[Chapter-delegates] Lybian Internet Outage

[Veni Markovski]

I have doubts that right now someone high enough has time to think
about blocking the Internet in Lybia. This is not a country with big
numb

On 2/22/11, Fred Baker <fred at cisco.com> wrote:
>
> On Feb 22, 2011, at 4:36 PM, Narelle wrote:
>
>> On Wed, Feb 23, 2011 at 8:49 AM, Fred Baker <fred at cisco.com> wrote:
>>
>>>> On 18 February 2011, during the 2011 Libyan protests, Libya appeared to
>>>> have withdrawn all of its BGP prefix announcements from the Internet for
>>>> a short period, cutting it off from the rest of the global Internet. The
>>>> prefix were re-advertised six hours later.[1]
>>>
>>> Reports on nanog indicate that traffic between Libya and the outside
>>> world is sharply curtailed but not "out".
>>
>> So does it look like people inside the ISPs (as it did in Egypt) are
>> being told to turn it off?
>>
>> Do you think they are just turning off BGP? Then turning it back on
>> again arbitrarily (eg because someone's son needs to check their
>> financial portfolio)?
>
> I have no direct data. Craig's charts (http://www.monkey.org/~labovit/blog/)
> report an overall 60-80% traffic reduction impacting all Internet
> applications, especially hitting web and AIM data. One possible theory might
> be that a class of users (people using certain COs or routers for example)
> is affected; another is that specific web 2.0 applications (facebook,
> youtube, etc) are affected. Media reports indicate censorship; one could
> imagine them looking for encrypted or obfuscated traffic (https, IPsec, SSH,
> tunnels of various kinds, etc) and keywords in unencrypted traffic resulting
> in a TCP RST or simple drop.
>
> My guess is that the government-owned ISPs have the gateways to the great
> wide world, and are being told to do make the Internet not be an issue. On
> the 18th they shut it down completely, per Renesys, and brought it back up
> on the 19th. There have been "Internet Curfews" most nights since. Referring
> to a chart in the blog, today it says
>
>> You can see a few things here. The median time it takes to reach Libyan
>> hosts from all over the world has remained pretty constant, roughly 200ms.
>> Fewer traceroutes are succeeding, suggesting that reachability is
>> impaired, even though the routes are up. The distribution of times has
>> remained relatively stable, without large outliers, perhaps suggesting
>> that the reported reductions in traffic to/from Libya are the result of
>> internal shutdowns, rather than heavy congestion on the international
>> links. Finally, you can see successful traceroute counts drop to zero
>> during the outages.
>
> Your guess is at least as good as mine. But it does look like some amount of
> routing to /dev/null in some form.
>
>
>
>>
>> best regards
>>
>>
>>
>> --
>>
>>
>> Narelle
>> narellec at gmail.com
>
> _______________________________________________
> Chapter-delegates mailing list
> Chapter-delegates at elists.isoc.org
> https://elists.isoc.org/mailman/listinfo/chapter-delegates
>

-- 
Sent from my mobile device