Traffic shaping going on?

2013-05-08 Thread Ray Wong
Doesn't seem directly correlated with outages, and everything seems to be
working ok, but I'm seeing about a 20-30% shift in flows from AS7792 to
AS3356. Seems unlikely that many ISPs have suddenly turned up a level3 link
on the same day/hour, and performance metrics all seem normal. I confess
I've had to turn my attention away from network issues to
systems/DB/security ones lately, so I may have missed something. Anyone
else seeing fairly significant next hop shifts over the previous 24 hours?
All of yesterdays major outages I was sort of suspecting seem to have been
resolved without correlating shifts back.

-R


Re: Traffic shaping going on?

2013-05-08 Thread Jared Mauch

On May 8, 2013, at 10:54 AM, Ray Wong r...@rayw.net wrote:

 Doesn't seem directly correlated with outages, and everything seems to be
 working ok, but I'm seeing about a 20-30% shift in flows from AS7792 to
 AS3356. Seems unlikely that many ISPs have suddenly turned up a level3 link
 on the same day/hour, and performance metrics all seem normal. I confess
 I've had to turn my attention away from network issues to
 systems/DB/security ones lately, so I may have missed something. Anyone
 else seeing fairly significant next hop shifts over the previous 24 hours?
 All of yesterdays major outages I was sort of suspecting seem to have been
 resolved without correlating shifts back.

Just a random guess:

Level3 could be migrating/integrating further networks which has triggered this 
shift.  They do represent over 50% of the networks out there

http://as-rank.caida.org/?mode0=as-rankingn=50ranksort=1

You can see here they have 51% of AS'es and 55% of IPv4 prefixes behind them.

If you look at the combined, it's even more @69%/72% here:

http://as-rank.caida.org/?mode0=org-infomode1=member-asesorg=LVLT-ARIN

- Jared