The Ukrainian Internet

There is much speculation about what has been happening to the Internet in Ukraine since the ongoing conflict began on 24 February. After food and shelter, access to information is one of the more vital resources at this time. As much is unclear, we'd like to show what the data we collect points at, in terms of the state of the Internet in Ukraine. We fully realise things can change at any moment, so our analysis will likely be rendered moot in the upcoming days. That said, we will be keeping up with developments and will try to update this post as and when new information becomes available.

What RIPE Atlas tells us about the Ukrainian Internet

One very direct signal we have about the Ukrainian Internet is the number of RIPE Atlas probes that are online. RIPE Atlas probes are devices that measure the Internet from a particular location. There are around 200 of these devices in Ukraine, hosted by volunteers from the RIPE community.

This is what we see at the time of writing:

Since 24 February we see a slow but steady decline from 222 connected probes to 185 on 28 February. It is hard to pinpoint the cause of this decline, but since many people in Ukraine left houses and offices to get to safer places, a likely explanation for this decline in connected probes is that people switched off their home/office Internet access devices.

The two most noteworthy things we saw are as follows:

ISP Triolan (AS13188)

We saw the ISP Triolan, which connects an estimated 5% of end-users in Ukraine, disrupted on 24 February. If we zoom into the probes we have there this is what we see:

Over half of the RIPE Atlas probes all went offline at the same time (2:48am UTC on 24 Feb), indicating a structural problem. Over the cause of the next days, most of these came online again. The data we collect with RIPE RIS about the Internet routing confirms that Internet routing for the Triolan address space was disrupted. In Figure 3 we show visibility of some of the Triolan originated address space on 24 Feb. Each horizontal line is the visibility of an individual IP prefix originated by Triolan. As you can see there are many different patterns for individual prefixes. Many show time-correlated changes, some were stable during the full day. Note that we only show a very small fraction of all the Triolan address space.

According to information available in a message on the Triolan website, the cause of the outage was sabotage.

27 February Dip

On 27 February, at around 8am UTC, we saw a short but noticeable drop in the number of connected probes. This is visible in Figure 1. When we inspect this closer we see that probes in multiple locations and across multiple networks cause this dip. This indicates there was either a problem with the physical infrastructure (for instance power loss), or all these networks share a common upstream element. Figure 5 shows connectivity for probes near Kyiv on 27 February, while Figure 6 shows the same for probes near Kharkiv:

Summary

As these were the two most notable events with regards to the Internet infrastructure that we found, the picture emerges that the Internet infrastructure in Ukraine has been mostly intact and functioning since the start of the conflict.

This is not to say that the events currently unfolding are not having a wider impact on the Ukrainian Internet. It just means that the components that connect up all the parts of the Internet (routers, physical infrastructure between them) have mostly stayed up and functional to the extent that we can see. What we don't have insight into is traffic levels. If a website is under a DDoS attack that prevents it from working, the infrastructure that we have insight into typically stays functional.

We can only speculate as to why the Internet infrastructure is holding up. This may be because it has not been deliberately targeted. Or it may be that the structure of Internet in Ukraine is such that it is very resilient to disruption? We know that the Internet in Ukraine spread over a large number of distinct networks, which might help with resilience. For instance, over 50% of end-users in Ukraine are in networks that have less then 1% of the end-user market. These are points we will continue to examine.

Like many, we are watching this situation very closely. Our thoughts are with the Ukrainian people, and we hope for a quick and peaceful resolution of this conflict.