Three Case Studies on the Egyptian Disconnection

As media and tech articles reported, many Egyptian networks disappeared from the Internet during the night between 27 - 28 January 2011. However, a significant number of networks and services managed to remain visible and/or active. In this article we present three interesting examples, showing the insight we can get using our visualisation tools BGPlay and iBGPlay.

Egyptian Universities Network

The first example features BGP data from  GARR [1]. GARR provides connectivity to our university and hosts an instance of iBGPlay to monitor the reachability of selected targets. Looking at various examples of Egyptian networks disappearing from the network, we find out that before 30 January 2011, the Egyptian academic network (AS2561) is apparently visible through  GÉANT [2][3]:

However, during the same time window none of the prefixes were actually reachable from our network (via ping, traceroute, etc,) which suggests an underlying discrepancy between BGP tables and real connectivity .

TE Data

We now focus on TE Data (AS8452), an ISP established by Telecom Egypt.This  complements an earlier article on RIPE Labs by Richard Barnes . Looking at the output of the RIPE NCC's Resource Explainer tool REX , we notice that some prefixes remain visible during the disconnection:

We can take a closer look at the routing events related to these prefixes, using both BGPlay at Routeviews  and Historical BGPlay  hosted by the RIPE NCC (introduced on RIPE Labs in Historical BGP ).  With the  prefix 196.219.248.0/22 (not in the REX plot, but still announced by TE Data) this is the situation before 27 January 2011:

The disruption causes major rerouting towards AS6762, owned by Telecom Italia:

The other visible prefixes show no significant changes, being routed through AS6762 also before 27 January. As of 1 February, some of these prefixes were actually reachable through ping.

The American University in Cairo

The last example deals with multihoming, which proves its value in avoiding single points of failure. The IP prefix (213.181.237.0/24) is announced by AS8524, owned by the American University in Cairo, and is used to publicly serve their website. As the Hurricane Electric BGP Toolkit shows , AS8524 peers with at least two ISPs, namely RAYA Telecom and Noor Data Networks. This is what REX tells us about the set of prefixes announced by AS8524:

The mixed pattern of disappearing and visible prefixes reflects Richard Barnes' observations : RAYA fades out after 27 January whereas Noor Data Networks remains temporarily active (BGPlay gives visual evidence for each prefix). The plot draws our attention to the prefix mentioned above (213.181.237.0/24), which becomes visible again after being withdrawn for some time. Using BGPlay, we show what this means in terms of BGP policies. The routing graph before 27 January looks as follows:

The prefix was routed through RAYA. The situation changed after 29 January:

What we see is a clear shift to Noor Data Networks (visually represented by different colors in the timeline on the left) in order to ensure reachability of the service . Note that according to REX, this is the only prefix affected by the policy change, implicitly stating its relative importance within the whole set of prefixes announced by AS8524.

Authors and Acknowledgements

Analysis performed by members of the Compunet Research Group at Roma Tre University : Maurizio Pizzonia, Claudio Squarcella.

RIPE Labs article by Claudio Squarcella. 

[1] GARR is the Italian Research & Education Network (NREN). It plans and operates the national high-speed telecommunication network for University and Scientific Research. Its shareholders are four major Research and Academic organizations in Italy, CNR, ENEA, INFN and Fondazione CRUI, representing the Conference of Italian University Rectors. For more info visit  http://www.garr.it/

[2] The GÉANT network is the fast and reliable pan-European communications infrastructure serving Europe’s research and education community. Co-funded by European National Research & Education Networks (NRENs) and the EC, the GÉANT network and project (also known as GN3) is entering its third generation, along with associated development activities. For more info visit  http://www.geant.net/

[3] EUMEDCONNECT2 is a high-capacity IP-based data-communications network serving the research and education communities in seven countries across the southern Mediterranean, enabling them to participate in collaborative projects. Offering a direct link to GÉANT, its pan-European counterpart, EUMEDCONNECT2 allows approximately 2 million users in around 700 institutions across North Africa and the Middle East to collaborate with their peers at more than 4000 research and education establishments in Europe. For more info visit  http://www.eumedconnect2.net/