Renesys Blog

How about traditional journalism and reporting as a method of intelligence? The government is supposed to be for and by the people and I for one don't feel comfortable with my tax dollars going to aid this sort of actively offensive espionage/violation of human rights. But that's just my opinion and it's something I should vote for or whatever if I feel strongly about it; that's not what this is about. This is about a right to know what type of actions my government (which is supposed to be a representation of me) is involved in in this world. Without Snowden I would never know for certain that my government is involved in actions like this and I would never have the ability to object to actions like this in a public forum without being labeled a conspiracy theorist. I mean just look at this list of articles speculating on what was going on with Syria's internet, do any of these even dare to speculate that it was NSA espionage that caused the outages? Of course not cause that's fucking crazy; except it's not and we know it's not because of Snowden and Snowden alone. He is a truer patriot than you or I will ever be.

Press coverage of the Syrian internet outage at the time: http://www.cnet.com/news/blackout-syria-vanishes-from-intern... "The Middle Eastern country has been experiencing an Internet outage for several hours, and many people on Twitter are reporting that phone lines are down as well."
http://www.renesys.com/2012/11/syria-off-the-air/ "There was one brief…

Renesys has written about this twice with more facts and less speculation: http://www.renesys.com/blog/2010/06/two-strikes-i-root.shtml, http://www.renesys.com/blog/2010/03/fouling-the-global-nest.shtml

The gist of things it that the mainland Chinese network operators allowed the anycasted routes for the I-root in China to leak outside of their networks and into the global BGP routing table. If you made a DNS request to the I-root during that leak, and the best route to the I-root prefix was the leaking route from China, then your DNS traffic went through the great firewall and was altered accordingly.

Finally, I want to give the article the benefit of the doubt with regard to this:

And he said he believes there were more instances of Web traffic
being diverted to China, or "hijacked," around that time, but
wouldn't elaborate. "I believe it happened more than twice,"
Joffe said. "I can't comment on how many times because the
information is not generally public."

but many views of the BGP routing table are public (http://routeviews.org) and/or fairly well monitored for hijackings, etc. by network operators and others like Renesys and BGPMon (http://bgpmon.net/). Unless this is occurring only within China's regional networks, I expect we would've heard something about this already.

Press coverage of the Syrian internet outage at the time:
http://www.cnet.com/news/blackout-syria-vanishes-from-internet/
"The Middle Eastern country has been experiencing an Internet outage for several hours, and many people on Twitter are reporting that phone lines are down as well."

http://www.renesys.com/2012/11/syria-off-the-air/
"There was one brief whole-country outage of less than ten minutes on 25 November. By the time that one was confirmed, the outage was over. It would be reaching to call that a “precursor event” or “practice run,” but that’s a possibility."

http://www.huffingtonpost.com/2012/11/30/anonymous-declares-war-syrian-government-websites_n_2218447.html
"The Syrian government said that terrorists were behind the outages, but CloudFlare, a firm that helps accelerate Internet traffic, said it would have been extremely difficult for any type of sabotage to cause such a comprehensive blackout, according to Reuters."

http://blog.cloudflare.com/how-syria-turned-off-the-internet
"All the edge routers are controlled by Syrian Telecommunications. The systematic way in which routes were withdrawn suggests that this was done through updates in router configurations, not through a physical failure or cable cut."

BGP is a protocol used to exchange routing information. Pakistan's main provider is a company called PCCW, so they are Pakistan's "upstream" provider.

Each BGP peer announces which set of routes they are the final destination for, e.g. Level3 announces themselves as the final dest for my Class C, 206.192.23.0/24 .

In blocking YouTube, they either meant to be malicious, or, they meant to null-route YouTube inside Pakistan but instead fat-fingered it and issued commands that instead of null-routing, made them the final destination for those YouTube IPs.

Mistake that YouTube made was that this Class C was also where their DNS servers were, so they were unable to redirect people elsewhere once they were aware what was going on (since corrected).

Also see http://www.renesys.com/blog/2008/02/pakistan_hijacks_youtube_1.shtml

I like Renesys's take [1] on the subject as well:

Note that there’s no good exact opinion about the One True Size of the Internet — every provider we talk to has a slightly different guess. The peak of the distribution today (the consensus) is actually only about 502,000 routes, but recognizably valid answers can range from 497,000 to 511,000, and a few have straggled across the 512,000 line already.

[1] http://www.renesys.com/2014/08/internet-512k-global-routes/

It's interesting how they explain that since there's no true consensus for the actual size of the routing table, the "event" of crossing the 512k barrier has frankly already begun ... and, so far, hasn't been catastrophic, nor likely to be.

"Our thoughts are with the Syrian people and we hope connectivity, and peace, will be quickly restored."

Err... well, that's great. I'm glad that this information free blog post pimping your services ended with your sincere token of solidarity with the Syrian people.

For an article with real information from people who actually understand what a network is, go here: http://www.renesys.com/blog/2012/11/syria-off-the-air.shtml

(Yes, I'm a little annoyed. But that's just because a lot of companies are submitting their "informative" blog posts on HN while really it's just more pimping of said service.)