Internet Stability in Times of Corona

The Internet is a network of connected networks that move information as packets. For instance, that home education video you're watching now that schools are closed was brought to you because your cable provider and the platform hosting the video communicate, either directly or indirectly, on how to deliver small chunks of the video to you. They do this using a protocol called Border Gateway Protocol (BGP), and we collect information about this in a data collection system called RIS. If a network does maintenance, or wants other networks to change the paths used for communicating over the Internet, it sends this information via BGP to the rest of the network.

We assemble snapshots of the routing tables RIS collects every eight hours. By looking at the differences between these snapshots we can see some of the dynamics of this network maintenance. Note that because the Internet routing system is not completely secured against bad actors, BGP updates can sometimes re-route Internet traffic for malicious purposes. This is also captured in our data.

What did we expect?

The world has changed quite a bit in the last few weeks: a large part of the world is in social quarantine, working from home or in lockdown due to the Corona pandemic. We are interested to see effects of this in the data collected by RIS. The specific signal that we looked at shows re-configuration activities such as: IP prefix announcements, withdrawals or changes in origin. One might expect that network operators would make fewer changes to their networks or that they would have only restricted access to data centers, reducing the number of networks where we can see re-configuration activity.

To my surprise there is no such signal visible as of writing of this post. The red line in Figure 1 below shows the number of networks (ASes) for which we see any kind of changes in terms of the IPv4 prefixes they announce. In Figure 2 this signal is split out in networks that have specific types of changes (prefixes added, prefixes removed, and origins changed). In both these graphs there is no visible decrease in the number of networks with these types of changes on the right-end of the graph. These were the weeks where more and more countries took social distancing measures to combat Corona spread.

Another interesting aspect of these figures are the telltale signs of human behaviour in there. The vertical grey lines indicate Monday midnight: you can see fewer ASes in the two days before Monday that show any kind of changes to their IPv4 announcements, i.e. the graph shows a periodic dip on Saturdays and Sundays. This coincides with the weekend in the western world. The weeks before and after the western New Year also show fewer network changes. This could be another sign that we are looking at the human behaviour of network operators, as this coincides with a period where many people go on holidays. Also interesting are the spikes around Christmas and New Year (malicious activity?), and spikes around other times that we cannot link to any specific events.

Figure 1: Number of ASes with any type of changes in BGP in terms of IPv4 prefix announcements

Figure 2: Number of ASes split up by specific type of prefix change

While this analysis is preliminary, we thought it was useful to share at this point. It could very well indicate that in the new mode of operations for many network operators, by and large they keep on reconfiguring their networks at the same pace as before the coronavirus pandemic. These graphs of stable BGP activity, together with reports of increased traffic volumes, stress the fact that these are busy times for network operators to keep the Internet up and running and as stable as possible. Thank you, network operators!

We intend to update this post if we see interesting things over the upcoming days/weeks. As always, your thoughts or questions are very welcome in the comments section below.