Re: [mat-wg] Live Egyptian Internet Incident Analysis

  • To: Mark Dranse markd@localhost, mat-wg@localhost
  • From: Iñigo Ortiz de Urbina inigoortizdeurbina@localhost
  • Date: Sun, 30 Jan 2011 21:14:22 +0100
  • Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:content-type:content-transfer-encoding; bh=a52xCLY6ZLwfa82OsaYeIcbANVSgIYZptyZE9e7iGsc=; b=b3zbd60Fp/jsnavrTVP/dGO7vubPTc/hFjrb72krbA4tJYnG4RipCad53r7nHkcVFm 3bpr/ZH3vfQpgQH5rOZNKIk2aFATXVlKSilFsJvd7sMi/siVRC29JhE/HFPw2ohe4+u5 8IWWeZN65+tUKvLVtmgJF1Ty5tF+OzIV+Gg0A=
  • Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; b=dv5nGYSTIYdNnIn977bJstQND1zxVAGTCEDV+AkGvDRJQafZjrOw0q2YDECKp2GrHT sjiESkItBS7pTvLyVS+oCuqRYYvPMe67ZjMQc2czwysEW/BYDMT0sdCJSTdIfKuQHh0q F7JlnEyyMlsjdN1AptkN2DxcaYyNCm9DM5vtw=

Definitely, this is the kind of effort and coverage I appreciate and
expect from this working group.

The measurement and visualization of these abnormal events provide
easy to share insight, very hard to achieve otherwise.

As Mark just pointed out, effort duplication is something to avoid in
first place, but I do think, also, that putting all the interesting
and meaningful graphs in one single place favours the analysis of the
event in question, mostly for the not so trained eyes.

Not only that, but also duplication of graphs may be worth when using
different datasources, as I presume is the case of Renesys and
RIPEstat. We might see the case where, the same analysis yield
unexpectedly different results, which would in turn raise more
questions: food for thought. Seems to me this working group has its
own reason for existence pretty much justified as it is essential to
understand the network.

In summary, my humble opinion is that the development, design and
promotion of a tool like RIPEstat (bringing together measurement data
from Atlas, DNSmon, RRCs, TTM boxes and external datasets), that can
be used for such different purposes as abnormal event analysis or
delay and loss heatmaps, is pretty much the way to go.

Just the two cents of an enthusiastic student

PS: I hope I stood on-topic. First post around here

On 1/30/11, Mark Dranse markd@localhost wrote:
> Hi Richard,
>
> On 30/01/2011 17:21:02, Richard L. Barnes wrote:
>> Couple of suggestions/questions:
>>
>> -- Could you break out the ASes that are contribute to these graphs?
>> Something like second graph on the Renesys blog entry [1], and/or links to
>> the individual AS pages within RIPEstat or REX.  Same would be great for
>> prefixes, but maybe not practical.
>
> It's possible, but I'm reluctant to duplicate other work. We can look at
> the complexity/benefit in business hours tomorrow.
>
>> -- Is this page being automatically updated as things progress?  It will
>> be interesting to see how things come back. (If they come back?)
>
> It is being updated regularly via an automated process, so do please
> keep checking http://stat.ripe.net/egypt, and it will track the
> re-emergence of the Egyptian Internet.
>
>> Thanks for keeping up with this, though.
>
> You're welcome, we feel that this is a useful contribution to the
> community. With a good level of support and interest, we can justify
> investing more in such activities in the future.
>
> I would be delighted to hear feedback from other list members on this
> topic. Is this the sort of work you want to see from the RIPE NCC? Can
> we alter or improve it to serve and inform you better?
>
> Regards,
>
> Mark
>
> --
> Mark Dranse
> RIPE NCC
>
>


-- 
Iñigo Ortiz de Urbina Cazenave
http://www.twitter.com/ioc32