North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: 2008.02.19 NANOG 42 Taiwan Earthquake Aftermath notes

  • From: Alexander Harrowell
  • Date: Wed Feb 20 04:40:53 2008
  • Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; bh=0Tw3qOmF1M2Qq+sU90OxzuODtA8mCHniM6ET8IIoEAI=; b=J6n7zdOMxn3CL/rztmcaHscrAzcTvi2Wbl//fOBBjCobAiCIA/uW1fMrG5dPQBOp4dn3b4rn4c035osv/gcXXwQ0MEMNcveb3aHbpfSAikyD2fxP7ZYVN3WAKJZ7eyIlZsFg+Knw86H33pT9YrzEEawqMDBwb3tn9Ws0ubVUUmk=
  • Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=hFi/2O4e2lP6hpATQq+0GeqHdUbG+kU7+XpRmbau4phllphLW+C6aLQtIkpZEaVcy4aqSUsoT6sQswkM5J7vQmv7I/iXDCSm3QN7Pl//Z2uJoLLNsS9KzjXcCSB1ZL5AI9vrgKjvSTR7AwLeQdkEsSBK7ChMg5mwdEMd1vgg52k=

Cf Renesys's superb analysis of the FLAG/FALCON/SMW4 cut, it looks like SingTel are the people to go to for reliable connectivity in Asia (they were the reconnection champs in January as well).

On Feb 20, 2008 2:03 AM, Matthew Petach <[email protected]> wrote:

Sorry, quick flurry of notes all at once now that things
are wrapping up.  ^_^;;

Matt



2008.02.19 Aftershocks from Taiwan Earthquake

Two presentations, and the IPv6 hour is starting
now...

Randy Bush has some things to say about the IPv6
hour.

The IPv4 LANs have been turned off; you will note
that you don't have good v6 connectivity even if
you're a v6 expert.  Failure is as good as success
for this.

Thunderbird and Firefox have v6 DNS resolution turned
off by default.

Macintosh--if you put in v6 DNS server IP address, if
you have capital A in it, it drops it!

ISC DHCPv6 has issues

Cisco NAT-PT has issues

Linux based NAT-PT substituted in isn't scaling.

So, we've learned a LOT already!  The experiment
has already been an excellent success as far as
Randy is concerned.


So, on to the talk.

Martin Brown from Renesys will talk about the
Taiwan earthquake analysis.

With contributions from Alin, Todd, and Earl, all
from Renesys.

Will look at shape of aftereffects, and then will
look at fallout, the shift in transit patterns.

Large earthquake hit Luzon Strait, south of
Taiwan on 26 Dec 2006
7 of 9 cables were severed in strait
reviewed at APRICOT in Bali in 2007

2 not cut: Asia Netcom's EAC, and Guam-Philippines
All cables reported reported on Feb 14, 2007.

Renesys is like route views, but they do way more
processing on the data.

Adjacent or 1 hop away from 65% of all internet
transit providers

Focus on prefixes geo-located in Asia region.

Defines what a network outage is, what unreachable
means, and what unstable/flapping networks are.

Pattern of taiwan earthquakes; shape of impact.
ramping up of outages and spikes in instabilities.
smaller quake on dec 27th
Recovery pattern is typically noisy

Outages/immediate aftermath of the quake, 10 days.
4 or 5 big quakes on the 26th, but outage ramps up
slowly; the 27th quake has huge spike after that,
much like last stick in Jenga.
Almost 4000 networks suffered an outage due to the
quakes.

China, Indonesia, India hit very hard by it.

Instabilities, same basic shape, more noisyness to it.
same countries hit for outages and instability.

Looked at the severity of impact; factor out baseline
instability and outage for each country; compare that
median to the peak;
china/hong kong hit worst.
About 70 times more outages in peak at hong kong as a
result of the outage, 55 times more in taiwan

For instability, china showed 1300 times more
instability in 10 days after quake as in 2 weeks
before the quake.

what did it look like after the event, who went
to new providers?
Looked at transit relationships, mapped them into
market regions, and ranked them based on size.
So, score first, then rank.
 they geolocate all prefixes first of all, give it a
 location
 give score to prefix based on length
 pre-cidr are discounted, probably less well utilized
 also look at transit patterns for that prefix.
 ignore any more specifics that share same transit
 pattern.
 Now looking at all AS-to-AS relationship; they track
 all adjacencies on net.  Will categorize the nature
 of the edge.
 computationally expensive, but lets them track all the
 relationships.
 gives a way to sum a score to a geo location or market.

relationship between scores is important for ranking,
the raw score doesn't matter.
Don't show traffic volumes, profit, customer satisfaction,
etc.

If you have a retail score, if you show up adjacent in
a market. probably in the region.  Sprint is biggest
transit for Sprint; but not much of a retail edge there.

Can look at trend, see who gains or loses market share.

coloured countries on map are most affected by quake.

Look at the changes in the region since quake.
compare by size, by deltas, and who gains, and who lost?

India gained, Vietnam more than doubled in size

four of 22 countries affected, look at the breakdown
of who serves them.
Can see which edges are interesting, and see who is
growing.
CW, tiscali, seabone/TI
Fairly clear the transit patterns shifted as result of
quake.
Chunghua provided transit during the aftermath until
the restoration.

ATT lost Hanaro at quake, then VSNL dropped during
time of repair, lost a bit of Asia Netcom, did well
with Bharti.

SingTel did very well; picked up China Netcom towards
end of year; Vietnam Telecom chose singtel

PCCW jumped 10 points, picked up starhub out of
singapore close to cable repair point.

telecom italia jumped 15 places in ranking; they got
singtel, but no sharp jump in prefixes.
simple metric of prefixes over time doesn't show
whole story.

Need to also see how *many* people chose the prefix
over time.
So new edge score is PPT (prefix, peers, time)
sum the amount of time the peer saw the prefix
routed on the edge during a time interval
all prefixes have same weight
cannot distinguish between an edge with a lot of
 prefixes seen by a few, and an edge with a few
 prefixes seen by many.

In the aftermath of the quake, world prefers to
use telecom italia to reach singtel.

CW gains big in India, Bharti, TM net,
jumps huge in the chart.

Tiscali gains from Asia Netcom, 6000 prefixes,
and wins providers in Hong Kong, Philippines

Chinese providers grew, but didn't grow relative
to other providers, so they dropped ranks.

Still living with fragile internet, in asia and
middle east; the cuts in mediterranean region
from yesterday highlight that.  Need more
diversity in the region, both east and
west.

Q: CNET networks--were you able to detect
partitioning, where japan could get to
china, but not US, for example?
Most likely, but they didn't focus on
looking for that in this analysis.

Q: Alin, Renesys, Telecom Italia and Singtel
were peering before quake; after quake,
relationship changed to transit, the
prefixes shifted, and were picked up
by rest of net.

Q: Paul Ferguson, can you draw 30,000 foot
view of impact of quake to the middle east
cuts, to show relative impact of outages?
They can can do that.
Taiwan outages were 2.5x as bad as Alexandria,
but press impact was higher.
After taiwan quake, huge drop in spam and
botnet attacks.  Todd asks if that means
he doesn't think the middle east is as good
at spamming as Asia?