In the routing graphs produced by the RIPE REX tool, we can get a different visualization of Egyptian networks falling off of the Internet, and observe some interesting phenomena.
There's been some good reporting on the Renesys and BGPmon blogs, and on RIPEstat (and elsewhere) about how Egyptian networks have disappeared from the BGP routing structure. To add one more visualisation, I called up the affected ASNs in the RIPE NCC Resource EXplainer (REX) tool, which provides nice graphs of which prefixes are advertised by an AS over time. The set of target ASNs in this little study comes from the BGPmon list of affected ASNs:
- 5536 - Internet-Egypt
- 6127 - IDSC
- 8452 - TE-AS [Telecom Egypt]
- 8524 - eg-auc
- 15475 - Nile Online
- 20928 - Noor Data Networks
- 24835 - RAYA Telecom – Egypt
- 24863 - LINKdotNET
- 36935 - Vodafone-EG
- 36992 - ETISALAT-MISR
Beyond the simple disconnection -- most of the lines coming to a halt as prefixes are withdrawn -- you can observe a few interesting details. For example, there seem to have been two major waves of disconnections: Most things went down at around 16:00 UTC on 27 Jan, but a second wave followed at around 09:00 UTC on 28 Jan. See, for example, Nile Online ( AS15475 ), LINKdotNET ( AS24863 ). Vodafone ( AS36935 ), on the other hand, took down some networks in advance of the major disconnection. The only AS that seems to have brought anything back is AS8524 (eg-auc).
Without further ado, here are the graphs themselves. They're uploaded here as static images; click on the image to go to the appropriate REX page.
Comments 3
Comments are disabled on articles published more than a year ago. If you'd like to inform us of any issues, please reach out to us via the contact form here.
Anonymous •
Nice article. The graphs clearly show how for some ASes a small subset of the announced prefixes continues to be seen in RIS. <br /><br />However, keep in mind that REX only uses information from the RIS RIB dumps, which are made three times a day. REX cannot give you the exact time prefixes were withdrawn, it reports the time of the RIB dump which last had them. So "most things going down at 16:00 Jan 27" means they were no longer in RIS at the time of the next (midnight) dump.<br /><br />-- Rene
Hide replies
Anonymous •
Point taken. I had figured there was some sort of time-binning going on, which was why we couldn't see the same staggering of withdrawals that the Renesys folks saw over less than an hour (or, likewise, the withdrawal spike on RIPEstat). Nonetheless, it seems like the "waves" of withdrawals are separated enough that they can be seen on the RIS time scale.<br />
Hide replies
Anonymous •
RIPEstat (4th graph on <a href="http://stat.ripe.net/egypt" rel="nofollow">http://stat.ripe.net/egypt</a>) shows some fine structure, a number of prefixes came back shortly before 00:00 Jan 28th. Since these prefixes were present in two consecutive RIS dumps, REX assumes they were visible throughout the entire 4pm to midnight time frame. It's not 100% correct, but REX' goal is to show routing developments on a longer time scale. With an error margin of a couple of hours you see how things evolve over time, dating back all the way to 2001.