Syria cut off from Internet (back up now, 2 day outage)

[ThePythonicCow]

About a day and a half ago, Syria entirely disconnected from the Internet. The article at How Syria Turned Off the Internet (cloudfare.com) (http://blog.cloudflare.com/how-syria-turned-off-the-internet) explains just what happened and when. Apparently all Internet traffic in and out of Syria went through a few edge routers, and these routers were methodically reconfigured over a few minute period to no longer route packets outside of Syria.





~~~~~~~~~~~~~~

November 29, 2012

Today, 29 November 2012, between 1026 and 1029 (UTC), all traffic from Syria to the rest of the Internet stopped. At CloudFlare, we witnessed the drop off. We've spent the morning studying the situation to understand what happened. The following graph shows the last several days of traffic coming to CloudFlare's network from Syria.


http://thepythoniccow.us/cloudflare_syrian_traffic_utc.png.scaled1000.png
Since the beginning of today's outage, we have received no requests from Syrian IP space. That is a more complete blackout than we've seen when other countries have been cut from the Internet (see, for example, Egypt where while most traffic was cut off some requests still trickled out) (http://blog.cloudflare.com/what-egypt-shutting-down-the-internet-looks-l).

The graph above shows two other incidents over the last week. On 25 November 2012 at approximately 0800 UTC we witnessed a 15 minute period during which Syrian traffic was cut to only 13% of normal levels. Again on 27 November 2012 at 0730 UTC, we saw a 15 minute period during which traffic dropped to only 0.2% of normal.

What Happened?

...
Watching the Shutdown Happen
One of our network engineers recorded the following video of network routes being withdrawn. Syrian Telecommunications (AS29386) is represented by the red dot in the middle of the video. The lines represent routes to the Syrian upstream providers.

OZHKeYwnALc
Beginning at 1026 UTC, routes were withdrawn for PCCW. The routing shifted primarily to Turk Telekom. Routes to Telecom Italia and TATA were also withdrawn, but has less of an impact. Then, at 1029 UTC, routes were withdrawn for Turk Telekom. After that, Syria was effectively cut off from the Internet. (Note that the remaining path that appears to be present in the video is an anomaly. We have confirmed that it is not actually active.)

While we cannot know for sure, our network team estimates that Syria likely has a small number of edge routers. All the edge routers are controlled by Syrian Telecommunications. The systematic way in which routes were withdrawn suggests that this was done through updates in router configurations, not through a physical failure or cable cut.

What Syrians Were Surfing Before the Internet Was Turned Off

...
~~~~~~~~~~~~~~

More at How Syria Turned Off the Internet (cloudfare.com) (http://blog.cloudflare.com/how-syria-turned-off-the-internet).

[ThePythonicCow]

See also the related thread In other news: war escalations in Syria (http://projectavalon.net/forum4/showthread.php?52598-In-other-news-war-escalations-in-Syria)

[Robert J. Niewiadomski]

I wonder if gsm network in Syria has it's own internet routers? And what about internet via satelite phones or satelite modems. Can the physical location of a device connected to interned may be in Syria and IP adress not in the range "typical" for Syria? There is also possibility of IP implementation over HAM radio stations. But this way is probably easy to detect and to disable by the authorities.

There can be another twist. To hamper cia sponsored rebels communications with their handlers. Syrian military has probably its own communication network. And if somebody "unathorized" manages to connect outside of Syria will automatically redflag herself for military inspection...

[Ilie Pandia]

WOW!

I just got this email the other day:

----------------

Dear IDL member,

We're writing to tell you about a serious threat to Internet freedom, and invite you to take part in an action this Monday, December 3rd.

In short, an obscure international meeting next week could give a top-down, non-transparent UN body (one with representation from many dictatorships) the power to regulate the Internet. It's called the ITU.

The ITU would literally give dictators like Syria’s Assad (who was trending yesterday for--it seems--cutting Syria off from the Internet) a role in crucial decisions about the Internet’s future.

You can learn more here: http://internetcoup.org/ (scroll down for a video and background reading).

Remember-- it's up to you whether or not to participate; those who have installed the "all future campaigns" code will participate by default. The widget for this action lets your visitors email and call the ITU delegations in their country. You can preview its style and functionality on internetcoup.org.

We're still working on the widget code itself. For now you can install the "All campaigns" code here, and this will activate on Monday Dec. 3rd: http://members.internetdefenseleague.org

Finally, we'd like to invite you to take the first steps to building a country-by-country presence for the IDL. The goal? Independent IDL's with the ability to mobilize users in every country in the world, both for domestic and international campaigns. If you're interested in organizing an IDL in your country contact us: team@fightforthfuture.org

And please share this page with your contacts in as many countries as possible: http://internetdefenseleague.org/international

Thanks. Sincerely,
Holmes Wilson - Internet Defense League

----------------

IDL stands for Internet Defense League (http://internetdefenseleague.org/)

[ThePythonicCow]

Syria’s Assad (who was trending yesterday for--it seems--cutting Syria off from the Internet)

I was guessing that it was the bastards in power that cut off Syria's Internet, in preparation for some activities that they didn't want too widely visible, rather than Assad who ordered it.

But that's just a guess.

[Ilie Pandia]

I am a bit surprised that this was possible to do so fast and effectively...

[ThePythonicCow]

I am a bit surprised that this was possible to do so fast and effectively...

Would that depend on how centralized was the control of the edge routers?

If one corporation and/or government controls all the edge routers for a country, then cutting it off from the Internet seems pretty easy.

