Cases Analysis
We present the analysis of some networks and services, from which we can deduct some conclusions about the effect of the earthquake on the normal behaviour of Internet
Chilean Networks Visibility
For more detail see Visibility Chilean Networks (complete study by Niclabs)
For a better understanding of the indicators, see visibility calculation
Niclabs developed a monitor to measure visibility of Chilean networks from the 13 collectors of the RIPE RIS Proyect . Measures are done once a day at 5:00 Chilean Local Time. By this data we got the following indicators:
- Country announced percentage: It is the percentage of Chilean IP addresses that are present in any of the collectors. It is normal that it is not 100%, becayse there are some network blocks not used. It should be stable on time.
- Country visibility percentage: It is the percentage of Chilean IP addresses that are present in the 13 collectors. It should be the same as the announced.
- Anounced and not visible: It is the difference between the announced percentage and the visible percentage. It should be 0%
- Not Announced: It is the complement of the announced percentage
- Visible w/r Normal: It is the percentage visible of the country with respect to a referencial value. This value is the maximum among the visibility in a given interval. It should be 100%.
From a total of 416 companies with IPv4 networks, representing 682 disjoint networks, the analysis between the 25F and the 1M gives the following results:
| %Announced | % Visible | % Announced and not Visible | % Not Announced | % Visible w/r Normal 1) | |
|---|---|---|---|---|---|
| 02/25/10 | 82,05% | 82,05% | 0,00% | 17,95% | 100,00% |
| 02/26/10 | 81,88% | 81,88% | 0,00% | 18,12% | 99,79% |
| 02/27/10 | 31,10% | 29,99% | 1,11% | 68,90% | 36,55% |
| 02/28/10 | 78,40% | 78,37% | 0,03% | 21,60% | 95,51% |
| 03/01/10 | 79,53% | 79,51% | 0,02% | 20,47% | 96,90% |
In conclusion, we can see that the 27F at 5:00 a big part of the Chilean Internet was unreachable. The most important indicator is the last column, it should be 100%, the 27 it shows 36,55% indicating that a 63,45% of the Chilean Internet was not on the route tables of the world. Also, we can see that the next days there was a below normal percentage, but better than the 27.
DNS
For more detail see DNS NIC Chile
The behavior of DNS queries for .CL was affected by the earthquake, generating a big load on servers outside of Chile and almost zero traffic on the servers inside Chile, which were 100% operative, connected and answering. On the presented images we can see the stability of traffic and the partition of it is very predictable by the day and hour, being lower on weekends. Since the earthquake (Saturday morning) to the day after (Sunday), the traffic and distribution is not normal.
- DNS queries for .CL are abnormal the day of the earthquake
- There is a notable grow in the DNS queries for .CL on secondary servers of: Los Angeles, Sao Paulo and Prague
See slides of DNS queries NIC Chile
Our hypothesis is that the portion of the Chilean Internet that survived the failure was disconnected form most of the NIC Chile servers inside the country, so they had to ask the secondary servers: Los Angeles (USA), Sao Paulo (Brasil) and Prague (Czech Republic).
BGP
We present cases related to the networks's visibility during the earthquake, analyzing the BGP route tables. The tools and data for the analysis was from BGPlay monitor and RIPE RIS Raw Data. The cases were choosen almost at random, because there are important Chilean prefixes that we though in that moment.
The graphics shown are the paths that distinct Autonomous Systems use to reach the Autonomous System announcing the prefix (marked in red).
From all those cases, just Movistar's prefix was active and present on 27 February 2010.
