{"id":2729,"date":"2014-08-29T15:04:59","date_gmt":"2014-08-29T22:04:59","guid":{"rendered":"http:\/\/blog.caida.org\/best_available_data\/?p=2729"},"modified":"2015-07-06T15:24:39","modified_gmt":"2015-07-06T22:24:39","slug":"under-the-telescope-time-warner-cable-internet-outage","status":"publish","type":"post","link":"https:\/\/blog.caida.org\/best_available_data\/2014\/08\/29\/under-the-telescope-time-warner-cable-internet-outage\/","title":{"rendered":"Under the Telescope: Time Warner Cable Internet Outage"},"content":{"rendered":"

In the early hours of August 27th 2014, Time Warner Cable (TWC) suffered a major Internet outage, which started around 9:30am<\/strong>\u00a0and lasted until 11:00am\u00a0<\/strong>UTC (4:30am-6:00am EST). According to Time Warner<\/a>, this disconnect was caused by an issue with its Internet backbone during a routine network maintenance procedure.<\/p>\n

A few\u00a0sources have documented the outage based on BGP and\/or active measurements, including Renesys<\/a> and RIPE NCC<\/a>. Here we present a view from passive traffic measurement, specifically from the\u00a0UCSD Network Telescope<\/a>, which continuously listens for Internet Background Radiation (IBR) traffic. IBR is a constantly changing mix of traffic caused by benign misconfigurations, bugs, malicious activity, scanning, responses to spoofed traffic (backscatter), etc. \u00a0In order to extract a signal usable for our inferences, we count the number of unique source IP addresses (in IBR observed from a certain AS or geographical area) that pass a series of filters. Our filters try to remove (i) spoofed traffic<\/a>, (ii) backscatter<\/a>, and (iii) ports\/protocols that generate significant noise.<\/p>\n

Most of TWC’s Autonomous Systems seem to have been affected during the\u00a0time of the reported outage. Our indicators from the telescope\u00a0show a total absence of traffic\u00a0from TWC’s ASes, indicating a complete network outage.<\/p>\n

\"\"<\/a><\/p>\n

Figure 1<\/strong>:\u00a0Number of unique IBR source IPs (after filtering) observed per minute for the TWC ASes<\/em><\/p>\n

Figure 1<\/em>\u00a0shows the number of unique source IPs originated by TWC ASes per minute, as observed by the network telescope; we plot only TWC ASes from which there was any IBR traffic observed just before and after the event. For reference, these ASes are: AS7843, AS10796, AS11351, AS11426, AS11427, AS11955, AS12271 and AS20001.<\/p>\n

TWC is a large Internet access provider in the United States, and this IBR signal can also reveal insight into the impact of this outage across the country. Figure 2 <\/em>shows the same metric as Figure 1<\/em>, but for source IPs across the entire country, indicating a drop of about 12%<\/strong> in the number of (filtered) IBR sources, which suggests that during the incident, a significant fraction of the US population lost Internet access.<\/p>\n

\"\"<\/a><\/p>\n

Figure 2<\/strong>: Number\u00a0of unique IBR source IPs (after filtering) observed in the\u00a0US\u00a0<\/em><\/p>\n

Drilling down to a regional level shows which US states seem to have suffered a larger relative drop in traffic.<\/p>\n

\"\"<\/a><\/p>\n

Figure 3<\/strong>: Decrease ratio of unique IBR source IPs per US state\u00a0<\/em><\/p>\n

Figure 3<\/em> compares the number of IBR sources observed in the 5 minute-interval just before the incident (9:25-9:30UTC) to the 5-minute interval after it (9:30-9:35UTC). The yellow to red color gradient represents the ratio at which a certain state’s IBR sources have decreased (redder\u00a0means larger drop). States that did not suffer a substantial relative decrease are shown in yellow. This geographical spread is likely correlated with market penetration of TWC connectivity within each state.<\/p>\n

 <\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

In the early hours of August 27th 2014, Time Warner Cable (TWC) suffered a major Internet outage, which started around 9:30am\u00a0and lasted until 11:00am\u00a0UTC (4:30am-6:00am EST). According to Time Warner, this disconnect was caused by an issue with its Internet backbone during a routine network maintenance procedure. A few\u00a0sources have documented the outage based on […]<\/p>\n","protected":false},"author":21,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1,31,10],"tags":[],"coauthors":[30,22],"_links":{"self":[{"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/posts\/2729"}],"collection":[{"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/comments?post=2729"}],"version-history":[{"count":70,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/posts\/2729\/revisions"}],"predecessor-version":[{"id":2818,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/posts\/2729\/revisions\/2818"}],"wp:attachment":[{"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/media?parent=2729"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/categories?post=2729"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/tags?post=2729"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.caida.org\/best_available_data\/wp-json\/wp\/v2\/coauthors?post=2729"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}