2008.02.19 NANOG 42 Taiwan Earthquake Aftermath notes

Wed Feb 20 09:30:55 UTC 2008

Cf Renesys's superb analysis of the FLAG/FALCON/SMW4 cut, it looks like
SingTel are the people to go to for reliable connectivity in Asia (they were
the reconnection champs in January as well).

On Feb 20, 2008 2:03 AM, Matthew Petach <mpetach at netflight.com> wrote:

>
> Sorry, quick flurry of notes all at once now that things
> are wrapping up.  ^_^;;
>
> Matt
>
>
>
> 2008.02.19 Aftershocks from Taiwan Earthquake
>
> Two presentations, and the IPv6 hour is starting
> now...
>
> Randy Bush has some things to say about the IPv6
> hour.
>
> The IPv4 LANs have been turned off; you will note
> that you don't have good v6 connectivity even if
> you're a v6 expert.  Failure is as good as success
> for this.
>
> Thunderbird and Firefox have v6 DNS resolution turned
> off by default.
>
> Macintosh--if you put in v6 DNS server IP address, if
> you have capital A in it, it drops it!
>
> ISC DHCPv6 has issues
>
> Cisco NAT-PT has issues
>
> Linux based NAT-PT substituted in isn't scaling.
>
> So, we've learned a LOT already!  The experiment
> has already been an excellent success as far as
> Randy is concerned.
>
>
> So, on to the talk.
>
> Martin Brown from Renesys will talk about the
> Taiwan earthquake analysis.
>
> With contributions from Alin, Todd, and Earl, all
> from Renesys.
>
> Will look at shape of aftereffects, and then will
> look at fallout, the shift in transit patterns.
>
> Large earthquake hit Luzon Strait, south of
> Taiwan on 26 Dec 2006
> 7 of 9 cables were severed in strait
> reviewed at APRICOT in Bali in 2007
>
> 2 not cut: Asia Netcom's EAC, and Guam-Philippines
> All cables reported reported on Feb 14, 2007.
>
> Renesys is like route views, but they do way more
> processing on the data.
>
> Adjacent or 1 hop away from 65% of all internet
> transit providers
>
> Focus on prefixes geo-located in Asia region.
>
> Defines what a network outage is, what unreachable
> means, and what unstable/flapping networks are.
>
> Pattern of taiwan earthquakes; shape of impact.
> ramping up of outages and spikes in instabilities.
> smaller quake on dec 27th
> Recovery pattern is typically noisy
>
> Outages/immediate aftermath of the quake, 10 days.
> 4 or 5 big quakes on the 26th, but outage ramps up
> slowly; the 27th quake has huge spike after that,
> much like last stick in Jenga.
> Almost 4000 networks suffered an outage due to the
> quakes.
>
> China, Indonesia, India hit very hard by it.
>
> Instabilities, same basic shape, more noisyness to it.
> same countries hit for outages and instability.
>
> Looked at the severity of impact; factor out baseline
> instability and outage for each country; compare that
> median to the peak;
> china/hong kong hit worst.
> About 70 times more outages in peak at hong kong as a
> result of the outage, 55 times more in taiwan
>
> For instability, china showed 1300 times more
> instability in 10 days after quake as in 2 weeks
> before the quake.
>
> what did it look like after the event, who went
> to new providers?
> Looked at transit relationships, mapped them into
> market regions, and ranked them based on size.
> So, score first, then rank.
>  they geolocate all prefixes first of all, give it a
>  location
>  give score to prefix based on length
>  pre-cidr are discounted, probably less well utilized
>  also look at transit patterns for that prefix.
>  ignore any more specifics that share same transit
>  pattern.
>  Now looking at all AS-to-AS relationship; they track
>  all adjacencies on net.  Will categorize the nature
>  of the edge.
>  computationally expensive, but lets them track all the
>  relationships.
>  gives a way to sum a score to a geo location or market.
>
> relationship between scores is important for ranking,
> the raw score doesn't matter.
> Don't show traffic volumes, profit, customer satisfaction,
> etc.
>
> If you have a retail score, if you show up adjacent in
> a market. probably in the region.  Sprint is biggest
> transit for Sprint; but not much of a retail edge there.
>
> Can look at trend, see who gains or loses market share.
>
> coloured countries on map are most affected by quake.
>
> Look at the changes in the region since quake.
> compare by size, by deltas, and who gains, and who lost?
>
> India gained, Vietnam more than doubled in size
>
> four of 22 countries affected, look at the breakdown
> of who serves them.
> Can see which edges are interesting, and see who is
> growing.
> CW, tiscali, seabone/TI
> Fairly clear the transit patterns shifted as result of
> quake.
> Chunghua provided transit during the aftermath until
> the restoration.
>
> ATT lost Hanaro at quake, then VSNL dropped during
> time of repair, lost a bit of Asia Netcom, did well
> with Bharti.
>
> SingTel did very well; picked up China Netcom towards
> end of year; Vietnam Telecom chose singtel
>
> PCCW jumped 10 points, picked up starhub out of
> singapore close to cable repair point.
>
> telecom italia jumped 15 places in ranking; they got
> singtel, but no sharp jump in prefixes.
> simple metric of prefixes over time doesn't show
> whole story.
>
> Need to also see how *many* people chose the prefix
> over time.
> So new edge score is PPT (prefix, peers, time)
> sum the amount of time the peer saw the prefix
> routed on the edge during a time interval
> all prefixes have same weight
> cannot distinguish between an edge with a lot of
>  prefixes seen by a few, and an edge with a few
>  prefixes seen by many.
>
> In the aftermath of the quake, world prefers to
> use telecom italia to reach singtel.
>
> CW gains big in India, Bharti, TM net,
> jumps huge in the chart.
>
> Tiscali gains from Asia Netcom, 6000 prefixes,
> and wins providers in Hong Kong, Philippines
>
> Chinese providers grew, but didn't grow relative
> to other providers, so they dropped ranks.
>
> Still living with fragile internet, in asia and
> middle east; the cuts in mediterranean region
> from yesterday highlight that.  Need more
> diversity in the region, both east and
> west.
>
> Q: CNET networks--were you able to detect
> partitioning, where japan could get to
> china, but not US, for example?
> Most likely, but they didn't focus on
> looking for that in this analysis.
>
> Q: Alin, Renesys, Telecom Italia and Singtel
> were peering before quake; after quake,
> relationship changed to transit, the
> prefixes shifted, and were picked up
> by rest of net.
>
> Q: Paul Ferguson, can you draw 30,000 foot
> view of impact of quake to the middle east
> cuts, to show relative impact of outages?
> They can can do that.
> Taiwan outages were 2.5x as bad as Alexandria,
> but press impact was higher.
> After taiwan quake, huge drop in spam and
> botnet attacks.  Todd asks if that means
> he doesn't think the middle east is as good
> at spamming as Asia?
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20080220/9d542ec4/attachment.html>