Renesys Blog

"Our thoughts are with the Syrian people and we hope connectivity, and peace, will be quickly restored." Err... well, that's great. I'm glad that this information free blog post pimping your services ended with your sincere token of solidarity with the Syrian people. For an article with real information from people who actually understand what a network is, go here: http://www.renesys.com/blog/2012/11/syria-off-the-air.shtml (Yes, I'm a little annoyed. But that's just because a lot of companies are submitting their "informative" blog posts on HN while really it's just more pimping of said service.)

Renesys' always excellent coverage throws some more light. They say the routers are all still up, there haven't been any routes withdrawn, but packets are just stopping somewhere on the way into libya. Firewalled I'm guessing, so privileged parties can still communicate. http://www.renesys.com/blog/2011/02/libyan-disconnect-1.shtml#latest http://www.renesys.com/blog/assets_c/2011/03/latencies_Libya2_AllSourc… The second one is a plot of traceroutes into libya over 24 hours.

That articles is light on details. Renesys, who did a great job reporting on what was happening with Egypt's networks, is keeping an eye on the situation. Hopefully they'll have some details tomorrow: http://www.renesys.com/blog/2011/02/watching-algeria.shtml It sounds to me like Bouteflika might be volunteering to be next. edit: I should note, as the renesys link above, that all of Algeria's prefixes are still being advertised publicly, so if they are blocking the internet at this point it is some kind of internal filter and not an Egypt-style total cutoff.

Renesys has written about this twice with more facts and less speculation: http://www.renesys.com/blog/2010/06/two-strikes-i-root.shtml, http://www.renesys.com/blog/2010/03/fouling-the-global-nest.shtml The gist of things it that the mainland Chinese network operators allowed the anycasted routes for the I-root in China to leak outside of their networks and into the global BGP routing table. If you made a DNS request to the I-root during that leak, and the best route to the I-root prefix was the leaking route from China, then your DNS traffic went through the great firewall and was altered accordingly. Finally, I want to give the article the benefit of the doubt with regard to this: And he said he believes there were more instances of Web traffic being diverted to China, or "hijacked," around that time, but wouldn't elaborate. "I believe it happened more than twice," Joffe said. "I can't comment on how many times because the information is not generally public." but many views of the BGP routing table are public (http://routeviews.org) and/or fairly well monitored for hijackings, etc. by network operators and others like Renesys and BGPMon (http://bgpmon.net/). Unless this is occurring only within China's regional networks, I expect we would've heard something about this already.

I like Renesys's take [1] on the subject as well: Note that there’s no good exact opinion about the One True Size of the Internet — every provider we talk to has a slightly different guess. The peak of the distribution today (the consensus) is actually only about 502,000 routes, but recognizably valid answers can range from 497,000 to 511,000, and a few have straggled across the 512,000 line already. [1] http://www.renesys.com/2014/08/internet-512k-global-routes/ It's interesting how they explain that since there's no true consensus for the actual size of the routing table, the "event" of crossing the 512k barrier has frankly already begun ... and, so far, hasn't been catastrophic, nor likely to be.

You can make tcp/ip fail as well, just like Pakistan did back in 2008: http://www.renesys.com/2008/02/pakistan-hijacks-youtube-1/

Here's the post at Renesys upon which this article is based: http://www.renesys.com/2013/11/mitm-internet-hijacking/ FWIW, I found the renesys post more informative than the Wired article (though on a standalone basis it is pretty good too).

Because: http://www.renesys.com/2013/11/mitm-internet-hijacking/

IIRC the one with the biggest fallout was some Pakistani ISP which fucked up a YouTube block order - they broadcasted the null-route to the entire Internet and Google couldn't do anything, lol. I never heard the 'Pakistan shutting off Youtube globally'-story, so for those equally interested: http://www.renesys.com/wp-content/uploads/2013/05/nanog43-hijack.pdf

A much more competent article written by the researchers themselves explained that they did contact the Iceland ISP involved in one of the attacks. Their reply stated that it was caused by a bug in a vendor's software that was resolved after a patch. The ISP wasn't interested in looking into it any further. http://www.renesys.com/2013/11/mitm-internet-hijacking/

Original article from two days ago: http://www.renesys.com/2013/11/mitm-internet-hijacking/

Not his fault, his sources[0] call it an MitM attack, too. Furthermore, he goes on to explain that this was a BGP hijack, and even mentions the Pakistani incident you just brought up. [0] - http://www.renesys.com/2013/11/mitm-internet-hijacking/

The researchers who analyzed this attack call it a "Man-In-the-Middle (MITM) hijack", which makes this whole subthread kind of pointless since the journalist is just using the terminology of the original research. Check out the researchers' article for tracerout data and other interesting details: http://www.renesys.com/2013/11/mitm-internet-hijacking/ And if you're interested in how the internet works at this level (BGP, peering, ISPs), the book "Tubes: A Journey to the Center of the Internet" is interesting reading.

