Renesys confirms that the 13 globally routed Libyan network prefixes were withdrawn at 23:18 GMT (Friday night, 1:18am Saturday local time), and Libya is off the Internet. One Libyan route originated by Telecom Italia directly is still BGP-reachable, but inbound traceroutes appear to die in Palermo. A minority of our peers report some surviving paths through the peering connection between Level3 and Telecom Italia, but traceroutes into those prefixes fail, suggesting that the Libyan cutoff is complete.
We wondered whether anyone would repeat Egypt’s strategy. Tonight, it appears that we have our answer.
Update 06:39 UTC Saturday 19 Feb 2011
Corrected above report to reflect GMT+2 time zone.
Two-thirds of Libyan routes came back to life at 6:01 UTC (8:01 local time), and the remainder were restored nine minutes later. At the moment, spot checks of Libyan domains and traceroutes into affected networks indicate that connectivity has been restored, and Libya is back on the Internet.
Update 18:10 UTC Monday 21 Feb 2011
Libya has continued to have periods of partial or total unreachability through the weekend. The first night’s Internet blackout was repeated 24 hours later, with all prefixes unreachable from 1am to just after 8am Sunday morning. At the moment, however, the Libyan prefixes are reachable, traceroutes inbound are completing at normal rates, and key commercial and government websites that we spot check are responding normally.
If last night’s “Internet curfew” pattern repeats a third time, we would expect to see Libya leave the Internet again just after 1am local time (23:00 GMT). It’s unclear why rolling Internet blackouts would be strategically worthwhile — they just draw more attention to the government’s inability to control the flow of information. Are there any reports of power problems at the Telecom Libya facilities?
Update 22:00 UTC Tuesday 22 Feb 2011
No repeat of the overnight “Internet curfew.” Libyan routes are up and traceroutes are completing (though at reduced rates of success). Here’s a plot showing the average round-trip delay to Libyan hosts that have responded to traceroute over the last few days. The blue background indicates the count of successful completions.
You can see a few things here. The median time it takes to reach Libyan hosts from all over the world has remained pretty constant, roughly 200ms. Fewer traceroutes are succeeding, suggesting that reachability is impaired, even though the routes are up. The distribution of times has remained relatively stable, without large outliers, perhaps suggesting that the reported reductions in traffic to/from Libya are the result of internal shutdowns, rather than heavy congestion on the international links. Finally, you can see successful traceroute counts drop to zero during the outages.
Update 21:00 UTC Saturday 26 Feb 2011
Commenters have requested a weekend update on Libya, but sadly there isn’t a lot of new information to share at the infrastructure level. The last outage event of multiple Libyan networks was a few minutes’ blip on Wednesday, affecting only a few networks. It’s been quiet since then.
The Google Transparency Report has good data on the query rate coming from each country on earth. As you can see (click through for latest data), the Libyan Internet appears to be delivering a daily pattern of traffic to Google that is actually increasing, day by day, though down substantially from its levels before the two overnight Internet blackouts.
Update 00:00 UTC Friday 4 Mar 2011
After a quiet week, we received reports tonight that Libyans in Tripoli were suddenly unable to use various Internet communications utilities. Examining the BGP routing table, we saw nothing unusual — all Libyan routes up and stable.
But our traceroutes tell a different story (no responses from Libyan hosts). All of the Libyan-hosted government websites we tested (i.e., the ones that are actually hosted in Libya, and not elsewhere) were unreachable.
Google’s Transparency Report seems to confirm that their Libyan query traffic has fallen to zero as well (click for latest):
The Youtube plot is interesting, suggesting that Google’s Youtube traffic from Libya has grown steadily all week. Tonight, however, we suspect that someone has turned off the tap on the Libyan Internet again, this time leaving the routes in place.
Image credits: Google Transparency Report
Update 04:00 UTC Friday 4 Mar 2011
Our last successful traceroute into Libya was shortly after 16:35 UTC. So it looks like this is more than a blip — radio silence for 12 hours and counting.
About the Author
Jim Cowie is the Chief Scientist at Dyn. Previously, Jim was the founder and CTO of Renesys, the Internet Intelligence Authority, which Dyn acquired in 2014.Follow on Twitter More Content by Jim Cowie