given ASN?

Mailman List Mirror (Read Only)
1

Hi,

there are various tools out there which show the prefix distribution
among the peers/uplinks for given ASN. For example
https://radar.qrator.net/as3333/graph#96311 or
http://bgp.he.net/AS3333#_asinfo. As far as I know, those tools build
the graphs mainly based on data from route servers. Am I correct that
at best this data could give very rough estimation on ingress traffic
for ASN as those graphs indicate announced prefixes? I mean for
example if ASN 1 announces 1.1.0.0/16, 2.2.0.0/16 and 3.3.0.0/16 to
ASN 2, but only 1.1.0.0/16 to ASN 3, then one could assume that more
ingress data to ASN 1 goes over ASN 2. What about egress traffic? In
general, are there ways to roughly estimate network traffic
distribution for given ASN among its peers/uplinks? I would say it is
not possible.

thanks,
Martin

2

You can certainly make inferences about the traffic between ASN 1 and ASN 2, 3, etc... however without being the operator of one of those ASNs, those inferences are just that - inferences. Even if you operate a network that peers with both ASN 1 and ASN 3, the traffic you see transiting your network to get to/from them might only be a fraction of the total traffic between those ASNs, given the possibility of there being other paths between then that don't cross your network.

What are you trying to figure out? If you want to see how much traffic you move between your AS and another AS, Netflow, IPFIX, and other tools can help you figure that out. If you're looking for the same kind of data for a source, destination (or both) that you don't control, all you can realistically do is guess.

jms

3

You may be able to view what routes I announce but you still have no idea
what my route policy is like. I might prefer one upstream over another due
to pricing, latency, capacity or any other unknown reason. And that is
never published.

If you can not know my egress, you will not know my ingress either as that
would be someone else egress and you can not know their egress....

You could use RIPE Atlas or the NLNOG RING to do traceroutes. That would
give you an idea of how traffic actually flows.

Knowing the routes tells you nothing about how much traffic will be
exchanged. How do you know which ASN has a deal with a big CDN or which
ASNs are content heavy vs eyeball heavy? Only the source or destination ASN
can know for sure how much traffic is exchanged.

Regards,

Baldur

4

Thanks for confirming this! One last question- am I correct that those
graphs referred in my initial e-mail indicate announced prefixes? Only
way to have some insight about received prefixes for particular ASN is
to check the RIR database aut-num object and hope that this is
up-to-date and all the routing policies are describe there in detail?
Again, RIPE Atlas or the NLNOG RING or looking-glass could also help a
little.

thanks,
Martin