Typhoon Haiyan - What we see in RIPEstat and RIPE Atlas

Note: We have continued to update the original story as new data became available. Please see the  update from 18 November , the update from 19 November and the update from 22 November below.

Typhoon Haiyan made landfall in the Philippines at approximately 4:40 a.m. 8 November 2013 local time (8:40 p.m. 7 November UTC).

The Country Routing Statistics widget in RIPEstat do not show a significant difference in the number of Philippine IPv4 networks that are announced pre- versus post-landfall. The number of ASes does slow a slight decrease from 181 prior to the typhoon's landfall, to 175 a couple of hours afterwards. This drop happened primarily at around 4:40am (UTC), as can be seen in Figure 1.

Figure 1: Slight decrease in the number of Philippine ASNs seen in routing tables.

The six networks that went missing from the routing tables we monitor are:

Table 1: Networks we didn't see on the routing table we monitor

When looking at the history of these networks, we do see occasional outages, but they had been generally stable over the last few weeks.

There are currently four RIPE Atlas probes in the Philippines, two of which have been collecting measurements over the past month. At the time of writing, both of these active probes appear to be up and running. They are in AS6648  (Bayan Telecommunications) and AS23930 (IP-Converge Data Center). Physically they both are in the Manila area.

While the effects of Haiyan on the people living in the affected areas are massive , its effects on the core Internet infrastructure in the Philippines that we can remotely measure appear to be modest. Of course, the story on the ground can be completely different. And it likely is: A lot of power interruptions are reported , which probably means that a lot of homes are without power - so no Internet. Any Internet infrastructure in these areas is likely on backup power, so can still go down if power is not restored before these backup systems are exhausted.

You can monitor Haiyan's effect on networks in the Philippines in near-real time on the RIPEstat Country Routing Monitor. If you see something interesting, please let us know by commenting below.

We will continue to monitor the situation and will provide further updates if we see anything noteworthy.

UPDATE 1 (18 November):

As reported earlier, we didn't find much of an effect of typhoon Haiyan in the data we collect about the well-being of the Internet. This is in sharp contrast with the humanitarian disaster in the Philippines due to the typhoon, as well as the reports from the ground about telecommunications infrastructure in the path of the storm that have been heavily affected.

Let's dig deeper and try to understand what's going on here. The Internet functions because of a loosely organised network of interconnected networks. These networks, also called Autonomous Systems, are of various sizes. They can be very big (spanning the globe) or very small - or anything in between.

If something happens within a network, such as a link inside the network going down, the network may be able to recover from this internally (if it has enough redundancy), so the network as a whole stays connected to the rest of the Internet, and the information about the link in the network going down stays inside the network.

When losing a large amount of internal links, a network can continue to announce the reachability of its addresses/prefixes to the rest of the Internet, provided it has not lost its connections to the Internet. In this case, there can be little or no external evidence of this happening; one of the only clues would be a decreased amount of traffic that this network exchanges with other networks.

This can explain why, although telecom infrastructure in the path of the typhoon is destroyed, we didn't find evidence of many networks going down. The larger networks in the Phillipines, which likely also provide service in the affected areas, managed to stay connected to the rest of the Internet.

UPDATE 2 (19 November):  

There are smaller networks in the Philippines though, and these can provide clues as to the local circumstances of availability of power and physical Internet infrastructure.

Most networks we reported as being severed from the Internet due to the storm (see Table 1 above), have a few things in common. They don't announce a lot of prefixes, and when we can geolocate them (based on netname), they are in, or close to, the affected area. Figure 2 below shows the location of four of the six networks in Table 1, as well as the University of the Philippines Cebu campus AS that we discovered went down roughly a day before the typhoon.

Figure 1: Location of networks that were severed from the Internet (in red) and the typhoon track (in purple)

The system of the University of the Philippines provides another sliver of information. This university system has campuses across the Philippines. Of these campuses, 13 have their own Autonomous System Number (ASN), and eight of these have been seen announcing address space in the routing tables we monitor. There is an ASN assigned for the campus in the severely affected city of Tacloban, but this AS has never been seen announcing address space on the Internet, so we can't use it to help assess and monitor the situation in this city.

Figure 3 below shows the visibility of prefixes announced by the eight campus Autonomous Systems.

