The AS-level Connectivity Observatory

1. Google's route leakage
   

   The above figure shows Google's (AS 15169) activity graph from 2004 to 2008. There is a big spike in the graph, it is obviously an unusual event. To investigate what happened with that spike, we move the sliding window to the time period, double-click in the window to visualize it, and obtain the following topology graph.

   On 18 July 2006, Google has 36 new links. However, on the next day, all these new links disappeared and have an age of zero days. This strongly indicates that Google leaked several routes that are for its peers and should not be advertised on 18 July 2006, but the problem was quickly fixed. With the topology graph in visualizer, we can have a general idea of what type and size of ASes are involved in this leakage. On the other hand, the web interface provides a quick way to browse connectivity details. Users can use the web interface and sort the link changes of Google around that time with lifetime property. The following figure shows a part of the list of leaked links, which have zero days lifetime.

   
   

2. Yahoo's Outage
   

   Several sites, including Yahoo (AS 10310), were unreachable on 6 July 2007. We examined Yahoo's connectivity around that time to see if there was any anomalous change resulted in the outage.

   The above figure shows that Yahoo has only one change of new peering with AS 9318 around that day. However, that link quickly disappeared on the next day, which seems to be suspicious. Since there is no other change in Yahoo's connectivity, we suspected that the outage might be related to AS 9318. Using the expansion function in Cyclops, we can easily navigate our view to AS 9318's connectivity and found that it anomalously leaking several routes, which caused Yahoo's outage.

   
   

3. Cogent De-peering
   

   In September 2007 there was a discussion thread on the NANOG mailing list about whether Cogent de-peered with Limelight Networks, nLayer Communications, and WV Fiber. Several people tried to figure out what happened to Cogent by different methods, such as traceroute and looking at RouteView data, but they obtained different results. With Cyclops, people can figure out how Cogent's connectivity changes are observed with public BGP data by simply inputting Cogent AS number and the time period.

   The above figure shows changes in Cogent connectivity from 14 to 30 September 2007. The topology graph filters out the new links to new nodes and dead links to dead nodes, focusing on new peerings and de-peerings. We can see that Cogent de-peered with WV Fiber (AS 19151) on 18 September and Limelight (AS 22822) on 28 September, but it did not de-peer with nLayer. The result is consistent with the conclusion of the discussion thread later.