[102592] in North American Network Operators' Group
Re: 2008.02.19 NANOG 42 Taiwan Earthquake Aftermath notes
daemon@ATHENA.MIT.EDU (Alexander Harrowell)
Wed Feb 20 04:39:34 2008
Date: Wed, 20 Feb 2008 09:30:55 +0000
From: "Alexander Harrowell" <a.harrowell@gmail.com>
To: "Matthew Petach" <mpetach@netflight.com>
Cc: "NANOG list" <nanog@nanog.org>
In-Reply-To: <63ac96a50802191803n249bc442oe4e282e350ea8f1d@mail.gmail.com>
Errors-To: owner-nanog@merit.edu
------=_Part_20157_33119662.1203499855927
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Cf Renesys's superb analysis of the FLAG/FALCON/SMW4 cut, it looks like
SingTel are the people to go to for reliable connectivity in Asia (they were
the reconnection champs in January as well).
On Feb 20, 2008 2:03 AM, Matthew Petach <mpetach@netflight.com> wrote:
>
> Sorry, quick flurry of notes all at once now that things
> are wrapping up. ^_^;;
>
> Matt
>
>
>
> 2008.02.19 Aftershocks from Taiwan Earthquake
>
> Two presentations, and the IPv6 hour is starting
> now...
>
> Randy Bush has some things to say about the IPv6
> hour.
>
> The IPv4 LANs have been turned off; you will note
> that you don't have good v6 connectivity even if
> you're a v6 expert. Failure is as good as success
> for this.
>
> Thunderbird and Firefox have v6 DNS resolution turned
> off by default.
>
> Macintosh--if you put in v6 DNS server IP address, if
> you have capital A in it, it drops it!
>
> ISC DHCPv6 has issues
>
> Cisco NAT-PT has issues
>
> Linux based NAT-PT substituted in isn't scaling.
>
> So, we've learned a LOT already! The experiment
> has already been an excellent success as far as
> Randy is concerned.
>
>
> So, on to the talk.
>
> Martin Brown from Renesys will talk about the
> Taiwan earthquake analysis.
>
> With contributions from Alin, Todd, and Earl, all
> from Renesys.
>
> Will look at shape of aftereffects, and then will
> look at fallout, the shift in transit patterns.
>
> Large earthquake hit Luzon Strait, south of
> Taiwan on 26 Dec 2006
> 7 of 9 cables were severed in strait
> reviewed at APRICOT in Bali in 2007
>
> 2 not cut: Asia Netcom's EAC, and Guam-Philippines
> All cables reported reported on Feb 14, 2007.
>
> Renesys is like route views, but they do way more
> processing on the data.
>
> Adjacent or 1 hop away from 65% of all internet
> transit providers
>
> Focus on prefixes geo-located in Asia region.
>
> Defines what a network outage is, what unreachable
> means, and what unstable/flapping networks are.
>
> Pattern of taiwan earthquakes; shape of impact.
> ramping up of outages and spikes in instabilities.
> smaller quake on dec 27th
> Recovery pattern is typically noisy
>
> Outages/immediate aftermath of the quake, 10 days.
> 4 or 5 big quakes on the 26th, but outage ramps up
> slowly; the 27th quake has huge spike after that,
> much like last stick in Jenga.
> Almost 4000 networks suffered an outage due to the
> quakes.
>
> China, Indonesia, India hit very hard by it.
>
> Instabilities, same basic shape, more noisyness to it.
> same countries hit for outages and instability.
>
> Looked at the severity of impact; factor out baseline
> instability and outage for each country; compare that
> median to the peak;
> china/hong kong hit worst.
> About 70 times more outages in peak at hong kong as a
> result of the outage, 55 times more in taiwan
>
> For instability, china showed 1300 times more
> instability in 10 days after quake as in 2 weeks
> before the quake.
>
> what did it look like after the event, who went
> to new providers?
> Looked at transit relationships, mapped them into
> market regions, and ranked them based on size.
> So, score first, then rank.
> they geolocate all prefixes first of all, give it a
> location
> give score to prefix based on length
> pre-cidr are discounted, probably less well utilized
> also look at transit patterns for that prefix.
> ignore any more specifics that share same transit
> pattern.
> Now looking at all AS-to-AS relationship; they track
> all adjacencies on net. Will categorize the nature
> of the edge.
> computationally expensive, but lets them track all the
> relationships.
> gives a way to sum a score to a geo location or market.
>
> relationship between scores is important for ranking,
> the raw score doesn't matter.
> Don't show traffic volumes, profit, customer satisfaction,
> etc.
>
> If you have a retail score, if you show up adjacent in
> a market. probably in the region. Sprint is biggest
> transit for Sprint; but not much of a retail edge there.
>
> Can look at trend, see who gains or loses market share.
>
> coloured countries on map are most affected by quake.
>
> Look at the changes in the region since quake.
> compare by size, by deltas, and who gains, and who lost?
