Sorry, quick flurry of notes all at once now that things are wrapping up. ^_^;; Matt 2008.02.19 Aftershocks from Taiwan Earthquake Two presentations, and the IPv6 hour is starting now... Randy Bush has some things to say about the IPv6 hour. The IPv4 LANs have been turned off; you will note that you don't have good v6 connectivity even if you're a v6 expert. Failure is as good as success for this. Thunderbird and Firefox have v6 DNS resolution turned off by default. Macintosh--if you put in v6 DNS server IP address, if you have capital A in it, it drops it! ISC DHCPv6 has issues Cisco NAT-PT has issues Linux based NAT-PT substituted in isn't scaling. So, we've learned a LOT already! The experiment has already been an excellent success as far as Randy is concerned. So, on to the talk. Martin Brown from Renesys will talk about the Taiwan earthquake analysis. With contributions from Alin, Todd, and Earl, all from Renesys. Will look at shape of aftereffects, and then will look at fallout, the shift in transit patterns. Large earthquake hit Luzon Strait, south of Taiwan on 26 Dec 2006 7 of 9 cables were severed in strait reviewed at APRICOT in Bali in 2007 2 not cut: Asia Netcom's EAC, and Guam-Philippines All cables reported reported on Feb 14, 2007. Renesys is like route views, but they do way more processing on the data. Adjacent or 1 hop away from 65% of all internet transit providers Focus on prefixes geo-located in Asia region. Defines what a network outage is, what unreachable means, and what unstable/flapping networks are. Pattern of taiwan earthquakes; shape of impact. ramping up of outages and spikes in instabilities. smaller quake on dec 27th Recovery pattern is typically noisy Outages/immediate aftermath of the quake, 10 days. 4 or 5 big quakes on the 26th, but outage ramps up slowly; the 27th quake has huge spike after that, much like last stick in Jenga. Almost 4000 networks suffered an outage due to the quakes. China, Indonesia, India hit very hard by it. Instabilities, same basic shape, more noisyness to it. same countries hit for outages and instability. Looked at the severity of impact; factor out baseline instability and outage for each country; compare that median to the peak; china/hong kong hit worst. About 70 times more outages in peak at hong kong as a result of the outage, 55 times more in taiwan For instability, china showed 1300 times more instability in 10 days after quake as in 2 weeks before the quake. what did it look like after the event, who went to new providers? Looked at transit relationships, mapped them into market regions, and ranked them based on size. So, score first, then rank. they geolocate all prefixes first of all, give it a location give score to prefix based on length pre-cidr are discounted, probably less well utilized also look at transit patterns for that prefix. ignore any more specifics that share same transit pattern. Now looking at all AS-to-AS relationship; they track all adjacencies on net. Will categorize the nature of the edge. computationally expensive, but lets them track all the relationships. gives a way to sum a score to a geo location or market. relationship between scores is important for ranking, the raw score doesn't matter. Don't show traffic volumes, profit, customer satisfaction, etc. If you have a retail score, if you show up adjacent in a market. probably in the region. Sprint is biggest transit for Sprint; but not much of a retail edge there. Can look at trend, see who gains or loses market share. coloured countries on map are most affected by quake. Look at the changes in the region since quake. compare by size, by deltas, and who gains, and who lost? India gained, Vietnam more than doubled in size four of 22 countries affected, look at the breakdown of who serves them. Can see which edges are interesting, and see who is growing. CW, tiscali, seabone/TI Fairly clear the transit patterns shifted as result of quake. Chunghua provided transit during the aftermath until the restoration. ATT lost Hanaro at quake, then VSNL dropped during time of repair, lost a bit of Asia Netcom, did well with Bharti. SingTel did very well; picked up China Netcom towards end of year; Vietnam Telecom chose singtel PCCW jumped 10 points, picked up starhub out of singapore close to cable repair point. telecom italia jumped 15 places in ranking; they got singtel, but no sharp jump in prefixes. simple metric of prefixes over time doesn't show whole story. Need to also see how *many* people chose the prefix over time. So new edge score is PPT (prefix, peers, time) sum the amount of time the peer saw the prefix routed on the edge during a time interval all prefixes have same weight cannot distinguish between an edge with a lot of prefixes seen by a few, and an edge with a few prefixes seen by many. In the aftermath of the quake, world prefers to use telecom italia to reach singtel. CW gains big in India, Bharti, TM net, jumps huge in the chart. Tiscali gains from Asia Netcom, 6000 prefixes, and wins providers in Hong Kong, Philippines Chinese providers grew, but didn't grow relative to other providers, so they dropped ranks. Still living with fragile internet, in asia and middle east; the cuts in mediterranean region from yesterday highlight that. Need more diversity in the region, both east and west. Q: CNET networks--were you able to detect partitioning, where japan could get to china, but not US, for example? Most likely, but they didn't focus on looking for that in this analysis. Q: Alin, Renesys, Telecom Italia and Singtel were peering before quake; after quake, relationship changed to transit, the prefixes shifted, and were picked up by rest of net. Q: Paul Ferguson, can you draw 30,000 foot view of impact of quake to the middle east cuts, to show relative impact of outages? They can can do that. Taiwan outages were 2.5x as bad as Alexandria, but press impact was higher. After taiwan quake, huge drop in spam and botnet attacks. Todd asks if that means he doesn't think the middle east is as good at spamming as Asia?