<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0">
   <channel>
      <title>Renesys Blog</title>
      <link>http://www.renesys.com/blog/</link>
      <description></description>
      <language>en</language>
      <copyright>Copyright 2009</copyright>
      <lastBuildDate>Mon, 22 Jun 2009 06:30:00 -0500</lastBuildDate>
      <generator>http://www.sixapart.com/movabletype/?v=4.25</generator>
      <docs>http://blogs.law.harvard.edu/tech/rss</docs> 

      
      <item>
         <title>The Proxy Fight for Iranian Democracy</title>
         <description><![CDATA[<p>If you put 65 million people in a locked room, they're going to find all the exits pretty quickly, and maybe make a few of their own.  In the case of Iran's <a href="http://www.renesys.com/blog/2009/06/iran-and-the-internet-uneasy-s.shtml">crippled-but-still-connected Internet,</a> that means finding a continuous supply of <a href="http://en.wikipedia.org/wiki/Squid_cache"><strong>proxy servers</strong></a> that allow continued access to unfiltered international web content like Twitter, Gmail, and the BBC. </p>]]></description>
         <link>http://www.renesys.com/blog/2009/06/the-proxy-fight-for-iranian-de.shtml</link>
         <guid>http://www.renesys.com/blog/2009/06/the-proxy-fight-for-iranian-de.shtml</guid>
         <category>Internet</category>
         <pubDate>Mon, 22 Jun 2009 06:30:00 -0500</pubDate>
      </item>
      
      <item>
         <title>Iran and the Internet: Uneasy Standoff</title>
         <description><![CDATA[
<p>We've received enough interest about our <a href="http://www.renesys.com/blog/2009/06/strange-changes-in-iranian-int.shtml">previous notes on Iranian Internet connectivity</a> that I wanted to give a brief update, and some reflections.</p>]]></description>
         <link>http://www.renesys.com/blog/2009/06/iran-and-the-internet-uneasy-s.shtml</link>
         <guid>http://www.renesys.com/blog/2009/06/iran-and-the-internet-uneasy-s.shtml</guid>
         <category>Internet</category>
         <pubDate>Tue, 16 Jun 2009 16:21:25 -0500</pubDate>
      </item>
      
      <item>
         <title>Strange Changes in Iranian Transit</title>
         <description><![CDATA[
Many media sources have reported <a href="http://www.cbsnews.com/stories/2009/06/14/world/main5087285.shtml">outages</a> in Iranian mobile networks and Internet services in the wake of Friday's controversial elections.   We took a look at the state of Iranian Internet transit, as seen in the aggregated global routing tables, and found that the story is not as clear-cut as has been reported.

]]></description>
         <link>http://www.renesys.com/blog/2009/06/strange-changes-in-iranian-int.shtml</link>
         <guid>http://www.renesys.com/blog/2009/06/strange-changes-in-iranian-int.shtml</guid>
         <category>Politics</category>
         <pubDate>Sun, 14 Jun 2009 07:33:22 -0500</pubDate>
      </item>
      
      <item>
         <title>How a Resilient Society Defends Cyberspace</title>
         <description><![CDATA[<p>Seventy-five years ago today, on May 29th, 1934, Egyptian private radio stations fell silent, as the government shut them down in favor of a state monopoly on broadcast communication. Egyptian radio "hackers" (as we would style them today) had, over the course of about fifteen years, developed a burgeoning network of unofficial radio stations. They offered listeners an unfiltered, continuous mix of news, gossip, and live entertainment from low-powered transmitters located in private houses and businesses throughout Cairo.</p>

<p>It couldn't last. After two days of official radio silence, on May 31st, official state-sponsored radio stations (run by the Marconi company under special contract) began transmitting a clean slate of government-sanctioned programming, and the brief era of grass-roots Egyptian radio was over.</p>]]></description>
         <link>http://www.renesys.com/blog/2009/05/how-a-resilient-society-defends-cyberspace.shtml</link>
         <guid>http://www.renesys.com/blog/2009/05/how-a-resilient-society-defends-cyberspace.shtml</guid>
         <category>Politics</category>
         <pubDate>Fri, 29 May 2009 21:45:48 -0500</pubDate>
      </item>
      
