Network Monitor

Network Monitor — March 2020

As Iran continues to battle against COVID-19, increased internet usage is putting a real strain on the country’s digital infrastructure.

Iran was plunged into yet another major crisis in March, with the COVID-19 outbreak spreading rapidly from its epicentre in Qom to villages, towns, and cities across the country. The public health emergency, which according to Iranian authorities has seen 53,183 recorded cases and 3,294 deaths (as of April 3), has resulted in massive social and economic disruption, and the introduction of tight controls on movement.

This crisis has also had a number of implications for citizens’ ability to get online and access information, though this appears to be largely due to strains on network infrastructure, as internet service providers (ISPs) struggle to cope with increased demand brought about by widespread remote working.

Iran’s network disruptions this month seem to have been largely attributable to two issues:

1- Online streaming has increased dramatically

Slow connection speeds were the main issues faced by users during March. As the government has advised citizens to stay home in order to combat the spread of COVID-19, Internet usage — and especially online streaming — has increased dramatically. According to Etemad Onlineinternet usage increased by 40% in the first week after COVID-19 started spreading in Iran.

In an effort to keep people at home, Iran’s ICT Ministry granted all home subscribers 100GB of free internet access, a very heavy traffic load on the national network.

Multiple sources from different internet providers in Iran confirmed to Filterwatch that ISPs purposefully slowed internet speeds in order to better cope with high traffic loads. It is likely that traffic loads were further increased as a result of the government’s 100GB giveaway, as users rushed to use their allowance before the offer’s expiry date.

2- Pre-planned maintenance-related internet shutdowns

Filterwatch received documents relating to planned maintenance-related service disruptions from a source that shall remain anonymous for security purposes. Based on these documents, the Telecommunication Infrastructure Company (TIC) informed ISPs that access to the global Internet would be disrupted during the following periods, while maintenance work was undertaken:

  • March 4 from 02:00 until 08:00 IRST (Iran Standard Time)
  • March 5 from 01:30 until 07:30 IRST
  • March 10 from 02:30 until 07:30 IRST
  • March 14 from 00:30 until 06:35 IRST
  • March 15 from 00:30 until 07:10 IRST

None of these planned disruptions were announced by Iranian officials or ISPs, causing confusion among users during these maintenance periods. In order to prevent this, the TIC and ISPs should communicate planned disruptions in a transparent manner, and clearly outline the reasons for such disruptions.

Our day-by-day analysis and documentation of key disruption incidents in March follows:

March 2 — Pre-planned internet shutdown

Qom was among the major cities that were disconnected from the Internet on March 2. During previous internet shutdowns, it was impossible for users outside Iran to access domestically hosted websites. During this brief shutdown, news sites remained accessible from abroad, but a number of websites — including Arvand Cloud’s network measurement service ‘Radar’ — were not.

Arvand Cloud was not accessible from outside the country.

On March 4 Sajjad Bonabi, a board member of the Telecommunications Infrastructure Company (TIC), responded to a question from the technology website Digiato about the disruption, stating:

“Approximately 40% of users were disconnected from the internet from 04:15 to 04:55 [IRST]. Yesterday we informed all ISPs that we had a planned update on the network from 02:00 to 08:00 [IRST], which may cause disruption.”

Between 01:40–06:30 IRST (21:10–02:00 UTC) Iran’s internet was disconnected from the global internet.
IODA data showed that the three provinces experiencing the most widespread internet outages were Markaz, Semnan, and Qom.


On the same night, Persian-language Wikipedia was filtered for a period of around two hours, before being unblocked. We believe this was a side effect of network maintenance.

Persian-language Wikipedia was filtered for around two hours.

March 3 — Widespread disconnections across multiple providers

Based on OIM data, March 3 was the worst day of the month with regard to internet disruptions. On this day, eleven major internet providers were disconnected from the Internet for a short period.

March 4 — Brief disruption identified

In line with the TIC documents observed by Small Media, a very brief period of disruption was observed between 22:00–23:00 UTC.

March 10 — Further disruptions detected

Pars Online was one of the ISPs most affected by the planned network disruptions on March 10. Although the disruption was in line with predictions from the leaked TIC document, no ISPs warned their customers about the planned outages.

March 11–24 — Minor disruptions reported

On March 11 rom 17:20–20:01 UTC (21:50–00:31 IRST) Arvand Radar reported disruptions. Based on Radar data, AsiaTech and Respina were particularly badly affected by this disruption.

Between March 11–24 Small Media observed very minor disruptions. During this period internet speeds decreased noticeably, especially on international traffic.

March 26 — Research Center of Theoretical Physics & Mathematics (IPM) goes offline

The Research Center of Theoretical Physics & Mathematics (IPM) network went offline completely from around 10:00 on March 25 until around 13:00 March 26. This is particularly important because IPM is responsible for managing top-level domains (TLDs) in Iran, including the .ir TLD.

IPM was almost completely disconnected from the Internet without any explanation from around 10:00 March 25 until around 13:00 on March 26.

Crucially, this outage would have had nothing to do with increasing online streaming, because IPM is not an internet provider — the only service they provide is the management of Iran’s TLDs. As such, this outage is unexplained.