>
> India gained, Vietnam more than doubled in size
>
> four of 22 countries affected, look at the breakdown
> of who serves them.
> Can see which edges are interesting, and see who is
> growing.
> CW, tiscali, seabone/TI
> Fairly clear the transit patterns shifted as result of
> quake.
> Chunghua provided transit during the aftermath until
> the restoration.
>
> ATT lost Hanaro at quake, then VSNL dropped during
> time of repair, lost a bit of Asia Netcom, did well
> with Bharti.
>
> SingTel did very well; picked up China Netcom towards
> end of year; Vietnam Telecom chose singtel
>
> PCCW jumped 10 points, picked up starhub out of
> singapore close to cable repair point.
>
> telecom italia jumped 15 places in ranking; they got
> singtel, but no sharp jump in prefixes.
> simple metric of prefixes over time doesn't show
> whole story.
>
> Need to also see how *many* people chose the prefix
> over time.
> So new edge score is PPT (prefix, peers, time)
> sum the amount of time the peer saw the prefix
> routed on the edge during a time interval
> all prefixes have same weight
> cannot distinguish between an edge with a lot of
> prefixes seen by a few, and an edge with a few
> prefixes seen by many.
>
> In the aftermath of the quake, world prefers to
> use telecom italia to reach singtel.
>
> CW gains big in India, Bharti, TM net,
> jumps huge in the chart.
>
> Tiscali gains from Asia Netcom, 6000 prefixes,
> and wins providers in Hong Kong, Philippines
>
> Chinese providers grew, but didn't grow relative
> to other providers, so they dropped ranks.
>
> Still living with fragile internet, in asia and
> middle east; the cuts in mediterranean region
> from yesterday highlight that. Need more
> diversity in the region, both east and
> west.
>
> Q: CNET networks--were you able to detect
> partitioning, where japan could get to
> china, but not US, for example?
> Most likely, but they didn't focus on
> looking for that in this analysis.
>
> Q: Alin, Renesys, Telecom Italia and Singtel
> were peering before quake; after quake,
> relationship changed to transit, the
> prefixes shifted, and were picked up
> by rest of net.
>
> Q: Paul Ferguson, can you draw 30,000 foot
> view of impact of quake to the middle east
> cuts, to show relative impact of outages?
> They can can do that.
> Taiwan outages were 2.5x as bad as Alexandria,
> but press impact was higher.
> After taiwan quake, huge drop in spam and
> botnet attacks. Todd asks if that means
> he doesn't think the middle east is as good
> at spamming as Asia?
>
------=_Part_20157_33119662.1203499855927
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Cf Renesys's superb analysis of the FLAG/FALCON/SMW4 cut, it looks like SingTel are the people to go to for reliable connectivity in Asia (they were the reconnection champs in January as well).<br><br><div class="gmail_quote">
On Feb 20, 2008 2:03 AM, Matthew Petach <<a href="mailto:mpetach@netflight.com">mpetach@netflight.com</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>Sorry, quick flurry of notes all at once now that things<br>are wrapping up. ^_^;;<br><br>Matt<br><br><br><br>2008.02.19 Aftershocks from Taiwan Earthquake<br><br>Two presentations, and the IPv6 hour is starting<br>now...<br>
<br>Randy Bush has some things to say about the IPv6<br>hour.<br><br>The IPv4 LANs have been turned off; you will note<br>that you don't have good v6 connectivity even if<br>you're a v6 expert. Failure is as good as success<br>
for this.<br><br>Thunderbird and Firefox have v6 DNS resolution turned<br>off by default.<br><br>Macintosh--if you put in v6 DNS server IP address, if<br>you have capital A in it, it drops it!<br><br>ISC DHCPv6 has issues<br>
<br>Cisco NAT-PT has issues<br><br>Linux based NAT-PT substituted in isn't scaling.<br><br>So, we've learned a LOT already! The experiment<br>has already been an excellent success as far as<br>Randy is concerned.<br>
<br><br>So, on to the talk.<br><br>Martin Brown from Renesys will talk about the<br>Taiwan earthquake analysis.<br><br>With contributions from Alin, Todd, and Earl, all<br>from Renesys.<br><br>Will look at shape of aftereffects, and then will<br>
look at fallout, the shift in transit patterns.<br><br>Large earthquake hit Luzon Strait, south of<br>Taiwan on 26 Dec 2006<br>7 of 9 cables were severed in strait<br>reviewed at APRICOT in Bali in 2007<br><br>2 not cut: Asia Netcom's EAC, and Guam-Philippines<br>
All cables reported reported on Feb 14, 2007.<br><br>Renesys is like route views, but they do way more<br>processing on the data.<br><br>Adjacent or 1 hop away from 65% of all internet<br>transit providers<br><br>Focus on prefixes geo-located in Asia region.<br>
<br>Defines what a network outage is, what unreachable<br>means, and what unstable/flapping networks are.<br><br>Pattern of taiwan earthquakes; shape of impact.<br>ramping up of outages and spikes in instabilities.<br>smaller quake on dec 27th<br>