      <item>
         <title>Reaching Google via Asia?</title>
         <description><![CDATA[
<p>
Across the Internet, yesterday, Google users twittered, blogged and emailed that Google search and mail were not usable.    And, yesterday afternoon, on 
<a href="http://googleblog.blogspot.com/2009/05/this-is-your-pilot-speaking-now-about.html">Google's official blog</a>, Urs Hoelzle reported that Google "direct[ed] some [...] web traffic through Asia".
</p>
]]></description>
         <link>http://www.renesys.com/blog/2009/05/google-ntt.shtml</link>
         <guid>http://www.renesys.com/blog/2009/05/google-ntt.shtml</guid>
         <category>Engineering</category>
         <pubDate>Thu, 14 May 2009 20:42:17 -0500</pubDate>
      </item>
      
      <item>
         <title>AfNOG Takes Byte Out of Internet</title>
         <description><![CDATA[<p>
A couple of months ago,
we discussed how a small 
<a href="http://www.renesys.com/blog/2009/02/the-flap-heard-around-the-worl.shtml">Czech provider</a>
ended up causing global Internet mayhem by tickling a Cisco bug via a rather ridiculous routing announcement.
While it's easy to fault the instigator of this meltdown,
ultimate responsibility belongs with the vendors of poorly tested code.
If we've learned anything in decades of software engineering,
it is that you can't assume anything about user input.
If you don't check that input for validity,
you are not just being careless, 
you are creating a time bomb that will eventually go off.
Another such bomb went off on Sunday, 3 May 2009,
taking out a large swath of the Internet.
We recount the sorry tale here.
</p>]]></description>
         <link>http://www.renesys.com/blog/2009/05/byte-me.shtml</link>
         <guid>http://www.renesys.com/blog/2009/05/byte-me.shtml</guid>
         <category>Engineering</category>
         <pubDate>Tue, 05 May 2009 15:47:11 -0500</pubDate>
      </item>
      
      <item>
         <title>The Blind Routing the Blind</title>
         <description><![CDATA[<p>
In our 
<a href="http://www.renesys.com/blog/2009/03/compliance-scoring-by-country.shtml">last blog entry</a>,
we talked about measuring the state of routing anarchy that exists on the Internet on a per-country basis.
We looked at every routed network (prefix) by country of origin and tried to answer the question: do folks
<em><a href="http://www.youtube.com/watch?v=lzymBKGV8rw">do what they say and say what they do</a></em>,
as articulated via routing registries?
Although many manage to administer their routes with care,
the overall results are quite varied.
And without some way of verifying routes via some authoritative source, 
we are left only with the current system of believing everything we're told and hoping for the best.
The dangers of such a system are 
<a href="http://www.renesys.com/blog/2008/02/pakistan-hijacks-youtube-1.shtml">demonstrated dramatically</a> from time to time.
</p>

<p>
Although they certainly could,
countries typically don't exercise any control over the routing hygiene of the companies operating within their borders.
Countries might tax those companies, 
<a href="http://map.opennet.net/">filter their traffic</a> for objectionable content, 
mandate the types of software or equipment they can use and even spy on them, 
but if a company wants to screw up routing on the global Internet, 
well that's their business.
As we've noted in 
<a href="http://www.renesys.com/blog/2009/02/the-flap-heard-around-the-worl.shtml">the past</a>,
no driver's license is required on the Information Superhighway,
as there are essentially no rules, regulations or enforcement.
So in this blog entry,
we'll apply our scoring idea to those who can easily effect change,
namely, those organizations who are ultimately responsible for how traffic flows on the Internet.
<p>]]></description>
         <link>http://www.renesys.com/blog/2009/05/keeping-score.shtml</link>
         <guid>http://www.renesys.com/blog/2009/05/keeping-score.shtml</guid>
         <category>Internet</category>
         <pubDate>Mon, 04 May 2009 06:00:00 -0500</pubDate>
      </item>
      
      <item>
         <title>Route Hygiene: The Dirt on the Internet</title>
         <description><![CDATA[<p>
Since Renesys maintains large quantities of data on the Internet going back many years, 
we sometimes get the question:  
<em>If you guys are watching the entire 'net, 
why don't you just warn people when things break?</em>
My response is generally along the lines of:
<em>Sure we can do that.
Simply tell us the correct state of the Internet at each moment in time 
and we'll alert you to any operational differences we observe.</em>
This is generally met with silence.
</p>

<p>
Renesys can tell you a lot about the <em>current</em> state of the Internet,
but absolutely no one can tell you the <em>correct</em> state.
And that is because no one is in charge,
and so there is no central authoritative source of information. 
Think of the Internet as a highway system where anyone can buy a car and simply start driving:
no need to register the car, attach a license plate, buy insurance or get a 
<a href="http://www.renesys.com/blog/2009/02/the-flap-heard-around-the-worl.shtml">driver's license</a>.
You don't even have to show an id or be sober.  
Just pay some fees, buy some equipment, hook up and go.
The barrier to entry really is that low.
</p>

