Child pages
  • Sudan disconnected from the Internet Sep 2013.
Skip to end of metadata
Go to start of metadata

Introduction

The report from renesys states that

"We initially stated that Sudan’s outage began at 12:47 UTC because that was when virtually all Sudanese routed networks were withdrawn from the global routing table. However once we plotted our active data measurement data, we observed traffic into Sudan dropping off dramatically 2.5 hours earlier at 10.23 UTC"

See http://www.renesys.com/2013/09/internet-blackout-sudan/

Sudan has 3 carriers: Sudatel, Zain and Canar

Sudatel

Zain

Canar

PingER

PingER was actively monitoring one host in the Sudan. It waswww.sustech.edu (41.67.53.4, AS 37197 Sudan Educational network) at the Sudan University of Science and Technology

From the traceroute it appears to be currently on the Canar network, see hop 8-11 (on AS 33788/Canar) below:

161cottrell@pinger:~$traceroute -A www.sustech.edu
traceroute to www.sustech.edu (41.67.53.4), 30 hops max, 60 byte packets
 1  rtr-servcore1-serv01-iepm.slac.stanford.edu (134.79.104.66) [AS3671]  1.090 ms  1.229 ms  1.281 ms
 2  rtr-core1-p2p-servcore1.slac.stanford.edu (134.79.252.166) [AS3671]  0.365 ms  0.899 ms  1.079 ms
 3  rtr-border1-p2p-core1.slac.stanford.edu (134.79.252.133) [AS3671]  59.613 ms  59.859 ms  60.043 ms
 4  slac-mr2-p2p-rtr-border1.slac.stanford.edu (192.68.191.245) [AS3671]  0.416 ms  0.523 ms  0.639 ms
 5  * * *
 6  eqxsjrt1-te-sunncr5.es.net (134.55.38.146) [AS293]  1.313 ms  1.325 ms  1.512 ms
 7  * * *
 8  canar.pos3-7.ar01.hkg04.pccwbtn.net (63.218.253.198) [AS3491]  290.867 ms  291.048 ms  291.227 ms
 9  196.29.176.222 (196.29.176.222) [AS33788]  292.701 ms  293.577 ms  292.284 ms
10  196.29.176.190 (196.29.176.190) [AS33788]  292.099 ms  293.237 ms  294.367 ms
11  196.29.185.190 (196.29.185.190) [AS33788]  301.945 ms 196.29.167.154 (196.29.167.154) [AS33788]  302.063 ms 196.29.185.190 (196.29.185.190) [AS33788]  301.641 ms
12  41.67.49.10 (41.67.49.10) [AS37197]  279.412 ms  278.940 ms  278.614 ms
13  41.67.52.2 (41.67.52.2) [AS37197]  291.290 ms  291.466 ms  291.458 ms
14  * * *

Looking at the traceroutes for the last 3 days sustech was reached via Canar (AS 33788) at hop 9 and today at at least one time it did not reach canar until hop 22, see below

www-wanmon.slac.stanford.edu_to_www.sustech.edu_2013_09_25
  1  rtr-servcore1-serv01-webserv.slac.stanford.edu (134.79.197.130) [AS3671]  0.710 ms
2 rtr-core1-p2p-servcore1.slac.stanford.edu (134.79.252.166) [AS3671] 0.402 ms
3 rtr-border2-p2p-core1.slac.stanford.edu (134.79.252.141) [AS3671] 162.821 ms
4 slac-mr2-p2p-rtr-border2.slac.stanford.edu (192.68.191.249) [AS3671] 0.349 ms
  5  *
6 sacrcr5-ip-a-sunncr5.es.net (134.55.40.5) [AS293] 3.913 ms
7 denvcr5-ip-a-sacrcr5.es.net (134.55.50.202) [AS293] 24.818 ms
8 kanscr5-ip-a-denvcr5.es.net (134.55.49.58) [AS293] 35.343 ms
9 chiccr5-ip-a-kanscr5.es.net (134.55.43.81) [AS293] 46.481 ms
10 eqxchirt1-10g-chicsdn2.es.net (134.55.38.162) [AS293] 46.336 ms
11 *
12 ae-4.r23.nycmny01.us.bb.gin.ntt.net (129.250.2.41) [AS2914] 75.521 ms
13 ae-0.r22.nycmny01.us.bb.gin.ntt.net (129.250.3.72) [AS2914] 68.346 ms
14 ae-5.r22.londen03.uk.bb.gin.ntt.net (129.250.3.127) [AS2914] 151.034 ms
15 ae-1.r02.londen03.uk.bb.gin.ntt.net (129.250.5.25) [AS2914] 138.633 ms
16 flagtelecom-0.r02.londen03.uk.bb.gin.ntt.net (83.231.235.238) [AS2914] 148.038 ms
17 xe-8-0-0.0.pjr04.ldn001.flagtel.com (85.95.26.242) [AS15412] 158.601 ms
18 ge-4-0-0.0.cjr03.ldn001.flagtel.com (85.95.25.57) [AS15412] 147.422 ms
19 nileonline-gw-cairo.flagtel.com (80.77.0.46) [AS15412] 256.734 ms
 20  *
 21  *
22 (196.29.167.154) [AS33788] 235.247 ms
23 (41.67.49.10) [AS37197] 234.523 ms
24 41.67.52.2 (41.67.52.2) [AS37197] 229.913 ms
 25  *
 26  *

