ATLAS Internet Observatory ISOC IETF 76 November 12, 2009, Hiroshima, Japan

Transcription

1 ATLAS Internet Observatory ISOC IETF 76 November 12, 2009, Hiroshima, Japan Danny McPherson danny@arbor.net Chief Security Officer

2 ATLAS Observatory Details ISP / Content Providers ATLAS Centrally maintained servers Graphic not an accurate representation of current ATLAS deployments Within a given ISP, commercial probe infrastructure Monitors NetFlow / Jflow / etc and routing across possible hundreds of routers Probes topology aware of ISP, backbone and customer boundaries Routers typically include most of peering / transit edge Some deployments include portspan / inline appliances Deployments send anonymous XML file to central servers Includes self-categorization of primary geographic region and type Data includes coarse grain anonymized traffic engineering statistics Largest Internet monitoring infrastructure in the world, first global traffic engineering study of Internet evolution Global deployment across 110+ ISPs / Content Providers Near real-time traffic and routing statistics (~15 Tbps) Leverages commercial security / TE infrastructure Participation voluntary, all data sources are anonymous Introduced at NANOG 47, tech report forthcoming, Arbor blog provides ongoing related bits Co-collaborators: Labovitz & Iekel-Johnson (Arbor), Oberheide & Jahanian (UoM) Karir (Merit Network)

3 Major Findings 1 Consolidation of Content Contributors Content migrated out of enterprise / edge to aggregators Consolidation of large Internet properties Now only 150 origin ASNs now contribute 50% of traffic Hyper-giants: 30 companies account for 30% of all traffic 2 Consolidation of Applications Browser increasingly application front end (e.g., mail, video) Applications migrate to HTTP or Flash ports / protocols (tcp/80) Other ports / app groups decline (except games and VPN) 3 Evolution of Internet Core and Economic Innovation Majority of traffic direct between consumer and content Market shifts focus to higher value services (MSSP, VPN, CDN, etc) Experimentation with paid transit, paid content Disintermediation of middleman

4 Textbook Internet: Then & Now Tier1 global core (modulo a few name changes over the years) Disintermediation between content and eyeball networks Flatter Internet, much more dense interconnection has routing, traffic, security, economic, implications

5 The ATLAS 10 : Then and Now Rank 2007 Top Ten % 2009 Top Ten % 1 Level(3) 5.77 Level(3) Global Crossing 4.55 Global Crossing ATT 3.35 Google Sprint Cogent NTT 2.6 Comcast Verizon TeliaSonera Savvis AboveNet Corresponds with expected tier-1 ISPs (e.g., Wikipedia) Based on analysis of anonymous ASN (origin/transit) data (weighted average % of all Internet Traffic) Top ten has NO direct relationship to Observatory participation Tier1s still carry significant traffic volumes (and profitable services) Google and Comcast Join the Top 10 in 2009

6 Consolidation of Content (Grouped Origin ASN) In 2007, thousands of ASNs contributed 50% of content In 2009, 150 ASNs contribute 50% of all Internet traffic, 30 hyper giants contribute 30% Approximates a power law distribution

7 What s Happening? Commoditization of IP and Hosting / CDN Drop price of wholesale transit Drop price of video / CDN Economics and scale drive enterprise to cloud Consolidation Bigger get bigger (economies of scale) e.g., Google, Yahoo, MSFT acquisitions Success of bundling / Higher Value Services Triple and quad play, etc. New economic models Paid content (ESPN 360), paid peering, etc. Difficult to quantify due to NDA / commercial privacy Disintermediation Direct interconnection of content and consumer Driven by both cost and increasingly performance

8 Content Map Content versus Eyeballs Google Relative Percentage Traffic LimeLight Akamai Cogent L3 MSFT Qwest Telia NTT AT&T Shaw Comcast C&W VSNL Yahoo Sprint BC VZB FT KPN Belgacom Percentage ASN (all) Content Interestingly MSFT looks more like transit Did not include all ASN for clarity of graph Comcast most significant change recently

9 Comcast Case Study Comcast most significant shift (20%) of any AS in top 50 Growth in SMB / transit business? Selling video to other MSOs