<p>
Obviously, this arrangement can cause some problems.
When
<a href="http://www.renesys.com/blog/2008/02/pakistan-hijacks-youtube-1.shtml">Pakistan hijacked YouTube</a> last year by announcing YouTube IP space, 
out of the hundreds of thousands of routing announcements seen on Internet,
how was anyone to know this particular one was incorrect?
Okay sure, you couldn't get your videos, 
but maybe YouTube had just opened a data center in Karachi and the problem was internal to them?
Without some way of checking the authenticity of routes,
the routers that direct traffic on the Internet simply believe what they are told.
And if the best route to YouTube appears to be via Pakistan, 
then they are all going to use it, no questions asked.
This is not a new problem, and this blog explores an old and largely failed attempt to address it.
We then compare the differences between countries with respect to their routing hygiene.
</p> ]]></description>
         <link>http://www.renesys.com/blog/2009/03/compliance-scoring-by-country.shtml</link>
         <guid>http://www.renesys.com/blog/2009/03/compliance-scoring-by-country.shtml</guid>
         <category>Internet</category>
         <pubDate>Wed, 25 Mar 2009 15:00:00 -0500</pubDate>
      </item>
      
      <item>
         <title>Longer is not always better</title>
         <description><![CDATA[<p>
This post is a follow-up to 
<a href="http://www.renesys.com/blog/2009/02/the-flap-heard-around-the-worl.shtml">our blog last week</a>
about a small Czech provider briefly causing global Internet mayhem
via a single errant routing announcement.
In this incident,
SuproNet (AS 47868) announced its one prefix, 94.125.216.0/21, to its backup provider, Sloane Park Property Trust (AS 29113), with an extremely long AS path.
We've gotten more feedback about this entry than any other in recent memory, 
so we thought we'd try to answer some of the questions that were posed both here and elsewhere, 
as well as provide some clarification about exactly what went on.
The questions we try to address include:
<ul>
	<li>How could anyone be this dumb?</li>
	<li>Why did this cascade throughout the planet?</li>
	<li>Can you provide more details about the impact and its spread?</li>
	<li>How do we prevent this from happening again?</li>
</ul>
</p>]]></description>
         <link>http://www.renesys.com/blog/2009/02/longer-is-not-better.shtml</link>
         <guid>http://www.renesys.com/blog/2009/02/longer-is-not-better.shtml</guid>
         <category>Engineering</category>
         <pubDate>Sat, 21 Feb 2009 14:30:30 -0500</pubDate>
      </item>
      
      <item>
         <title>To Catch a Thief</title>
         <description><![CDATA[<p>
Last August at 
<a href="http://www.defcon.org/html/defcon-16/dc-16-post.html">DEFCON</a>,
Alex Pilosov and Tony Kapela presented a talk entitled
<a href="https://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-pilosov-kapela.pdf">Stealing the Internet: An Internet Scale Man-In-The-Middle Attack</a>,
which illustrated a technique for misdirecting specific Internet traffic via carefully constructed BGP routing messages.
Using this approach, 
an attacker can redirect the incoming traffic of <em>any </em> victim through his own site for further inspection or alteration before ultimately passing it on to the victim.
Furthermore, the attack can be carried out in a way that is largely transparent to the victim.
Since this talk,
Renesys staff have been repeatedly asked "So are people using this technique today?"
That is, are people currently "stealing the Internet", and if so, who is attacking whom?
Given the volume of routing data that Renesys has at our disposal and the number of tools we have to slice and dice it, 
we thought this would be a relatively straightforward question to answer.  
<em>We were wrong.</em>
</p>

<p>
Although we ultimately succeeded in answering the question and in developing a general Man-In-The-Middle (MITM) detection algorithm for the global Internet,
we ended up writing a lot of code over the course of several months and burning through endless CPU cycles looking for attack evidence.
Our results were presented this week at
<a href="http://www.blackhat.com/html/bh-dc-09/bh-dc-09-main.html">Black Hat</a>
and the complete presentation can be found
<a href="http://www.renesys.com/tech/presentations/pdf/blackhat-09.pdf">here</a>.
In this blog, we'll hit on some of the highlights from the presentation.
</p>]]></description>
         <link>http://www.renesys.com/blog/2009/02/stealing-the-internet-back-1.shtml</link>
         <guid>http://www.renesys.com/blog/2009/02/stealing-the-internet-back-1.shtml</guid>
         <category>Engineering</category>
         <pubDate>Thu, 19 Feb 2009 14:45:00 -0500</pubDate>
      </item>
      