Recovery pattern is typically noisy<br><br>Outages/immediate aftermath of the quake, 10 days.<br>4 or 5 big quakes on the 26th, but outage ramps up<br>slowly; the 27th quake has huge spike after that,<br>much like last stick in Jenga.<br>
Almost 4000 networks suffered an outage due to the<br>quakes.<br><br>China, Indonesia, India hit very hard by it.<br><br>Instabilities, same basic shape, more noisyness to it.<br>same countries hit for outages and instability.<br>
<br>Looked at the severity of impact; factor out baseline<br>instability and outage for each country; compare that<br>median to the peak;<br>china/hong kong hit worst.<br>About 70 times more outages in peak at hong kong as a<br>
result of the outage, 55 times more in taiwan<br><br>For instability, china showed 1300 times more<br>instability in 10 days after quake as in 2 weeks<br>before the quake.<br><br>what did it look like after the event, who went<br>
to new providers?<br>Looked at transit relationships, mapped them into<br>market regions, and ranked them based on size.<br>So, score first, then rank.<br> they geolocate all prefixes first of all, give it a<br> location<br>
give score to prefix based on length<br> pre-cidr are discounted, probably less well utilized<br> also look at transit patterns for that prefix.<br> ignore any more specifics that share same transit<br> pattern.<br> Now looking at all AS-to-AS relationship; they track<br>
all adjacencies on net. Will categorize the nature<br> of the edge.<br> computationally expensive, but lets them track all the<br> relationships.<br> gives a way to sum a score to a geo location or market.<br><br>relationship between scores is important for ranking,<br>
the raw score doesn't matter.<br>Don't show traffic volumes, profit, customer satisfaction,<br>etc.<br><br>If you have a retail score, if you show up adjacent in<br>a market. probably in the region. Sprint is biggest<br>
transit for Sprint; but not much of a retail edge there.<br><br>Can look at trend, see who gains or loses market share.<br><br>coloured countries on map are most affected by quake.<br><br>Look at the changes in the region since quake.<br>
compare by size, by deltas, and who gains, and who lost?<br><br>India gained, Vietnam more than doubled in size<br><br>four of 22 countries affected, look at the breakdown<br>of who serves them.<br>Can see which edges are interesting, and see who is<br>
growing.<br>CW, tiscali, seabone/TI<br>Fairly clear the transit patterns shifted as result of<br>quake.<br>Chunghua provided transit during the aftermath until<br>the restoration.<br><br>ATT lost Hanaro at quake, then VSNL dropped during<br>
time of repair, lost a bit of Asia Netcom, did well<br>with Bharti.<br><br>SingTel did very well; picked up China Netcom towards<br>end of year; Vietnam Telecom chose singtel<br><br>PCCW jumped 10 points, picked up starhub out of<br>
singapore close to cable repair point.<br><br>telecom italia jumped 15 places in ranking; they got<br>singtel, but no sharp jump in prefixes.<br>simple metric of prefixes over time doesn't show<br>whole story.<br><br>
Need to also see how *many* people chose the prefix<br>over time.<br>So new edge score is PPT (prefix, peers, time)<br>sum the amount of time the peer saw the prefix<br>routed on the edge during a time interval<br>all prefixes have same weight<br>
cannot distinguish between an edge with a lot of<br> prefixes seen by a few, and an edge with a few<br> prefixes seen by many.<br><br>In the aftermath of the quake, world prefers to<br>use telecom italia to reach singtel.<br>
<br>CW gains big in India, Bharti, TM net,<br>jumps huge in the chart.<br><br>Tiscali gains from Asia Netcom, 6000 prefixes,<br>and wins providers in Hong Kong, Philippines<br><br>Chinese providers grew, but didn't grow relative<br>
to other providers, so they dropped ranks.<br><br>Still living with fragile internet, in asia and<br>middle east; the cuts in mediterranean region<br>from yesterday highlight that. Need more<br>diversity in the region, both east and<br>
west.<br><br>Q: CNET networks--were you able to detect<br>partitioning, where japan could get to<br>china, but not US, for example?<br>Most likely, but they didn't focus on<br>looking for that in this analysis.<br><br>
Q: Alin, Renesys, Telecom Italia and Singtel<br>were peering before quake; after quake,<br>relationship changed to transit, the<br>prefixes shifted, and were picked up<br>by rest of net.<br><br>Q: Paul Ferguson, can you draw 30,000 foot<br>
view of impact of quake to the middle east<br>cuts, to show relative impact of outages?<br>They can can do that.<br>Taiwan outages were 2.5x as bad as Alexandria,<br>but press impact was higher.<br>After taiwan quake, huge drop in spam and<br>
botnet attacks. Todd asks if that means<br>he doesn't think the middle east is as good<br>at spamming as Asia?<br></blockquote></div><br>
------=_Part_20157_33119662.1203499855927--
