The five smaller “net blocks” by Tata Communications that initially escaped the Internet blackout in Syria on 29 November were torn down about 12 hours after the blackout started, according to a blog post by Renesys, a network-operations monitoring company.

“These blocks survived today's Internet blackout in Syria, but 12 hours after the onset, they too are off the air,” James Crowie, Renesys CTO, wrote in a blog post. “Traceroutes to these blocks now die on Tata's network in New Jersey, and websites hosted in these blocks are no longer responding.”

A net block is a group of Internet Protocol (IP) addresses that has its own IP address. Each Internet Service Provider (ISP) has a net block it serves.

A traceroute is a tool for identifying packet-transfer problems in a network and for determining the path IP data travel along.

Around 12:30pm Damascus time on 29 November, all of Syria’s 84 net blocks became unreachable, according to Renesys. This information was later confirmed by the large content delivery network services provider Akamai.

This effectively took the entire civil-war-torn country off the global Internet, according to both Renesys and Akamai.

A Syrian government official said the blackout was the work of terrorists and affected only some regions of the country. The statement contradicted reports by Renesys and Akamai.

The five networks (each with its own net block) that escaped the massive blackout initially but later became unresponsive as well used IP addresses registered in Syria and hosted Syrian content. However, Crowie speculated, they were potentially off-shore, which would explain why they were not subject to “whatever kill switch was thrown today within Syria.”

These net blocks’ originator was Tata, an India-based global telecommunications company.

How it was done

CloudFlare, which optimizes network paths to accelerate web content delivery and has visibility into global network infrastructure, explained how the countrywide outage happened in a blog post.

State-run Syrian Telecommunications Establishment is the exclusive Internet-access provider in the country, according to CloudFlare. Connectivity from Syria to the rest of the Internet is provided by PCCW, Turk Telekom, Telecom Italia and Tata.

At the onset of the outage, all routes from Syria to these upstream providers were withdrawn at the same time. There are four physical cables that connect the country to the global Internet, all landing in the Syrian City of Tartous.

Since the entire country went offline at the same time, it was unlikely that these cables were cut. If that were true, they would have had to be cut simultaneously, CloudFlare explained.

PCCW, Telecom Italia and Tata routes were withdrawn at 10:26am local time, with routing shifting primarily to Turk Telekom, according to CloudFlare. Three minutes later, routes to Turk Telekom were withdrawn as well.

“While we cannot know for sure, our network team estimates that Syria likely has a small number of edge routers,” CloudFlare representatives wrote.

“All the edge routers are controlled by Syrian Telecommunications. The systematic way in which routes were withdrawn suggests that this was done through updates in router configurations, not through a physical failure or cable cut.”