Telstra, Optus stay out of Arbor Atlas alliance

Atlas aggregates streams of Internet traffic data from over 100 ISPs globally that have Arbor equipment as part of their networks.

The collated information is then provided back to the community of participating ISPs to give them visibility and potentially advanced warning of traffic-generating events that could have a flow-on impact locally.

It is said to enable the ISPs to make better business decisions about peering relationships, capacity planning, markets, services and network management, according to Arbor's A/NZ country manager Nick Race.

"What Atlas gives them is an idea of where traffic is going from and to and the nature of the traffic," Race said.

"It's why we've consciously had to make the option to participate in the sharing as an opt-in".

Race said Nextgen was "happy to participate" in Atlas. Arbor also has New Zealand's TelstraClear as a participating alliance member.

But two of the largest telecommunications and Internet players in Australia are so far yet to join.

"Telstra and Optus have the equipment in their networks that is capable of participating in this but they're not participating," Race said.

"We continue to have dialogue with Australian ISPs to participate. Some customers have equipment but aren't part of the alliance at the moment, and there's more ISPs that could potentially become Arbor customers."

Race said the Obama inauguration was an example of a traffic event that would show up in the Atlas statistics.

"The kind of visibility it gives ISPs is that a spike might otherwise look like a security or distributed denial-of-service attack on first glance rather valid traffic coming from valid users," Race said.

ISPs could use this information to ensure capacity was available to scale up to expected traffic demands, he said.

Atlas is also used to track malware using darknet sensors. Darknets are IP addresses that are typically owned by the ISP and aren't defined or allocated to users.

"Because no users are assigned you wouldn't expect traffic to go to it but malware typically scans the net looking for vulnerable hosts and often scans into darknets too," said Race.

"If we've got sensors in that darknet space, we can act as a compromisable hub, learn the behaviour of the malware and try to develop measures to counter it."

Race said around 31GB of global darknet traffic is analysed daily by Atlas.

Over three Terabits per second of Internet transit traffic is monitored and reported through the alliance, he said.

A stripped down version of Atlas is publicly available online.