The elusive Effect of Routing Dynamics on Traffic Anomalies

Network operators need to know the root cause of traffic anomalies to determine the appropriate action to mitigate their effect. This paper studies the one type of anomaly for which we can know the root cause: routing-induced anomalies. A major challenge in quantifying the effect of routing events on traffic is that the flows affected by routing are not easily distinguishable from the rest of the traffic. We study this problem using both logs of routing messages and traffic flow records of two research backbones. We define the notion of routing impact in order to quantify how much of the observed volume variation in the traffic matrix is caused by routing changes. Our solution involves a method to compute the traffic matrix that achieves up-to-second accuracy. Results indicate that routing-induced traffic anomalies correspond to a very small faction (< 5%) of the total volume anomalies detected by a Kalman detector. We show that most of the significant routing shifts (> 80%) remain undetected because other volume changes hide their effect, or because they have a limited impact on traffic volume. However, the routing events detected by Kalman correspond to those events that have the biggest impact on the traffic. Running Kalman on destination address or prefixes instead of packets count can improve the detection of routing anomalies. These results represent the promise of a model of routing-induced anomalies, which could be used to accurately identify routinginduced traffic shifts even when no routing messages are available.