InternetPerils   InternetPerils
What's New
All About Risk
My Account

PerilFold: Syria disconnects 29 November 2012 ...more

Syria disconected from the Internet at 10:30 GMT 2 February 2011, 12:30PM Syrian time:

Syria disconnects 29 November 2012

Figure 1: Syria disconnects 29 November 2012

Ellipses in these graphs represent servers; boxes represent routers; colors of boxes reflect ownership of parts of the network.
Arrows show the varying connectivity among them: green is fast, yellow is slow, orange is slower, and red is very slow.
Times are GMT.

Graphs were produced using PerilScope™, which is InternetPerils' interactive topology examination interface, based upon the GAIN platform.

The green ellipses and the pink ellipse are four destinations in Yemen InternetPerils was watching (we weren't watching any in Syria). Paths to reach those Yemeni nodes changed suddenly at 10:30 AM GMT 29 November 2012. This is very close to the 10:26 AM GMT Syrian disconnect time reported by Renesys. According to Noah Shachtman in Wired Danger Room 29 November 2012: Syria Has Just Been Taken Offline,

“But this is the first time are seeing it centralized (from what I can tell),” emails SecDev CEO Rafal Rohozinski, who has been working with Syrian opposition groups. “We are trying to ascertain whether this is a deliberate pulling of the plug, a technical error, or something else.”

Sure looks like a deliberate pulling of the plug, just like Egypt 22:30 GMT 20 January 2011. Various reports (for example Okga Khazan, wapo, 30 Nov 2012, Syria Internet outage: How it might have happened and what it means) say the Syrian government blames rebels for the outage, but what advantage would rebels gain from disconnecting the Internet they use to coordinate among themselves and with outsiders? Only an authoritarian government thinks it will gain advantage by disconnecting its country from the Internet.


At 10:30 GMT routing goes through London to somewhere in the middle east, as you can see in Figure 2:

Before: 10:30 AM GMT 29 November 2012 to Yemen

Figure 2: Before: 10:30 AM GMT 29 November 2012 to Yemen

  • 0.453 ms to
    a Level3 node in London connecting to a FLAG Telecom node
  • 1.21 ms to
    A FLAG Telecom node connecting perhaps to Dubai
  • 121 ms (at least hundreds of miles) to ?
    A FLAG Telecom node with no reverse DNS
  • a few ms to and ?
    two nodes with no reverse DNS in address space owned by, TeleYemen.

Nobody seems to claim, but apparently it is somehow associated with Syria, since it vanishes exactly at 10:30 AM GMT, when Syria disconnected from the Internet. Both and

Read the complete PerilWatch: Syria disconnects 29 November 2012