Analysis of Egyptian Internet outage 27th January - 2nd February 2011

In January 2011, Egypt was completely disconnected from the Internet. There is some background to this incident on RIPE Labs here, a summary on Wikipedia and additional visualisations from the RIPE NCC REX tool.

The RIPE NCC provided a real-time monitor to observe reachability of Egyptian prefixes throughout the disconnection.

This page also archives the withdrawal and subsequent re-announcement of the prefixes of the Egyptian Internet on the 27th of January and the 2nd of February.

Snapshot of the withdrawal of the Egyptian Internet

Starting from 27 Jan 20:30 UTC we observe increased levels of BGP activity for Egyptian prefixes. Clearly visible after 22:00 is the huge spike in updates and withdrawals when many Egyptian prefixes were withdrawn from the Internet.

The second graph below shows data for specific prefix visibilities as opposed to general BGP activity.

The many updates visible at the time the address ranges were withdrawn are due to the nature of the BGP protocol. It takes some time for withdrawals to propogate between all routers and during this period, the routers continuously inform each other of the changing paths.

Static view on BGP activity for prefixes originating from Egyptian organisations between 27 Jan 16:00 UTC and 28 Jan 01:00 UTC

Static view on the number of visible prefixes originating from Egyptian organisations between 27 Jan 16:00 UTC and 28 Jan 01:00 UTC

Snapshot of the return of the Egyptian Internet

Methodology

The 3089 prefixes we monitor were selected by identifying ranges allocated to Egyptian organisations, as documented by AfriNIC here. We searched the RIPE NCC Routing Information Service (RIS) for announced prefixes from within these allocations which were visible between 20th and 28th January 2011. In total, these prefixes were announced by 51 ASes.

This selection process could result in both false positives and negatives, explaining why some activity is still seen even though the Egyptian Internet is generality considered to be 'offline'.

The visible prefix graph is constructed by applying live BGP update (announcement and withdrawal) events to data contained in regularly generated full routing table dumps in order to maintain a constant and accurate count of visible prefixes.

All routing data is taken from the RIPE NCC's RIS, which collects global Border Gateway Protocol (BGP) information observed from over 600 networks worldwide.