You are here: Home > Publications > RIPE Labs > Emile Aben > Internet Stability in Times of Corona

Internet Stability in Times of Corona

Emile Aben — 26 Mar 2020
In this article we're sharing observations we made in the RIPE Routing Information System (RIS), our Internet data plane observatory.

The Internet is a network of connected networks that move information as packets. For instance, that home education video you're watching now that schools are closed was brought to you because your cable provider and the platform hosting the video communicate, either directly or indirectly, on how to deliver small chunks of the video to you. They do this using a protocol called Border Gateway Protocol (BGP), and we collect information about this in a data collection system called RIS. If a network does maintenance, or wants other networks to change the paths used for communicating over the Internet, it sends this information via BGP to the rest of the network.

We assemble snapshots of the routing tables RIS collects every eight hours. By looking at the differences between these snapshots we can see some of the dynamics of this network maintenance. Note that because the Internet routing system is not completely secured against bad actors, BGP updates can sometimes re-route Internet traffic for malicious purposes. This is also captured in our data.

What did we expect?

The world has changed quite a bit in the last few weeks: a large part of the world is in social quarantine, working from home or in lockdown due to the Corona pandemic. We are interested to see effects of this in the data collected by RIS. The specific signal that we looked at shows re-configuration activities such as: IP prefix announcements, withdrawals or changes in origin. One might expect that network operators would make fewer changes to their networks or that they would have only restricted access to data centers, reducing the number of networks where we can see re-configuration activity.

To my surprise there is no such signal visible as of writing of this post. The red line in Figure 1 below shows the number of networks (ASes) for which we see any kind of changes in terms of the IPv4 prefixes they announce. In Figure 2 this signal is split out in networks that have specific types of changes (prefixes added, prefixes removed, and origins changed). In both these graphs there is no visible decrease in the number of networks with these types of changes on the right-end of the graph. These were the weeks where more and more countries took social distancing measures to combat Corona spread.

Another interesting aspect of these figures are the telltale signs of human behaviour in there. The vertical grey lines indicate Monday midnight: you can see fewer ASes in the two days before Monday that show any kind of changes to their IPv4 announcements, i.e. the graph shows a periodic dip on Saturdays and Sundays. This coincides with the weekend in the western world. The weeks before and after the western New Year also show fewer network changes. This could be another sign that we are looking at the human behaviour of network operators, as this coincides with a period where many people go on holidays. Also interesting are the spikes around Christmas and New Year (malicious activity?), and spikes around other times that we cannot link to any specific events.

Figure 1: Number of ASes with any type of changes in BGP in yerms of IPv4 prefix announcements

Figure 2: Number of ASes split up by specific type of prefix change

While this analysis is preliminary, we thought it was useful to share at this point. It could very well indicate that in the new mode of operations for many network operators, by and large they keep on reconfiguring their networks at the same pace as before the coronavirus pandemic. These graphs of stable BGP activity, together with reports of increased traffic volumes, stress the fact that these are busy times for network operators to keep the Internet up and running and as stable as possible. Thank you, network operators!

We intend to update this post if we see interesting things over the upcoming days/weeks. As always, your thoughts or questions are very welcome in the comments section below.


Kurt Kayser says:
26 Mar, 2020 05:27 PM
this is great data and I really do love to see the Internet helping to delay the pandemic effects (through home-office, video conferencing and VoIP/Telcos).
It should be mentioned though that some large datacenter operators that have started to restrict access to their areas for visitors or any other party. This logical and helps to minimize contact between people.
But access for emergency repair or maintenance work MUST be ensured in order to guarantee the continued operation of the Internet!
Please let's not overdo security to trade off operational stability.

regards, Kurt
Stéphane Bortzmeyer says:
26 Mar, 2020 05:33 PM
One may assume that, if some people delayed the changes, other people rushed in to adapt the networks to the increased load? Both behaviour may explain why the change rate is more or less the same?
Emile Aben says:
27 Mar, 2020 08:24 AM
I think it would be interesting to dig into this data deeper indeed. I looked at splitting this out per country a bit, but could try figure out if there are trends in the sets of ASNs in this timeseries. Would you be willing to look at this? My colleague Vesna is doing a virtual hackathon around Internet and Corona ([…]/hackathons-in-the-time-of-corona ), I'd love it if we could collaborate around this. Let me or Vesna know, or hop on to the conf calls, Mon 2pm UTC ( 3pm Paris timezone :) )
Add comment

You can add a comment by filling out the form below. Comments are moderated so they won't appear immediately. If you have a RIPE NCC Access account, we would like you to log in.