Significant Internet disruptions are happening in Sudan, possibly as a reaction to riots. We use RIPE NCC tools to get a better understanding of what is going on.
The latest we see in RIPEstat (see Figure 1) is that in the routing tables that we collect, five Sudanese networks (ASNs) are still visible that together announce a total of 21 IPv4 prefixes and two IPv6 prefixes. Before the outage, we saw six ASNs announcing a total of 2,122 IPv4 and two IPv6 prefixes.
What Figure 1 also shows is that there were brief periods (twice around 20:00 UTC) where the situation appeared to return to normal.
Zooming in on the ASNs that were visible in routing (see Figure 2), it is clear that this wasn't a full Internet blackout, at least not at the routing level: At its lowest point (25-09-2013, 12:55 UTC) we still saw three ASNs ( 33788/KANARTEL , 36972/MNTSD and 37197/SUDREN ) still announcing address space. The three ASNs that completely disappeared were 15706/SUDATEL , 36998/SDN-MOBITEL and 37211/VISIONVALLEY . Sudatel (the incumbent telecom) started announcing a single IPv4 prefix again around 13:00 UTC (our data has five-minute granularity). 
Figure 2: Sudanese ASNs in the routing table over time
The large drop in routed IPv4 prefixes is almost completely due to SDN-Mobitel - before the outage we see 1,864 IPv4 prefixes, while at time of writing this we only see a single /24 IPv4 prefix (256 IPv4 addresses) announced from this network.
Visibility of a network in routing is far from equal to everybody in the network having Internet access, and it is interesting to correlate these events in routing to actual traffic coming into large content networks ( Akamai and Google have publicly available indicators of volumes of traffic) at the macroscopic level.
Zooming in, we can see what happened in the SudREN network, the single network that we have a RIPE Atlas probe in.
SudREN is the national research and education network of Sudan. What we see in latency measurements (see Figure 3) from that network is that there are periods where the rest of the Internet cannot be reached. This happens twice before the disruptions that are seen in routing (roughly 10:30 to 11:00 UTC and again from 11:30 to 13:00 UTC). Apart from these brief outages, this data indicates that for this network Internet connectivity is not disrupted.
We'll try to keep on top of things and report updates in this article if we find new and interesting information.
If you want to monitor the status of the routing table in Sudan yourself, please visit:
https://stat.ripe.net/SD#tabId=routing
We'll try to keep updating that as near to real time as possible.
UPDATE (2013-09-26 10:28 UTC) : The last Sudanese AS that went missing from the routing table came back (around 10:00 UTC), and the number of IPv4 prefixes went up to normal levels again too (see Figure 4). Google's transparency report indicates traffic levels back to normal again around 10:00 UTC too.
UPDATE (2013-09-27 11:28 UTC):
I heard from what I consider a reliable source that the ISPs in Sudan were ordered to "shutdown the Internet".
The data we collected supports that: During the disruption described above a large number of networks were not globally visible anymore while a much smaller footprint of address space remained. Most Autonomous Systems (ASes) did not disappear completely from the global routing tables we collect, so possibly these ISPs mostly kept their international connectivity and core infrastructure running, while not providing Internet services to their end-users. Our RIPE Atlas measurements also support this, because the vantage point we have in SudREN that retained Internet connectivity seems to be close to their core infrastructure. With the data collected it's not possible to see if the users connected via SudREN had Internet access or not.
Let's hope this doesn't happen again.
Comments 0
Comments are disabled on articles published more than a year ago. If you'd like to inform us of any issues, please reach out to us via the contact form here.