Figure 3: Visibility of prefixes originated by the University of the Philippines around the time of the typhoon. Each colored line is a single prefix, lines colored by originating AS. The shaded grey area is the approximate time Haiyan was over the Philippines.

Figure 4 below shows where the campuses are geographically. Campuses in red had outages longer than a day, while locations colored green had no such outages.

Figure 4: The campuses of the University of the Philippines during the time of the typhoon. Campuses colored red had outages longer than a day.

UPDATE 3 (22 NOVEMBER):

With estimates of more than ten million people affected by Typhoon Haiyan – out of a population of 98 million – one would expect to see the typhoon’s effect on Internet traffic levels.

Looking at the traffic volume data that the Google Transparency Report provides, there is not much of an effect visible. Figure 4 has a snapshot of Google’s Transparency Report for the Philippines.  The typhoon hit the Philippines in the evening of 7 November, and the signal before and after is not very different.

Figure 4: Snapshot of traffic volumes as reported by Google's Transparency Report

What we may be looking at here is the aggregate of two opposing effects:

• Decreased traffic due to destroyed infrastructure
• Increased traffic due to more people looking for information related to Haiyan

If these effects cancel each other out, the aggregate won't tell us much.

We also found an Internet Exchange Point (IXP) in Manila that provides aggregate traffic statistics, shown in Figure 5. This shows a higher traffic volume around the time Haiyan was over the Philippines.  However, it is difficult to assess what these traffic stats actually mean without knowing more about the IXP and its members.

Figure 5: Snapshot of traffic volumes on the Philippines Open Internet Exchange in Manila

Another public source of data is NDT (Network Diagnostic Test), a speed and diagnostic test data from M-Lab . While we don't expect that firing up a bandwidth test is on the mind of somebody in distress, these tests are embedded in several commonly used applications, so seeing tests being performed from a particular location is a sign of that location being online. To create a baseline, we took 12 days (26 October to 7 November) of NDT tests from address space geolocated to the Philippines, and compared that to 12 days (9 November to 21 November) of the same data after the typhoon hit. For this we used the RIPEstat Data API . Figure 6a shows this data for the Philippines before Haiyan, Figure 6b shows it after Haiyan. Care should be taken to not over-interpret these figures.

First, the geolocation data may not be accurate for the IP resources, as is exemplified by the presence of a signal to the northeast of the island Samar, where there is no island (blue circle in Figure 6a).

If for a moment we assume 100% correct geolocation, the absence of a signal will be due to a lack of people performing tests from that location. This is not proof of infrastructure being down, although it could be the reason.

However, if we do see a signal, that that means we can be certain the infrastructure was functioning.  In the case of Cebu City, we do see a strong signal both before and after Haiyan hit, and we did not see it disappear at any time in November.

Figure 6: Locations of IP addresses seen in NDT tests for (a) 12 days before Haiyan, and (b) 12 days after Haiyan.

In the case of Tacloban, we do see a pre-Haiyan signal of IP addresses as a source for NDT tests, and we now see a faint signal in the post-Haiyan map, too. Tacloban is indicated with purple circles in Figure 6a and 6b. We do see a single IP address performing tests on 18 November. We tried to cross check this with the availability of electricity in Tacloban, and we did find information about restoration of infrastructure and shipping of power aggregates . If the geolocation data for this IP address is correct, that is a very encouraging sign of post-Haiyan recovery of this severely affected town .

Conclusion

Piecing all these slivers of information together, one could summarise the effect of Haiyan on the Internet infrastructure in the Philippines as being very localised, but very severe.

Using the data we collect, we try to inform the Internet community about the effects that major events have on the Internet. We'll try to feed what we've learned from analysing Haiyan back into our data collection and presentation systems. For instance, we're considering using heat maps like Figure 6a and 6b for parts of RIPEstat .

We haven't used RIPE Atlas to the fullest extent possible in this regard yet. A major part of the reason in the case of Haiyan was that we didn't have RIPE Atlas probes close to the affected area. If people can host probes in areas outside of metro Manila, and more generally in populated areas where we don't yet have any probes, that would help tremendously in providing us – and the entire Internet community – better Internet telemetry.

As people are looking for friends and relatives in the areas affected by Haiyan, and later when rebuilding those areas, the Internet will play an important role. We want to continue to offer any insight we can that might help in those efforts. Learn more about how you can help us collect the necessary data .