You are here: Home > Publications > RIPE Labs > Claudio Squarcella > Three Case Studies on the Egyptian Disconnection

Three Case Studies on the Egyptian Disconnection

Claudio Squarcella — 15 Feb 2011
Roma Tre University presents three analyses related to the recent events in Egypt, proving interesting behavior in relation to the observed disconnection. We use tools like BGPlay and iBGPlay, developed for the visualisation of BGP dynamics.

As media and tech articles reported, many Egyptian networks disappeared from the Internet during the night between 27 - 28 January 2011. However, a significant number of networks and services managed to remain visible and/or active. In this article we present three interesting examples, showing the insight we can get using our visualisation tools BGPlay and iBGPlay.

Egyptian Universities Network

The first example features BGP data from  GARR [1]. GARR provides connectivity to our university and hosts an instance of iBGPlay to monitor the reachability of selected targets. Looking at various examples of Egyptian networks disappearing from the network, we find out that before 30 January 2011, the Egyptian academic network (AS2561) is apparently visible through  GÉANT [2][3]:

EUN, iBGPlay GARR

However, during the same time window none of the prefixes were actually reachable from our network (via ping, traceroute, etc,) which suggests an underlying discrepancy between BGP tables and real connectivity .

TE Data

We now focus on TE Data (AS8452), an ISP established by Telecom Egypt.This  complements an earlier article on RIPE Labs by Richard Barnes . Looking at the output of the RIPE NCC's Resource Explainer tool REX , we notice that some prefixes remain visible during the disconnection:
We can take a closer look at the routing events related to these prefixes, using both BGPlay at Routeviews  and Historical BGPlay  hosted by the RIPE NCC (introduced on RIPE Labs in Historical BGP ).  With the  prefix 196.219.248.0/22 (not in the REX plot, but still announced by TE Data) this is the situation before 27 January 2011:

TE Data, before Jan 27th

The disruption causes major rerouting towards AS6762, owned by Telecom Italia:

TE Data, after Jan 27th

The other visible prefixes show no significant changes, being routed through AS6762 also before 27 January. As of 1 February, some of these prefixes were actually reachable through ping.

The American University in Cairo

The last example deals with multihoming, which proves its value in avoiding single points of failure. The IP prefix (213.181.237.0/24) is announced by AS8524, owned by the American University in Cairo, and is used to publicly serve their website. As the Hurricane Electric BGP Toolkit shows , AS8524 peers with at least two ISPs, namely RAYA Telecom and Noor Data Networks. This is what REX tells us about the set of prefixes announced by AS8524:

REX, AS8524 (eg-auc)

The mixed pattern of disappearing and visible prefixes reflects Richard Barnes' observations : RAYA fades out after 27 January whereas Noor Data Networks remains temporarily active (BGPlay gives visual evidence for each prefix). The plot draws our attention to the prefix mentioned above (213.181.237.0/24), which becomes visible again after being withdrawn for some time. Using BGPlay, we show what this means in terms of BGP policies. The routing graph before 27 January looks as follows:

AUC, before

The prefix was routed through RAYA. The situation changed after 29 January:

AUC, after

What we see is a clear shift to Noor Data Networks (visually represented by different colors in the timeline on the left) in order to ensure reachability of the service . Note that according to REX, this is the only prefix affected by the policy change, implicitly stating its relative importance within the whole set of prefixes announced by AS8524.

Authors and Acknowledgements

Analysis performed by members of the Compunet Research Group at Roma Tre University : Maurizio Pizzonia, Claudio Squarcella.

RIPE Labs article by Claudio Squarcella. 

GARR logo [1] GARR is the Italian Research & Education Network (NREN). It plans and operates the national high-speed telecommunication network for University and Scientific Research. Its shareholders are four major Research and Academic organizations in Italy, CNR, ENEA, INFN and Fondazione CRUI, representing the Conference of Italian University Rectors. For more info visit  http://www.garr.it/

GEANT logo [2] The GÉANT network is the fast and reliable pan-European communications infrastructure serving Europe’s research and education community. Co-funded by European National Research & Education Networks (NRENs) and the EC, the GÉANT network and project (also known as GN3) is entering its third generation, along with associated development activities. For more info visit  http://www.geant.net/

EUMED logo [3] EUMEDCONNECT2 is a high-capacity IP-based data-communications network serving the research and education communities in seven countries across the southern Mediterranean, enabling them to participate in collaborative projects. Offering a direct link to GÉANT, its pan-European counterpart, EUMEDCONNECT2 allows approximately 2 million users in around 700 institutions across North Africa and the Middle East to collaborate with their peers at more than 4000 research and education establishments in Europe. For more info visit  http://www.eumedconnect2.net/

 

 

2 Comments

Anonymous says:
24 Feb, 2011 12:09 PM
Thanks, Teaching in egypt. I appreciate this.
vqthang says:
18 Mar, 2013 12:25 PM
I'm very interesting in these tools, but was iBGPlay cancelled ? Because after downloading it from http://www.ibgplay.org/, I can not activate this software, because there is no response from iBGPlay team about it. So sad...
Add comment

You can add a comment by filling out the form below. Comments are moderated so they won't appear immediately. If you have a RIPE NCC Access account, we would like you to log in.