Yesterday, Syria's Internet connectivity was cut off from the rest of the world. At 14:12 UTC, approximately 19 hours and 30 minutes after it had been shut down, connectivity was returned. Here's a BGPlay video of routes being restored within the country.
Two interesting points. First, the government has stated that the outage was the result of a cable cut. Based on what we've seen, we believe this is highly unlikely. Syria's network connects to the rest of the Internet at four distinct points that are geographically separated. For traffic to be terminated entirely, all four connection points would need to be severed simultaneously.
Moreover, the video of the outage, as well as the video of the routes being restored, show the systematic withdrawl of BGP routes across all of Syria's providers. This is not the signature we see when there is an actual cable cut.
Second, while most of the Internet was cut off in Syria, it appears there was a small portion of Syrian IP space that continued to have connectivity. Specifically, the following IP ranges behind AS29256:
- 46.53.0.0/17
- 78.110.96.0/20
- 94.141.192.0/19
Those prefixes continued to be announced to Deutche Telecom which means they would have continued to have access to the Internet.
We don't know who is behind that IP space. We're still investigating whether we saw any Internet traffic coming from that IP space. The fact that they were still available, however, further discredits the assertation that this was a cable cut.
Here is a graph showing the last 24 hours of Syrian traffic to the CloudFlare network.