10 Case Study Google Google and YouTube /23/07 6/23/07 7/23/07 8/23/07 9/23/07 10/23/07 11/23/07 12/23/07 1/23/08 2/23/08 3/23/08 4/23/08 5/23/08 6/23/08 7/23/08 8/23/08 9/23/08 10/23/08 11/23/08 12/23/08 1/23/09 2/23/09 3/23/09 4/23/ Google absorbs YouTube Accounts for 5% of all Internet traffic globally

11 Top ATLAS Global Applications Rank Application Change 1 Web 41.68% 52.00% 24.76% 2 Video 1.58% 2.64% 67.09% 3 VPN 1.04% 1.41% 35.58% % 1.38% -2.13% 5 News 1.75% 0.97% % * 6 P2P (*) 2.96% 0.85% % 7 Games 0.38% 0.49% 28.95% 8 SSH 0.19% 0.28% 47.37% 9 DNS 0.20% 0.17% % 10 FTP 0.21% 0.14% % Other 2.56% 2.67% 4.30% Unclassified 46.03% 37.00% % (*) 2009 P2P Value based on 18% Payload Inspection Weighted average percentage Internet traffic Limited payload based application classification dataset P2P likely closer to 18%, and video significantly larger Web (and video over HTTP) largest Followed by P2P (which is also fastest shrinking)

12 Internet Protocols TCP Dominates as expected (92% TCP, 6.5% UDP) Slight gain in other protocols (VPN) at expense of TCP

13 VPN Protocols VPN protocols show yearly and weakly cycles Correlated with western business week and holiday Slight trend upward in VPN market share

14 IPv6 Internet Traffic August 2008 IPv6 was less than 100 th of 1%, IPv6 has grown 1,400% in 12 months (mostly attributable to one application/isp) Only 6 of 110 participants have native IPv6 router and collection infrastructure enabled (so this is just Teredo and 6to4 data) Only handful of participants use payload visibility, so only UDP Teredo control traffic is reported In the space of ten months utorrent helped drive IPv6 traffic from.002% to.03% of all Internet traffic

15 Daily Web Usage Web (tcp/80,8080,443) 52% of all Internet traffic on aggregate Daily low of 42%

16 Global P2P Trends Graph of weighted average traffic using well-known P2P ports Trend in both well-known ports and payload based analysis Not enough data to graph payload based data decline Most P2P uses random ports and 40% or more encrypted Slight differences in rate of decline by region (i.e. Asia is slower)

17 P2P Dynamics P2P 15-20% of NA traffic - bursts from low of 8% (~4P) to high of 17% well after midnight P2P cycles do not coincide broader traffic trends cyclically inverted (perhaps indicative or persistent congestion or ISP traffic management?) P2P also not responsible for midnight spike in US consumer usage

18 P2P Replaced by Direct Download Graph shows weighted average percentage Carpathia traffic Carpathia Hosting represents more than 0.5% of all traffic Provider to MegaUpload, MegaErotic, etc. Mega became Carpathia customer November 2008 Leaseweb not considered here

19 The Internet After Dark (North America) 6A traffic at 50% of daily peaks Daily maxima at 4P, peak at 11P EU traffic peaks at 6P, drops until next business day US traffic peaks at 11P, relatively high until 3A Consumer traffic plays large role in daily peak Cross 50% threshold at 9A, as opposed to general at 6A chow time leisure

20 What are People Doing at Night?

21 Visible Global Events Woods/Rocco showdown at US Open Torrey Pines June 16, 2008 Obama inauguration traffic

22 Internet Size / Growth Followed MINTS methodology for AGR Used 10 known ISP totals (MRTG / Flow based) to extrapolate Internet total Similar findings to MINTS and Cisco Significant growth, but no Exaflood

23 Observatory Conclusions Internet is at an inflection point Transition from focus on connectivity to content Old global Internet economic models are evolving New entrants are reshaping definition / value of connectivity New technologies are reshaping definition of network Web / Desktop Applications, Cloud computing, CDN Changes mean significant new commercial, security and engineering challenges This is just the beginning

24 EOF Danny McPherson