Skip to main content

Case Study 1 - Unreachable Prefixes From BGP Point of View (Egyptian Prefix)

Introduction

Due to the fibre cuts, some prefixes were unreachable for a significant time period. We analysed the effects of the FEA fibre cut on the prefixes originated by AS20484 (Yalla Online, Egypt).

Routing States of a Prefix Originated by AS20484 - BGPlay screenshots

We looked at the routing dynamics of the prefix 196.20.62.0/24 (originated by AS20484), using BGPlay. The following figures show some of the key routing changes the prefix underwent. Overall, the prefix was completely disconnected from the Internet for about 11 days.

10:38 (UTC), 30 January 2008: Some hours after the fibre cut, the prefix is still reachable by most of the RIS peers:

20484-before-fault.png

10:41 (UTC), 30 January 2008: In a few minutes the prefix has lost all its paths towards RIS peers. The path still shown connecting AS20848 and AS21475 (ISP Global Ukraine LAN Lviv, Ukraine) is the last to go. It was withdrawn some seconds after the time of this snapshot:

20484-after-fault.png

10:58 (UTC), 5 February 2008: For a very short time period, the prefix temporarily regained its connectivity to the Internet:

20484-temp-recovery.png

14:56 (UTC), 10 February 2008: First signs of recovery, route announcements start to arrive at the RIS peers:

20484-before-recovery.png

15:34 (UTC), 10 February 2008: All the RIS peers are observing the prefix again:

20484-after-recovery.png

Cross Prefix Analysis - BGPath screenshots

We also looked at the routing dynamics of all the prefixes originated by AS20484, and other prefixes' usage of the AS20484-AS8452 link, using the BGPath tool.

Path Evolution of All the Prefixes Originated by AS20484

All the prefixes originated by AS20484 and using AS8452 (TEDATA) as upstream provider either changed their paths or completely lost their connectivity to the Internet for the whole period.

20484-path-evolution.png

The AS-link 20484-8452 usually carries about 50 prefixes. The following plot shows that all these prefixes stopped using the link during the morning of 30 January 2008. Because the timing of that event does not align with the known start times of the cable outages, the link may have been shutdown by human operator intervention.

20484-rank-20484-8452.png

Conclusions

This analysis shows that from 30 January 2008 to 10 February 2008, the AS-link 20484-8452 experienced some major event. All the prefixes usually passing through this link