http://blog.cloudflare.com/how-syria-turned-off-the-internet
How Syria Turned Off the Internet
Today, 29 November 2012, between
1026 and 1028 (UTC), all traffic from Syria to the rest of the Internet
stopped. At CloudFlare, we witnessed the drop off. We've spent the
morning studying the situation to understand what happened. The
following graph shows the last several days of traffic coming to
CloudFlare's network from Syria.
Since the beginning of today's outage, we have received no requests
from Syrian IP space. That is a more complete blackout than we've seen
when other countries have been cut from the Internet (see, for example,
Egypt where while most traffic was cut off some requests still trickled out).
The graph above shows two other incidents over the last week. On 25 November 2012 at approximately 0800 UTC we witnessed a 15 minute period during which Syrian traffic was cut to only 13% of normal levels. Again on 27 November 2012 at 0730 UTC, we saw a 15 minute period during which traffic dropped to only 0.2% of normal.
What Happened?
The Syrian Minister of Information is being reported as saying that the government did not disable the Internet, but instead the outage was caused by a cable being cut. Specifically: "It is not true that the state cut the Internet. The terrorists targeted the Internet lines, resulting in some regions being cut off." From our investigation, that appears unlikely to be the case.
To begin, all connectivity to Syria, not just some regions, has been cut. The exclusive provider of Internet access in Syria is the state-run Syrian Telecommunications Establishment. Their network AS number is AS29386. The following network providers typically provide connectivity from Syria to the rest of the Internet: PCCW and Turk Telekom as the primary providers with Telecom Italia and TATA for additional capacity. When the outage happened, the BGP routes to Syrian IP space were all simultaneously withdrawn from all of Syria's upstream providers. The effect of this is that networks were unable to route traffic to Syrian IP space, effectively cutting the country off the Internet.
Syria has 4 physical cables that connect it to the rest of the Internet. Three are undersea cables that land in the city of Tartous, Syria. The fourth is an over-land cable through Turkey. In order for a whole-country outage, all four of these cables would have had to been cut simultaneously. That is unlikely to have happened.
Watching the Shutdown Happen
One of our network engineers recorded the following video of network routes being withdrawn. Syrian Telecommunications (AS29386) is represented by the red dot in the middle of the video. The lines represent routes to the Syrian upstream providers.
While we cannot know for sure, our network team estimates that Syria likely has a small number of edge routers. All the edge routers are controlled by Syrian Telecommunications. The systematic way in which routes were withdrawn suggests that this was done through updates in router configurations, not through a physical failure or cable cut.
What Syrians Were Surfing Before the Internet Was Turned Off
The last four sites on CloudFlare that received requests from Syria in the seconds before access was cut were:
As we have posted about recently, we don't believe our role is to take sides in political conflicts. However, we do believe it is our mission to build a better Internet where everyone can have a voice and access information. It is therefore deeply troubling to the CloudFlare team when we see an entire nation cut off from the ability to access and report information. Our thoughts are with the Syrian people and we hope connectivity, and peace, will be quickly restored.
---
UPDATE: Syrian Internet access appears to be at least partially restored as of 1 December 2012 at 1432 UTC. We have confirmed both that the BGP routes are reestablished and traffic from both wired and mobile devices is flowing to CloudFlare's network. We've posted a blog post with more details: http://blog.cloudflare.com/syrian-internet-access-appears-partially-rees
The graph above shows two other incidents over the last week. On 25 November 2012 at approximately 0800 UTC we witnessed a 15 minute period during which Syrian traffic was cut to only 13% of normal levels. Again on 27 November 2012 at 0730 UTC, we saw a 15 minute period during which traffic dropped to only 0.2% of normal.
What Happened?
The Syrian Minister of Information is being reported as saying that the government did not disable the Internet, but instead the outage was caused by a cable being cut. Specifically: "It is not true that the state cut the Internet. The terrorists targeted the Internet lines, resulting in some regions being cut off." From our investigation, that appears unlikely to be the case.
To begin, all connectivity to Syria, not just some regions, has been cut. The exclusive provider of Internet access in Syria is the state-run Syrian Telecommunications Establishment. Their network AS number is AS29386. The following network providers typically provide connectivity from Syria to the rest of the Internet: PCCW and Turk Telekom as the primary providers with Telecom Italia and TATA for additional capacity. When the outage happened, the BGP routes to Syrian IP space were all simultaneously withdrawn from all of Syria's upstream providers. The effect of this is that networks were unable to route traffic to Syrian IP space, effectively cutting the country off the Internet.
Syria has 4 physical cables that connect it to the rest of the Internet. Three are undersea cables that land in the city of Tartous, Syria. The fourth is an over-land cable through Turkey. In order for a whole-country outage, all four of these cables would have had to been cut simultaneously. That is unlikely to have happened.
Watching the Shutdown Happen
One of our network engineers recorded the following video of network routes being withdrawn. Syrian Telecommunications (AS29386) is represented by the red dot in the middle of the video. The lines represent routes to the Syrian upstream providers.
(Video created with BGPlay by Roma Tre University)
Beginning at 1026 UTC, routes were withdrawn for PCCW. The routing
shifted primarily to Turk Telekom. Routes to Telecom Italia and TATA
were also withdrawn, but has less of an impact. Then, at 1028 UTC,
routes were withdrawn for Turk Telekom. After that, Syria was
effectively cut off from the Internet. (Note that the remaining path
that appears to be present in the video is an anomaly. We have confirmed
that it is not actually active.)While we cannot know for sure, our network team estimates that Syria likely has a small number of edge routers. All the edge routers are controlled by Syrian Telecommunications. The systematic way in which routes were withdrawn suggests that this was done through updates in router configurations, not through a physical failure or cable cut.
What Syrians Were Surfing Before the Internet Was Turned Off
- fotoobook.com - a photo sharing blog
- aliqtisadi.com - a Syrian news site
- madinah.com - a Muslim-oriented social network
- to2.xxx - a porn site (warning: not safe for work)
As we have posted about recently, we don't believe our role is to take sides in political conflicts. However, we do believe it is our mission to build a better Internet where everyone can have a voice and access information. It is therefore deeply troubling to the CloudFlare team when we see an entire nation cut off from the ability to access and report information. Our thoughts are with the Syrian people and we hope connectivity, and peace, will be quickly restored.
---
UPDATE: Syrian Internet access appears to be at least partially restored as of 1 December 2012 at 1432 UTC. We have confirmed both that the BGP routes are reestablished and traffic from both wired and mobile devices is flowing to CloudFlare's network. We've posted a blog post with more details: http://blog.cloudflare.com/syrian-internet-access-appears-partially-rees
No comments:
Post a Comment