Presentations
Route Withdrawal Timeseries
As referenced in the Blackout Results in Widespread Network Outages Report
The blackout resulted in an Internet-wide burst of BGP withdrawal messages. The first plot above, though complicated, contains a lot of information about the time process of the withdrawal of routes to various networks. Each row in the plot describes a timeseries of the number of withdrawn routes sent from one of dozens of routers located in the U.S., Europe, Africa, Australia, and Asia. On the horizontal axis is time, and the vertical axis represents the number of withdrawn routes every 3600 seconds.
The highest spikes are transient, uncorrelated events affecting single routers. The alignment of high withdrawal peaks sent from every router around the number-3 blue label (16:11 EDT) is the surge in withdrawals due to the blackout. The second plot shows a zoom-in on the onset of the blackout, where the timeseries shows the number of withdrawn routes at a finer resolution (every 300 seconds).
Note that the baseline level of withdrawals both before and after the blackout event is quite high and very noisy. Many routers withdraw on the order of 1000 routes per hour even before the blackout. Throughout the period starting August 11th, MS Blaster scanning activity caused higher than normal levels of network outages due to maintenance, edge router failures, and other collateral damage.
The first 24 hours of the plot show the relatively calm baseline withdrawal behavior that existed before the worm. The hourly withdrawal level rises and becomes consistently more noisy starting on Monday the 11th.
« Back to the Blackout Results in Widespread Network Outages Report