A massive route leak initiated by Telekom Malaysia (AS4788), starting at 8:43 June 12, 2015 UTC, caused significant network problems for the global routing system until about 10:40 June 12, 2015 UTC. Primarily affected was Level3 (AS3549 – formerly known as Global Crossing) and their customers.  See for details. This study shows the effects as seen by PingER monitoring hosts at SLAC and at the University of Malaysia.

Correlation for Level3 AS

We looked at the daily traceroutes measured from SLAC to ~ 800 PingER monitored hosts to see which one were using AS3539:

[cottrell@pinger ~]$ grep 3549 /afs/slac/package/pinger/chktrace/2015_06_12/*

/afs/slac/package/pinger/chktrace/2015_06_12/ ( [AS3549]  268.581 ms

/afs/slac/package/pinger/chktrace/2015_06_12/ ( [AS3549]  4.213 ms

/afs/slac/package/pinger/chktrace/2015_06_12/ ( [AS4651/AS3549]  216.855 ms

/afs/slac/package/pinger/chktrace/2015_06_12/ ( [AS4651/AS3549]  205.348 ms

/afs/slac/package/pinger/chktrace/2015_06_12/ (

/afs/slac/package/pinger/chktrace/2015_06_12/ ( [AS3549]  202.149 ms

Looking at those in S. E. Asia:


Correlations for Malaysian hosts seen from SLAC

or the 26 Malaysian hosts monitored from SLAC on 6/12/2015 looking at the 95 percentile frequency losses as a function of hour of day (see then apart from the hours of 9:00 and 10:00am UTC the losses are zero. The two majn contributors are: and Below are shown the RTTs and losses for these hosts on 6/12/2015. 


It is seen in the graph below that we observed losses of > 80% at 9:09, 9:39 and 10:09 and zero loss at 8:38am and again at 10:38. Also the Round Trip times increased from ~ 200 msec to over 450 msec.  The route from SLAC to  passes through AS4788.

Similar results are seen for and see below.

Just to illustrate that this is not normal behavior for say we show the ping performance over longer period below:

Hosts in Indonesia, Cambodia and the Phillipines seen from PingER monitor at University of Malaya in Kuala Lumpur

The monitorig host is


  • No labels