<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Cloudfare believes the routes were withdrawn:<o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Beginning at 1026 UTC, routes were withdrawn for PCCW. The routing shifted primarily to Turk Telekom. Routes to Telecom Italia and TATA were also withdrawn, but has less of an impact. Then, at 1029 UTC, routes were withdrawn for Turk Telekom. After that, Syria was effectively cut off from the Internet. (Note that the remaining path that appears to be present in the video is an anomaly. We have confirmed that it is not actually active.)<o:p></o:p></span></i></p><p class=MsoNormal style='margin-left:.5in'><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>While we cannot know for sure, our network team estimates that Syria likely has a small number of edge routers. All the edge routers are controlled by Syrian Telecommunications. The systematic way in which routes were withdrawn suggests that this was done through updates in router configurations, not through a physical failure or cable cut.<o:p></o:p></span></i></p><p class=MsoNormal style='text-indent:.5in'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><a href="http://blog.cloudflare.com/how-syria-turned-off-the-internet">http://blog.cloudflare.com/how-syria-turned-off-the-internet</a><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>BGPMon also talks about routes being withdrawn: <a href="http://www.bgpmon.net/syria-shuts-down-the-internet/">http://www.bgpmon.net/syria-shuts-down-the-internet/</a><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I wish those who directly peer with AS29256 would/could share their router logs. Did they see their BGP sessions timeout or were there BGP UPDATEs?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Frank<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> outages-bounces@outages.org [mailto:outages-bounces@outages.org] <b>On Behalf Of </b>Grant Ridder<br><b>Sent:</b> Thursday, November 29, 2012 9:16 PM<br><b>To:</b> Josh Luthman<br><b>Cc:</b> Carl Brooks; outages@outages.org<br><b>Subject:</b> Re: [outages] Syria off the net<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Did they physically disconnect? or just disable eBGP?<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>-Grant<o:p></o:p></p><div><p class=MsoNormal>On Thu, Nov 29, 2012 at 8:38 PM, Josh Luthman <<a href="mailto:josh@imaginenetworksllc.com" target="_blank">josh@imaginenetworksllc.com</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal>Using ASN numbers you can see that a tiny piece is back.<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><a href="http://www.renesys.com/blog/2012/11/syria-off-the-air.shtml" target="_blank">http://www.renesys.com/blog/2012/11/syria-off-the-air.shtml</a><o:p></o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><span style='color:#888888'><br clear=all><span class=hoenzb>Josh Luthman</span><br><span class=hoenzb>Office: <a href="tel:937-552-2340" target="_blank">937-552-2340</a></span><br><span class=hoenzb>Direct: <a href="tel:937-552-2343" target="_blank">937-552-2343</a></span><br><span class=hoenzb>1100 Wayne St</span><br><span class=hoenzb>Suite 1337</span><br><span class=hoenzb>Troy, OH 45373</span><br><br></span><o:p></o:p></p><div><div><div><p class=MsoNormal>On Thu, Nov 29, 2012 at 9:24 PM, Sanjeev Gupta <<a href="mailto:sanjeev@dcs1.biz" target="_blank">sanjeev@dcs1.biz</a>> wrote:<o:p></o:p></p></div></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><div><div><p class=MsoNormal>On Fri, Nov 30, 2012 at 1:55 AM, Carl Brooks <<a href="mailto:carl.brooks@tier1research.com" target="_blank">carl.brooks@tier1research.com</a>> wrote:<o:p></o:p></p></div><div><div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal>Can anyone on the list confirm/expand? Cutting off web traffic isn't<br>cutting off network access.<o:p></o:p></p></blockquote></div><div><p class=MsoNormal><br>This is not blocking web, or a kind of traffic. This is switching off power to the routers that connect Syrian ISPs to the rest of the world. <br><br>For all we can tell, domestic traffic may still be flowing.<br><br>A similar case last year, in Egypt, see: <a href="http://bit.ly/65w20v" target="_blank">http://bit.ly/65w20v</a><span style='color:#888888'><br clear=all><br><br clear=all>-- <br>Sanjeev Gupta<br><a href="tel:%2B65%2098551208" target="_blank">+65 98551208</a> <a href="http://sg.linkedin.com/in/ghane" target="_blank">http://sg.linkedin.com/in/ghane</a><br> </span><o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p></div></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>_______________________________________________<br>Outages mailing list<br><a href="mailto:Outages@outages.org" target="_blank">Outages@outages.org</a><br><a href="https://puck.nether.net/mailman/listinfo/outages" target="_blank">https://puck.nether.net/mailman/listinfo/outages</a><o:p></o:p></p></div></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'><br>_______________________________________________<br>Outages mailing list<br><a href="mailto:Outages@outages.org">Outages@outages.org</a><br><a href="https://puck.nether.net/mailman/listinfo/outages" target="_blank">https://puck.nether.net/mailman/listinfo/outages</a><o:p></o:p></p></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>