You are here: Home > Publications > RIPE Labs > Alun Davies > Our First Glance at the Belarus Outages

Our First Glance at the Belarus Outages

Alun Davies — 12 Aug 2020
On 9 August, Belarus experienced country-wide Internet outages. Here's a first glance at what our tools and datasets have to tell us about the scale of these outages and their impact.

Belarus has a population of around 9.5 million citizens with an estimated 75%-80% of these being active Internet users (current figures vary depending on sources, see herehere, and here). Beltelecom, national telecommunications company for Belarus, is the primary provider for fixed Internet connections for these users, while MTS and A1 Mobile are among the major mobile network providers. 

On Sunday 9 August, the day presidential elections took place in the country, wide-scale Internet outages occurred, partially disrupting the ability of people in Belarus to connect with the rest of the world via the Internet. Questions about the scale of these outages and their impact have been circulating since. 

What We See in RIPE Atlas

RIPE Atlas, a service we provide that allows anyone anywhere to create various kinds of useful Internet measurements, is made up of a network of probes distributed all over the world. On the day the outages occurred in Belarus, we see that a significant number of probes in the country went offline. The following visualisation from RIPEstat gives an indication of the extent of this.

As we see here, on 8 August, 19 of the 21 probes located in Belarus were up and running as normal. 
Two days later, only 6 of these were still connected to the RIPE Atlas network. A 70% drop in the number of probes connected in a country in one day is notable, and fits with wider reports on the scale of the outage. 

Of the probes that stayed connected, all were situated in ASNs operated by the national service provider, Beltelecom. The map on the right shows the situation from RIPE Atlas at around 16:00 on 11 August, at which point only one of the probes situated in another ASN had come back online. As of the morning of 12 August, all probes that went offline since 8 August have reconnected. You can check the current status of probes in Belarus on the RIPE Atlas probe network coverage map

What We See in Our Routing Information Service (RIS)

We also see a drop in routing visibility for Belarus networks on 9 August. If we look at the BGP data collected via our Routing Information Service (RIS) - available in the RIPEstat country routing statistics for Belarus - we see that during a certain period later in the day, the number of IPv4 visible prefixes dropped by a little over 10%, from 1,044 to 922. These numbers then recovered the following day.

As for the IPv6 prefixes, the change was more pronounced. In total, 56 of the 94 IPv6 prefixes that were visible to BGP early on Sunday morning disappeared just after 06:00. That's a 60% drop. This situation lasted until around 04:45 on 12 August, by which point the number of prefixes had risen back to 94. 

It's worth noting that the IPv4 prefixes hosting the RIPE Atlas probes that became disconnected that day did remain visible. However, the fact that there a route is visible in BGP does not, in and of itself, tell us whether hosts in the relevant networks are reachable.

Perform Your Own Analysis

As a neutral source of information, we actively contribute to the health and stability of the Internet. We offer a whole range of tools and services that are there to help you arrive at get a clearer understanding of how the Internet is functioning at any given moment in time. 

Much of the above is based on what we see in RIPEstat, which provides visualisations for routing data collected in RIS, data on RIPE Atlas probe deployment per country, and other country-level data, all of which can be made us of by anyone who wants to monitor Internet events just like this one. If you're interested in investigating the outages further for yourself, there are lots more widgets available in RIPEstat that you can use to get more information.

You can also dive in to the raw data from our Routing Information Service (RIS), which we collect and make available to anyone who wants it. Or go and investigate the current situation in more detail by creating your own Internet measurements in RIPE Atlas

Conclusions

The data we have on the Internet outages that occurred in Belarus last Sunday, taken together with other reports that have circulated since, point to large scale disruption across a number of networks that would have had a real impact on Internet users in the country. While some of the effects of this lasted - with a number of RIPE Atlas probes having not been reachable for a few days, and a significant number of IPv6 prefixes having disappeared from BGP for the same period - things do seem to have returned to normal as of this morning (12 August). 

It's also clear this wasn't a full shutdown during which the entire country lost touch with the wider Internet. A number of RIPE Atlas probes did remain connected throughout. And as noted, many routes and ASNs remained visible in BGP all the time; though as stated, this alone doesn't mean hosts in the relevant networks were reachable at the time of the outages.

In sum, while this is just our first look at the situation, there's a plenty of room for further analysis. To support this, we invite and encourage anyone out there to make use of all the tools and datasets we at the RIPE NCC have to offer in order to get a better understanding of these recent events and their impact on the Internet as a whole.

12 Comments

Gino says:
12 Aug, 2020 02:46 PM
A small correction - population is 9,5 mil. people
Alun Davies says:
12 Aug, 2020 02:55 PM
Fixed. Thank you!
Yury says:
12 Aug, 2020 02:58 PM
Any info about traffic packet loss from probes?
Alun Davies says:
12 Aug, 2020 04:02 PM
Good question. Arriving at a proper answer to this would require looking at all measurements from all probes for the past four days to find out if any observed packet losses is related to the outage or to other issues in the path to the destination. From a first peek at one probe that disconnected for two days and came back, it seems that (some/all?) IPv4 pings did make it through all the time. IPv6 on the other hand had 100% packet loss. See: https://atlas.ripe.net/probes/25114/#tab-builtins
Ilya Begun says:
12 Aug, 2020 03:26 PM
Even more, I can provide you proofs of DNS Spoofing commited on the governmentally controlled in-country DNS server.
anna cerino says:
12 Aug, 2020 03:45 PM
small (almost rhetorical but not really) question. do you assume these outages were created manually on request of state regulator?
Alun Davies says:
13 Aug, 2020 04:53 PM
As we say, our purpose here is really to see what our data has to tell us about the scale and impact of the outages. Nothing in the data we've been looking at determines what caused the outages.
Pavel Polyakov says:
12 Aug, 2020 04:35 PM
Also, it is interesting to note that hosts that stayed up while most were off had an heavy filtering of TLS traffic.

There were a few exceptions, yandex.* and vk.com remained accessible at all time. Plain text still worked, and one way to circumvent the censorship was to start a plain text connection and then upgrade it, such as with Opportunistic TLS. SSH for instance, would work.

It also look like that they have tried to disconnect the local Internet Exchange so as to be sure that no interconnections could be made with international peers without going through the government-controlled operator. Beltelecom (AS6697), which normally peers on various IXPs also became unavailable via those.
Mikalai Daronin says:
12 Aug, 2020 05:19 PM
Neither SSH nor yandex.*, vk.com worked for me
Pavel Polyakov says:
12 Aug, 2020 06:47 PM
Could you establish any plain text connection? It worked from both Byfly and Beltelecom. I suppose you were just completely offline.
Andrei says:
12 Aug, 2020 05:28 PM
I'm from Belarus and see in errors in logs of stubby: TLS filtering/drop.
Vesna says:
13 Aug, 2020 09:24 AM
While RIPE Atlas does not measure HTTP, here are some other sources of various measurements of Internet in Belarus:

Open Observatory:
https://explorer.ooni.org/s[…]20-08-07&only=anomalies

NetBlocks: https://netblocks.org/repor[…]us-on-election-day-YAE2jKB3

Oracle: https://map.internetintel.o[…]mp;country=BY&asn=25106
Add comment

You can add a comment by filling out the form below. Comments are moderated so they won't appear immediately. If you have a RIPE NCC Access account, we would like you to log in.