      <item>
         <title>Reckless Driving on the Internet</title>
         <description><![CDATA[<p>
This weekend, 
John Markoff wrote an interesting piece for the New York Times entitled 
<a href="http://www.nytimes.com/2009/02/15/weekinreview/15markoff.html">Do We Need a New Internet?</a>
While his emphasis was largely on security, or rather the lack thereof, 
the central point Markoff makes is that the Internet may be so hopelessly broken that it could be better to start over,
rather than continue to apply band-aids.
As if to emphasize this point, 
<a href="http://www.supro.cz/">SuproNet</a>, a local Czech provider,
single-handedly caused a global Internet meltdown for upwards of an hour today.
SuproNet accomplished this feat by sending out a rather unusual routing update,
one which a lot of routers did not handle very well.
The result was Internet bedlam.
</p>]]></description>
         <link>http://www.renesys.com/blog/2009/02/the-flap-heard-around-the-worl.shtml</link>
         <guid>http://www.renesys.com/blog/2009/02/the-flap-heard-around-the-worl.shtml</guid>
         <category>Engineering</category>
         <pubDate>Mon, 16 Feb 2009 22:40:00 -0500</pubDate>
      </item>
      
      <item>
         <title>&quot;The Adventurous Parts of the Internet&quot;</title>
         <description><![CDATA[
I just spent a very pleasant 3 days attending <a href="http://nanog.org/meetings/nanog45/index.php">NANOG 45</a> in the Dominican Republic.   The whole thing was a whirlwind of peering, technical presentations, and catching up with the people who keep the North American parts of the internet backbone alive.   What can I say? The DR is overflowing with friendly people, great food, warm breezes (82F in Santo Domingo, versus 0F at my house in New Hampshire), and very decent Presidente beer.   Very conducive to thinking the big thoughts.  The trick is to write them down ...<p>]]></description>
         <link>http://www.renesys.com/blog/2009/01/the-adventurous-parts-of-the-i.shtml</link>
         <guid>http://www.renesys.com/blog/2009/01/the-adventurous-parts-of-the-i.shtml</guid>
         <category>Economics</category>
         <pubDate>Wed, 28 Jan 2009 11:40:26 -0500</pubDate>
      </item>
      
      <item>
         <title>Internet Year in Review 2008</title>
         <description><![CDATA[ <p>
It's been an interesting year in many ways, 
not least of which for the Internet.
This year, I started to contribute in earnest to the Renesys blog and back in January I was wondering 
"How am I going to find anything interesting to talk about on a regular basis?
Nothing much happens on the Internet, right?"
Well, it certainly did this year and now I've got many more ideas than I have time to research and write about.
In hindsight, I guess it isn't too surprising.
As the world becomes more interconnected and more Internet-dependent,
we're bound to bump into each other more and expose the limitations of the current system.
So let's review what 2008 brought us and take a guess at what is in store for the new year.
</p>]]></description>
         <link>http://www.renesys.com/blog/2008/12/internet-year-in-review-2008.shtml</link>
         <guid>http://www.renesys.com/blog/2008/12/internet-year-in-review-2008.shtml</guid>
         <category>Internet</category>
         <pubDate>Mon, 29 Dec 2008 08:15:00 -0500</pubDate>
      </item>
      
      <item>
         <title>Deja Vu All Over Again: Cables Cut in the Mediterranean</title>
         <description><![CDATA[<p>
The end of the year is approaching which seems to be a harbinger of
Internet disasters. Four years ago (on 24 Dec. 2004), <a href=http://renesys.com/tech/presentations/pdf/renesys-nanog34.pdf>TTNet</a> significantly
disrupted Internet traffic by leaking over 100,000 networks that were
globally routed for about an hour. Two years ago (on 26 Dec.
2006), large <a href=http://renesys.com/tech/presentations/pdf/nanog39.pdf>earthquakes</a> hit the Luzon Strait, south of Taiwan, severing
several underwater cables and wreaking havoc on communications in
the region. Last year there was a small delay. On 30
Jan. 2008, more underwater cables were severed in the <a href=http://renesys.com/tech/presentations/pdf/nanog42-lightning.pdf>Mediterranean</a>, severely
disrupting communications in the Middle East, Africa, and the Indian
subcontinent.
</p>

