Visualizing the Egyptian Disconnection

Richard Barnes — Jan 30, 2011 07:40 PM
Filed under: , ,
In the routing graphs produced by the RIPE REX tool, we can get a different visualization of Egyptian networks falling off of the Internet, and observe some interesting phenomena.

There's been some good reporting on the Renesys and BGPmon blogs, and on RIPEstat (and elsewhere) about how Egyptian networks have disappeared from the BGP routing structure. To add one more visualisation, I called up the affected ASNs in the RIPE NCC Resource EXplainer (REX) tool, which provides nice graphs of which prefixes are advertised by an AS over time. The set of target ASNs in this little study comes from the BGPmon list of affected ASNs:

Beyond the simple disconnection -- most of the lines coming to a halt as prefixes are withdrawn -- you can observe a few interesting details. For example, there seem to have been two major waves of disconnections: Most things went down at around 16:00 UTC on 27 Jan, but a second wave followed at around 09:00 UTC on 28 Jan.  See, for example, Nile Online (AS15475), LINKdotNET (AS24863). Vodafone (AS36935), on the other hand, took down some networks in advance of the major disconnection. The only AS that seems to have brought anything back is AS8524 (eg-auc).

Without further ado, here are the graphs themselves. They're uploaded here as static images; click on the image to go to the appropriate REX page.

rex_5536.png

rex_6127.png

rex_8452.png

rex_8524.png

rex_15475.png

rex_20928.png

rex_24835.png

rex_24863.png

rex_36935.png

rex_36992.png

3 Comments

wilhelm
wilhelm says:
Jan 31, 2011 02:01 AM
Nice article. The graphs clearly show how for some ASes a small subset of the announced prefixes continues to be seen in RIS.

However, keep in mind that REX only uses information from the RIS RIB dumps, which are made three times a day. REX cannot give you the exact time prefixes were withdrawn, it reports the time of the RIB dump which last had them. So "most things going down at 16:00 Jan 27" means they were no longer in RIS at the time of the next (midnight) dump.

-- Rene
rbarnes
rbarnes says:
Jan 31, 2011 02:33 AM
Point taken. I had figured there was some sort of time-binning going on, which was why we couldn't see the same staggering of withdrawals that the Renesys folks saw over less than an hour (or, likewise, the withdrawal spike on RIPEstat). Nonetheless, it seems like the "waves" of withdrawals are separated enough that they can be seen on the RIS time scale.
wilhelm
wilhelm says:
Feb 01, 2011 07:23 PM
RIPEstat (4th graph on http://stat.ripe.net/egypt) shows some fine structure, a number of prefixes came back shortly before 00:00 Jan 28th. Since these prefixes were present in two consecutive RIS dumps, REX assumes they were visible throughout the entire 4pm to midnight time frame. It's not 100% correct, but REX' goal is to show routing developments on a longer time scale. With an error margin of a couple of hours you see how things evolve over time, dating back all the way to 2001.
Add comment

You can add a comment by filling out the form below. Only plain text is possible. Web and email addresses will be transformed into clickable links. Comments are moderated so they won't appear immediately.

Related Items
Increased Reach of RIPE Atlas Anchors

Increasing the reach of RIPE Atlas anchors is one of the highest priority goals of RIPE Atlas Team. ...

Proposing Making RIPE Atlas Data More Public

RIPE Atlas is now three years old, and is moving from a prototype to production service. Based on ...

Modifications to the IP Analyser to Reflect New Policy

We are in the process of implementing the policy regarding Post Depletion Adjustment of Procedures ...

RIPE Atlas: Improved Probe Pages

We've made it much easier to get an overview of the history and measurements for all the public ...

Visualising Bandwidth Capacity and Network Activity in RIPEstat Using M-Lab Data

As a result of the cooperation between the RIPE NCC and Measurement Lab (M-Lab), you can now ...

more ...