Two interesting points. First, the government has stated that the outage was the result of a cable cut. Based on what we've seen, we believe this is highly unlikely. Syria's network connects to the rest of the Internet at four distinct points that are geographically separated. For traffic to be terminated entirely, all four connection points would need to be severed simultaneously.

Moreover, the video of the outage, as well as the video of the routes being restored, show the systematic withdrawl of BGP routes across all of Syria's providers. This is not the signature we see when there is an actual cable cut.

Second, while most of the Internet was cut off in Syria, it appears there was a small portion of Syrian IP space that continued to have connectivity. Specifically, the following IP ranges behind AS29256:

• 46.53.0.0/17

• 78.110.96.0/20

• 94.141.192.0/19

Those prefixes continued to be announced to Deutche Telecom which means they would have continued to have access to the Internet.

We don't know who is behind that IP space. We're still investigating whether we saw any Internet traffic coming from that IP space. The fact that they were still available, however, further discredits the assertation that this was a cable cut.

Here is a graph showing the last 24 hours of Syrian traffic to the CloudFlare network.

The video below, which we generated using BGPlay, shows the routes in to the Syrian Internet being withdrawn:

The graph below shows the requests to CloudFlare's network from the Syrian Internet space over the last 6 hours (times are UTC):

We will continue to monitor Syrian traffic and post updates here if we see connectivity return.

This BGP map shows that connectivity with global Internet carriers PCCW and TATA has been reestiablished.

1557 UTC Syria has reconnected to Turk Telecom as well as PCCW and TATA.

The BGP map shows that with PCCW, TATA and Turk Telecom.

The following video shows the reestablishment of connectivity in two phases. At 1432 UTC Syria reconnected to PCCW and TATA; at 1557 UTC Syria reconnected to Turk Telecom.

1706 UTC Internal monitoring at CloudFlare shows that traffic is flowing from Syrian IP addresses onto the Internet. Both fixed and mobile IP addresses appear to be at least partially able to access the Internet.

2105 UTC Traffic to the CloudFlare network from Syrian IP addresses appears to have returned to levels seen prior to the shutdown. Almost immediately after the first links were reestablished we saw trafficlevels jump back up.

2112 UTC There have been no routing changes for Syria since 1558 UTC. The Internet connectivity and traffic levels appear stable.

Since the beginning of today's outage, we have received no requests from Syrian IP space. That is a more complete blackout than we've seen when other countries have been cut from the Internet (see, for example, Egypt where while most traffic was cut off some requests still trickled out).

The graph above shows two other incidents over the last week. On 25 November 2012 at approximately 0800 UTC we witnessed a 15 minute period during which Syrian traffic was cut to only 13% of normal levels. Again on 27 November 2012 at 0730 UTC, we saw a 15 minute period during which traffic dropped to only 0.2% of normal.

The Syrian Minister of Information is being reported assaying that the government did not disable the Internet, but instead the outage was caused by a cable being cut. Specifically: "It is not true that the state cut the Internet. The terrorists targeted the Internet lines, resulting in some regions being cut off." From our investigation, that appears unlikely to be the case.

To begin, all connectivity to Syria, not just some regions, has been cut. The exclusive provider of Internet access in Syria is the state-run Syrian Telecommunications Establishment. Their network AS number is AS29386. The following network providers typically provide connectivity from Syria to the rest of the Internet: PCCW and Turk Telekom as the primary providers with Telecom Italia and TATA for additional capacity. When the outage happened, the BGP routes to Syrian IP space were all simultaneously withdrawn from all of Syria's upstream providers. The effect of this is that networks were unable to route traffic to Syrian IP space, effectively cutting the country off the Internet.

Syria has 4 physical cables that connect it to the rest of the Internet. Three are undersea cables that land in the city of Tartous, Syria. The fourth is an over-land cable through Turkey. In order for a whole-country outage, all four of these cables would have had to been cut simultaneously. That is unlikely to have happened.

One of our network engineers recorded the following video of network routes being withdrawn. Syrian Telecommunications (AS29386) is represented by the red dot in the middle of the video. The lines represent routes to the Syrian upstream providers.

Video created with BGPlay by Roma Tre University

Beginning at 1026 UTC, routes were withdrawn for PCCW. The routing shifted primarily to Turk Telekom. Routes to Telecom Italia and TATA were also withdrawn, but has less of an impact. Then, at 1028 UTC, routes were withdrawn for Turk Telekom. After that, Syria was effectively cut off from the Internet. (Note that the remaining path that appears to be present in the video is an anomaly. We have confirmed that it is not actually active.)

While we cannot know for sure, our network team estimates that Syria likely has a small number of edge routers. All the edge routers are controlled by Syrian Telecommunications. The systematic way in which routes were withdrawn suggests that this was done through updates in router configurations, not through a physical failure or cable cut.

The last four sites on CloudFlare that received requests from Syria inthe seconds before access was cut were:

• fotoobook.com - a photo sharing blog

• aliqtisadi.com - a Syrian news site

• madinah.com - a Muslim-oriented social network

• to2.xxx - a porn site (warning: not safe for work)

In other words, traffic from Syrians accessing the Internet in the moments before they were cut off from the rest of the world looks remarkably similar to traffic from any part of the world.

As we have posted about recently, we don't believe our role is to take sides in political conflicts. However, we do believe it is our mission to help build a better Internet where everyone can have a voice and access information. It is therefore deeply troubling to the CloudFlare team when we see an entire nation cut off from the ability to access and report information. Our thoughts are with the Syrian people and we hope connectivity, and peace, will be quickly restored.

UPDATE: Syrian Internet access appears to be at least partiallyrestored as of 1 December 2012 at 1432 UTC. We have confirmed both thatthe BGP routes are reestablished and traffic from both wired and mobiledevices is flowing to CloudFlare's network. We've posted a blog post with more details here.