<p>
Calamity returned to its customary end-of-year schedule this year, when early today (19 Dec. 2008) several communications cables were <a href=http://www.bloomberg.com/apps/news?pid=newsarchive&sid=aBa0lTN.dcoQ>severed</a>, affecting traffic in the Middle East and Indian subcontinent. According to a <a href=http://www.orange.com/en_EN/press/press_releases/cp081219en.html>press release</a> by France Telecom three major cables were damaged:
<a href="http://en.wikipedia.org/wiki/South_East_Asia-Middle_East-Western_Europe_4">Sea-Me-We 4</a> at 7:28 UTC, <a href="http://en.wikipedia.org/wiki/SEA-ME-WE_3_(cable_system)">Sea-Me-We 3</a> at 7:33 UTC, and <a href="http://en.wikipedia.org/wiki/FLAG_Telecom#Segment_FLAG_Europe_Asia_.28FEA.29">FLAG FEA</a> at 8:06 UTC. It appears that the SMW3 cable was only partially cut, the SMW4 cable was completely cut, while the FLAG cable was "observed down" with no other information given. The location of the cut appears to be between Sicily and Tunisia in a section which is the responsibility of Egypt Telecom. The causes of the cut remained unclear. It seems that ships were deployed to repair the damaged cables, but no ETA was given.
 </p>]]></description>
         <link>http://www.renesys.com/blog/2008/12/deja-vu-all-over-again-cables.shtml</link>
         <guid>http://www.renesys.com/blog/2008/12/deja-vu-all-over-again-cables.shtml</guid>
         <category>Engineering</category>
         <pubDate>Fri, 19 Dec 2008 21:23:00 -0500</pubDate>
      </item>
      
      <item>
         <title>Rising to the Top:  A Baker&apos;s Dozen</title>
         <description><![CDATA[<p>
As readers of this blog will know, 
Renesys collects Internet routing data &mdash; a lot of it.
We use this data in a variety of ways:
in determining the impact of 
<a href="http://www.renesys.com/blog/2008/01/mediterranean-cable-break.shtml">cable breaks</a>,
<a href="http://www.renesys.com/blog/2008/09/ike-brings-biggest-multistate.shtml">natural disasters</a> and
<a href="http://www.renesys.com/blog/2008/10/wrestling-with-the-zombie-spri.shtml">deliberate partitionings</a>;
in uncovering the source of
<a href="http://www.renesys.com/blog/2008/02/pakistan-hijacks-youtube-1.shtml">hijacks</a> or other
<a href="http://www.renesys.com/blog/2008/05/identity-theft-hits-the-root-n-1.shtml">questionable activity</a>;
in analyzing
<a href="http://www.renesys.com/products_services/market_intel">Internet business relationships</a>;
and in exploring
<a href="http://www.renesys.com/blog/2008/08/internet-matchmaking.shtml">"what-if"</a> scenarios.
</p>

<p>
All of our reports and products are based on hard facts and objective analysis.
Perhaps the only controversial thing we do with our data is to <em>rank</em> all the service providers in the world: globally, by geography, and by market segment.  
The rankings are a rather crude measure of <em>size</em>, 
as they are based entirely on the quantity of IP space ultimately transited by each provider.
Although there are obvious shortcomings in this approach, 
it is certainly objective and the process is fully automated.
It also happens to be derived from data that is readily available for all providers.
Routing data, unlike most other metrics we could consider using, is inherently public.
</p>

<p>
While everyone wants to be #1 (hence the controversy around rankings),
<em>changes</em> in rank can be far more revealing than the actual rank itself.
In other words,
while there are surely big differences between #1 and #50 in our rankings,
the differences between #5 and #6 are much less clear given the nature of the metric.
What we tend to look for are abrupt changes and long-term trends.
Did a provider just jump in the rankings? 
Maybe they picked up a large customer or a nearby rival lost one?  Who was it?
Is another provider showing steady gains in the rankings?
Maybe they are consistently taking market share with an aggressive, well-executed business plan in a particular part of the world?
This is why changes in rankings matter:
they capture some of the dynamics of the business of providing Internet service.
With this in mind, 
we will take a look at the top 13 providers in the world for 2008 and
how they have jockeyed for position throughout the year.
We will also highlight some of the more interesting changes.
</p>
]]></description>
         <link>http://www.renesys.com/blog/2008/12/winners-and-losers-for-2008.shtml</link>
         <guid>http://www.renesys.com/blog/2008/12/winners-and-losers-for-2008.shtml</guid>
         <category>Business</category>
         <pubDate>Wed, 17 Dec 2008 15:00:00 -0500</pubDate>
      </item>
      
   </channel>
</rss>