Quick question about inbound route-selection

Anton Kapela tkapela at gmail.com
Fri Jul 17 12:45:11 CDT 2009


Drew,

> (in theory, and based upon number of peers, data): If you have a network with these upstream connections to the Internet you should see inbound traffic utilization in this order:
>
> AS   Name
> ---------
> 3356 Level3
> 7018 ATT
> 3549 Global Crossing
> 4323 Time Warner Telecom
> 10796 TimeWarnerCable/RR

In short (and not to repeat what others have said, but simply point
out a different reason), the Internet is an example of a large
anisotropic system. The implication for 'inbound traffic distribution'
will not only depend in Neighbor-AS policies (upstream of your own AS,
mind you), but equally (if not moreso) on the traffic matrix your
users (or host systems, applications, etc) generate as a consequence
of their activities.

Almost entire decoupled from "pull heavy," "push heavy," or so-called
"balanced" (in the bits/sec sense) traffic patterns, quite simply,
"what you're doing" will influence the distribution. This will change
over time, too, especially if the source of the traffic reaching you
via 3356 experiences a change in a business relationship (174 and 3356
de-peer, again).

> I am trying to determine why I am seeing it in this order:
>
> 3356 Level3
> 4323 Time Warner Telecom
> 3549 Global Crossing
> 10796 TimeWarnerCable/RR
> 7018 ATT

Netflow or sflow will likely shed light on "why?" with a higher degree
of certainty than AS-AS adjacencies. Knowing both the rendezvous
mechanism and the application inducing the flow(s) would be the first
step to answering "why did that reach us via (3) and not some other
edge we know exists?"

Additionally, how apps discover both the network and content is a
topic being explored by several researchers and operators, and may be
relevant to your question. You may be able to tease out further data
by considering these mechanisms as you go about monitoring. Dave
Plonka is working on as much, but as of yet, I can't find a paper -
only presentations [*].

Best,

-Tk

[*]: "Rendezvous-based Network Traffic Analysis" -
http://www.cio.wisc.edu/events/lockdown/09/presentations.aspx#plonka




More information about the NANOG mailing list