I'm guessing from this that cutting off the US, or Western Europe, or even (hopefully) Texas, would be quite a bit more difficult.

As for Romania ... it's about the same size (area and population) as Syria. But I don't know who controls the routers connecting it with the rest of the Internet.

[Ilie Pandia]

In Romania there are a few private companies that would be very very upset if they would suddenly loose all of their customers over night and they would put a big pressure on the government to release the clamp, or they would at least try to find other ways to go "out", via satellites and such.

I imagine that closing down the net in Syria also means shutting down a lot of big and small business that rely on Internet communication. Are those just simply going to obey... ?

[ThePythonicCow]

Another graphic indicating how sharply the cutoff was, from Syria's internet cutoff easy to spot (The Guardian - UK) (http://www.guardian.co.uk/technology/2012/nov/29/syria-internet-cutoff-arbor-renesys):

http://static.guim.co.uk/sys-images/Technology/Pix/pictures/2012/11/29/1354215925585/renesys-syria.png
The above graphic shows the number of Syrian IP address blocks visible from outside. It went from the usual 84, down to 0, like falling off a cliff.

[ThePythonicCow]

The Guardian took the above graphic from renesys.com, which has more (geeky) details on the outage at Syrian Internet Is Off The Air (renesys.com | blog) (http://www.renesys.com/blog/2012/11/syria-off-the-air.shtml).

Renesys also has this interesting article: Could It Happen In Your Country? (http://www.renesys.com/blog/2012/11/could-it-happen-in-your-countr.shtml), evaluating the risk, by country, of getting the Internet cut off. Here's the map from that article:


http://www.renesys.com/blog/assets_c/2012/11/renesys.risk.internet.disconnect-thumb-600x395-810.png
The number of providers at the border was a key statistic in forming this map. If your country has just one or a few providers controlling the routers at the border, it is easier to cut your country off.

Looks like Texas and Romania are in good shape :).

[Robert J. Niewiadomski]

Googling site:gov.sy reveals some Syrian government websites. Have checked few of them and they could not be found :( Do you think if the Syrian government was behind taking shutting down interned they would leave gov.sy domain line for "propaganda"? I think Syria was cut off at the top level domain level. The website for Syria manager of TLD - National Agency for Network. Services, tld.sy is unavailable too. Have found nothing relevant on Syria at ICANN and IANA websites (googled: "site:icann.org syria" and "site:iana.org syria"). I wonder why Syrian government would cut itself from the outside internet?

Irrelevant:
But have found something for starting a new thread. It is titled "strawman solution" and is related to trademarks claims and protection. Link: http://blog.icann.org/2012/11/trademark-clearinghouse-update/.

[Operator]

Syria’s Assad (who was trending yesterday for--it seems--cutting Syria off from the Internet)

I was guessing that it was the bastards in power that cut off Syria's Internet, in preparation for some activities that they didn't want too widely visible, rather than Assad who ordered it.

But that's just a guess.

Paul, I would say that's more than a good guess.
We really can't verify if it was on Assad's orders, can we?

And especially if other news pops up with 'warnings' massaging us with what to believe I get really cautious.

[ghostrider]

the internet is driven by ronald reagan's star wars satelites , intended for defense against russia, the wall fell, hmm what shall we do with those 18 satalites ? bang the web is born, with only 10 percent of what those satalites can do. I said that to say this, all they have to do is flip a switch and global blah blah is over, GPS over, cell phones over, no country to country communication, ohhh unless you have analog . . hmmm who has that ?

[Operator]

the internet is driven by ronald reagan's star wars satelites , intended for defense against russia, the wall fell, hmm what shall we do with those 18 satalites ? bang the web is born, with only 10 percent of what those satalites can do. I said that to say this, all they have to do is flip a switch and global blah blah is over, GPS over, cell phones over, no country to country communication, ohhh unless you have analog . . hmmm who has that ?

Really? :rolleyes:

[Sidney]

This is really quite sobering. My first thought was that TPTB has taken their power way too far.

[ThePythonicCow]

It looks like Syria is back online, after about a two day outage.


From The Internet Is Coming Back On in Syria (gizmodo.com) (http://gizmodo.com/5964878/the-internet-is-coming-back-on-in-syria):


Just two days after the Syrian government cut the country off from access to the Internet, connectivity is coming back. Reports from Renesys and CloudFlare indicate that the country's connections started coming back online at 14:32 UTC today.
From Restoration in Syria (renesys.com) (http://www.renesys.com/blog/2012/12/restoration-in-syria-1.shtml):


Renesys confirms a largely complete restoration of the Syrian Internet this morning, starting at 14:32:10 UTC (16:32 local time in Damascus).

...The restoration was achieved just as quickly and neatly as the outage: like a switch being thrown. Does that mean that we believe the government (or the opposition) threw the switch? Frankly, the data available just don't support attribution at this point, despite all the speculation.

The only way we're going to know for sure will be to wait for a resolution to the conflict, at which point we will hear from the people who know for sure: the network engineers in Syria. We hope they're safe and we look forward to hearing their story firsthand.
From Syrian Internet access reestablished starting 1432 UTC, December 1, 2012 (cloudfare.com) (http://blog.cloudflare.com/syrian-internet-access-appears-partially-rees):


1432 UTC Syria has reestablished partial connectivity to the Internet. The following map of BGP connectivity shows Syria's 29386 network connected to multiple networks outside Syria

...Traffic to the CloudFlare network from Syrian IP addresses appears to have returned to levels seen prior to the shutdown. Almost immediately after the first links were reestablished we saw traffic levels jump back up.