Directly connecting users from Greece - The Tor Project https://metrics.torproject.org/users.html?graph=direct-users&start… "What’s Next For Syria’s Internet" - Renesys http://www.renesys.com/2013/08/whats-next-for-syrias-internet/

Renesys' usually tracks and reports on events like this on their blog and, indeed, they posted an article yesterday about this: http://www.renesys.com/2013/08/whats-next-for-syrias-internet/ A few examples from previous events of a similar nature: http://www.renesys.com/2011/01/egypt-leaves-the-internet/ http://www.renesys.com/2011/06/syrian-internet-shutdown/ http://www.renesys.com/2012/11/syria-off-the-air/

I don't think the map relates to the "Mad Despot", and I think it's only about risk of disconnection (including accidental disconnection). I was shocked to see Portugal there at first, but I guess they have transatlantic cables to USA or maybe to UK and not much to mainland / Spain, and that's why they are low risk. Original's Renesys (the map creator) here: http://www.renesys.com/blog/2012/11/could-it-happen-in-your-countr.sht… (I don't have time to parse it now, my first paragraph is just an idea)

I was just checking if Renesys[1] had any analytical updates, but hey, kudos to Cloudflare for a well-written and visualised post! [1] http://www.renesys.com/blog/2012/11/syria-off-the-air.shtml

At the bottom of the Renesys blog post, the folks there have a map showing the cables into Syria: http://www.renesys.com/blog/2012/11/syria-off-the-air.shtml

more detail also > http://www.renesys.com/blog/2012/11/sandys-global-impacts.shtml

Malicious party? It already happened by accident. http://www.renesys.com/blog/2009/02/longer-is-not-better.shtml

For more technical details, see http://www.renesys.com/blog/2011/01/egypt-leaves-the-internet.shtml

This is different. http://www.renesys.com/blog/2011/01/egypt-leaves-the-internet.shtml

Unfortunately, no. However these two articles (taken from Techmeme) are very interesting as they are basing their observations on the number of affected BGP routes: http://www.renesys.com/blog/2011/01/egypt-leaves-the-internet.shtml List of all affected networks -- seems like a very few are still holding up (Noor's name comes up again and again... for now) http://bgpmon.net/blog/?p=450

Now, almost all of them: http://www.renesys.com/blog/2010/10/internet-transit-sales-2005-10.sht… I wouldn't really consider Google a "backbone provider" since they don't sell transit; they're more of an "extremely ginormous end site".

"Whereas if it were a traditional peering dispute, the quality of the service would degrade with longer routes rather than be terminated altogether. " Nope, if a pair of Tier-1 Providers De-peer, their customers can't communicate to each other unless the new intermediary receives some form of settlement. They won't do it for free. See: http://www.renesys.com/tech/presentations/pdf/nanog43-peeringwars.pdf for an example of this.

This reminds me of the time Pakistan's AS accidentally blocked YouTube for the whole world. They accidentally published a very specific routing rule pointing YouTube's IP addressed to some machine in their network. This sucks even more than breaking DNS because you can't even get around it by hardcoding the IP. http://www.renesys.com/blog/2008/02/pakistan_hijacks_youtube_1.shtml

I came across this blog about the Wild West of Internet peering/transit when they had the undersea cable episodes. You might find it interesting. http://www.renesys.com/blog/

BGP is a protocol used to exchange routing information. Pakistan's main provider is a company called PCCW, so they are Pakistan's "upstream" provider. Each BGP peer announces which set of routes they are the final destination for, e.g. Level3 announces themselves as the final dest for my Class C, 206.192.23.0/24 . In blocking YouTube, they either meant to be malicious, or, they meant to null-route YouTube inside Pakistan but instead fat-fingered it and issued commands that instead of null-routing, made them the final destination for those YouTube IPs. Mistake that YouTube made was that this Class C was also where their DNS servers were, so they were unable to redirect people elsewhere once they were aware what was going on (since corrected). Also see http://www.renesys.com/blog/2008/02/pakistan_hijacks_youtube_1.shtml

How about traditional journalism and reporting as a method of intelligence? The government is supposed to be for and by the people and I for one don't feel comfortable with my tax dollars going to aid this sort of actively offensive espionage/violation of human rights. But that's just my opinion and it's something I should vote for or whatever if I feel strongly about it; that's not what this is about. This is about a right to know what type of actions my government (which is supposed to be a representation of me) is involved in in this world. Without Snowden I would never know for certain that my government is involved in actions like this and I would never have the ability to object to actions like this in a public forum without being labeled a conspiracy theorist. I mean just look at this list of articles speculating on what was going on with Syria's internet, do any of these even dare to speculate that it was NSA espionage that caused the outages? Of course not cause that's fucking crazy; except it's not and we know it's not because of Snowden and Snowden alone. He is a truer patriot than you or I will ever be. Press coverage of the Syrian internet outage at the time: http://www.cnet.com/news/blackout-syria-vanishes-from-intern... "The Middle Eastern country has been experiencing an Internet outage for several hours, and many people on Twitter are reporting that phone lines are down as well." http://www.renesys.com/2012/11/syria-off-the-air/ "There was one brief…

Press coverage of the Syrian internet outage at the time: http://www.cnet.com/news/blackout-syria-vanishes-from-internet/ "The Middle Eastern country has been experiencing an Internet outage for several hours, and many people on Twitter are reporting that phone lines are down as well." http://www.renesys.com/2012/11/syria-off-the-air/ "There was one brief whole-country outage of less than ten minutes on 25 November. By the time that one was confirmed, the outage was over. It would be reaching to call that a “precursor event” or “practice run,” but that’s a possibility." http://www.huffingtonpost.com/2012/11/30/anonymous-declares-war-syrian… "The Syrian government said that terrorists were behind the outages, but CloudFlare, a firm that helps accelerate Internet traffic, said it would have been extremely difficult for any type of sabotage to cause such a comprehensive blackout, according to Reuters." http://blog.cloudflare.com/how-syria-turned-off-the-internet "All the edge routers are controlled by Syrian Telecommunications. The systematic way in which routes were withdrawn suggests that this was done through updates in router configurations, not through a physical failure or cable cut."