The PingER plot of the data is seen below, the spreadsheet is here.

The loss of connectivity (RTT=unknown=0, loss=100%) is seen between 8:00 and 8:30am September 25th GMT, there is a  recovery between 9:00 and 10:15, and then a further loss of connectivity until 13:00. The drops in minimum RTT from ~280ms to ~230ms is probably due to the use of an alternate route. Below is another plot of the data.

:
Looking at a table of the actual data below:

Unix_time,Date time GMT,min_RTT(ms),avg_RTT(ms),max_RTT(ms),%loss
1380085324,9/25/2013 5:02,280.385,280.936,282.866,0
1380087134,9/25/2013 5:32,281.074,282.962,288.845,0
1380088928,9/25/2013 6:02,280.320,292.474,336.327,0
1380090724,9/25/2013 6:32,280.715,286.028,292.144,0
1380092528,9/25/2013 7:02,281.981,288.808,298.165,9.09090909090909
1380094323,9/25/2013 7:32,281.759,288.019,314.491,0
1380096131,9/25/2013 8:02,281.050,283.917,290.358,0
1380097950,9/25/2013 8:32,0,0,0,100
1380099729,9/25/2013 9:02,280.690,282.218,283.601,0
1380101528,9/25/2013 9:32,281.171,285.518,291.491,0
1380103329,9/25/2013 10:02,281.104,288.021,327.293,0
1380105150,9/25/2013 10:32,0,0,0,100
1380106954,9/25/2013 11:02,0,0,0,100
1380108751,9/25/2013 11:32,0,0,0,100
1380110550,9/25/2013 12:02,0,0,0,100
1380112349,9/25/2013 12:32,0,0,0,100
1380114126,9/25/2013 13:02,270.353,280.918,290.726,0
1380115925,9/25/2013 13:32,226.030,226.951,230.748,0
1380117727,9/25/2013 14:02,226.785,227.393,228.768,0
1380119527,9/25/2013 14:32,227.032,227.950,230.481,0
1380121334,9/25/2013 15:02,227.399,230.987,239.005,0
1380123132,9/25/2013 15:32,282.730,287.740,290.140,0
1380124930,9/25/2013 16:02,281.887,283.951,285.858,0
1380126730,9/25/2013 16:32,281.529,282.192,284.912,0
1380128526,9/25/2013 17:02,281.409,281.822,282.178,0
1380130327,9/25/2013 17:32,281.380,281.844,283.111,0
1380132128,9/25/2013 18:02,281.310,282.324,284.849,0
1380133924,9/25/2013 18:32,281.602,281.866,282.449,0
1380135744,9/25/2013 19:02,281.276,282.206,284.889,0
1380137528,9/25/2013 19:32,281.340,281.844,282.484,0
1380139326,9/25/2013 20:02,281.357,281.642,282.205,0
1380141133,9/25/2013 20:32,281.346,282.205,285.742,0
1380142932,9/25/2013 21:02,281.332,283.323,292.448,0
1380144728,9/25/2013 21:32,281.365,282.475,285.592,0
1380146530,9/25/2013 22:02,281.327,281.523,282.009,0
1380148330,9/25/2013 22:32,281.303,281.542,281.974,0
1380150132,9/25/2013 23:02,281.200,281.577,281.993,0
1380151934,9/25/2013 23:32,281.294,281.630,282.159,0
1380153729,9/26/2013 0:02,281.330,281.694,282.168,0
1380155534,9/26/2013 0:32,281.379,281.812,284.329,0
1380157341,9/26/2013 1:02,281.292,281.650,282.500,0
1380159129,9/26/2013 1:32,281.280,281.621,282.010,0

indicates no connectivity at 10:30 on through 12:30 with connectivity being restored by 13:02.

The fact the no connectivity (100% loss) for Sustech does not follow that for Canar, probably indicates that the routes changed as the existing one failed and a new one was found. The potential routes are seen below:

  • No labels