Using RIPEstat to Analyse Cable Cuts in Chile

The problem, first reported by customers, was then confirmed by the company itself, which explained that it was related to fibre cable cuts in different locations that might have been caused by malicious attacks.

According to the official company statement, the issues began at 18:37 CLP (21:37 UTC) and continued until almost 23:00 CLP (2:00 UTC on 30 December), and they were fixed gradually during that night.

An event of this magnitude can be detected in the Border Gateway Protocol (BGP). Like other events of national scale, for instance those caused by natural disasters or censorship, such events are visible in the BGP and it is possible to determine the exact time and scope of the network disruptions.

RIPEstat, a tool developed by the RIPE NCC, allows us to analyse routes globally and makes it possible to visualise what happened that night in the south of Chile. 

Figure 1: RIPEstat showing network disruption on 29 December 2017 in Chile

In Figure 1 above, you can clearly see how the number of IPv4 prefixes announced by the affected network (AS14117) dropped by more than 200. This corresponds to more than 700 single IPv4 addresses – 20% of the space that is usually announced. This means that around 700 customers were left without connectivity during that time. The dates and times are as indicated by the company, between 3:00 and 11:00 UTC (0:00 and 8:00 hours CLT on Saturday, 30 December 2017).

Currently, NIC Chile Research Labs is working on gathering and analysing of all the Internet routes in the country, and is considering the development of a tool that makes it possible to automate the analysis and to give real-time alerts helping to detect these issues and to fix them. In addition, this study will create a mathematical model of the national network that will simulate issues and find critical locations where redundancy might have helped to avoid leaving whole regions without connectivity during this type of event.