{"id":2230,"date":"2020-03-06T15:58:14","date_gmt":"2020-03-06T15:58:14","guid":{"rendered":"https:\/\/filter.watch\/en\/?p=2230"},"modified":"2020-06-02T18:56:37","modified_gmt":"2020-06-02T18:56:37","slug":"network-monitor-february-2020","status":"publish","type":"post","link":"https:\/\/filter.watch\/english\/2020\/03\/06\/network-monitor-february-2020\/","title":{"rendered":"Network Monitor \u2014 February 2020"},"content":{"rendered":"
\n
\n
\n

Unlike\u00a0in January<\/a>\u00a0\u2014 where we saw a number of sustained internet disruption incidents, and in some cases even shutdowns \u2014 we did not see any protracted internet shutdowns in February. However, we were able to observe a number of network disruptions affecting Iran, commencing from 2 February.<\/p>\n

In contrast to January, much of the disruption was short and at times specific to geographical locations. While Iranian officials claim that some of the disruptions were the result of DDoS attacks, they have so far failed to provide any convincing evidence or supporting data.<\/p>\n

We believe a number of disruptions observed during this period were caused by authorities\u2019 introduction of a new Internet Exchange Point (IXP) named \u2018Rikeza Ltd\u2019. Again, Iranian authorities have failed to publicly acknowledge this, or to provide a public explanation about its creation.<\/p>\n

On 8 February, the Director of the Telecommunications Infrastructure Company (TIC) Hamid Fatahi\u00a0claimed<\/a>\u00a0on Twitter that DDoS attacks from outside Iran were the cause of network disruptions. He\u00a0tweeted<\/a>:<\/p>\n

\n

\u201cHired hackers today launched the most widespread attack against the country\u2019s infrastructure in Iranian history. Millions of origins targeted millions of destinations and are seeking worldwide disruption to Iran\u2019s Internet network with a SYN [synchronised] flood* attack of 180 million PPS [packets per second]. The attack was repelled, and their efforts were futile.\u201d<\/em><\/p>\n<\/blockquote>\n

*[A\u00a0<\/em>SYN flood<\/em><\/a>\u00a0is a form of DDoS attack in which an attacker sends a succession of SYN requests to a target\u2019s system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.]<\/em><\/p>\n

Our research was unable to prove such a claim. However on February 17, Sajjad Bonabi \u2014 a TIC board member who previously\u00a0confirmed<\/a>\u00a0the DDoS attack on Twitter \u2014\u00a0said<\/a>\u00a0the source of the DDoS attack originated from inside the country, and suggested that it was launched by \u201cdomestic competitors\u201d.<\/p>\n

Detailed documentation of our findings and observations from February are available below. Let our team know if you have any questions or observations of your own.<\/p>\n<\/div>\n<\/div>\n<\/section>\n

\n
\n
\n
\n
\n
\n
\n
\n
\"This<\/div>\n<\/div>\n<\/div>\n<\/div>
<\/figcaption><\/figure>\n
\n
\n
\n
\n
\n
<\/div>\n
\"\"
Loading...<\/figcaption><\/figure>\n<\/div>\n<\/div>\n<\/div>\n<\/div>
<\/figcaption><\/figure>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n

2 February \u2014 Disruptions noted across 13 providers<\/strong><\/h2>\n

We observed disruptions on at least 13 providers. Oracle Intelligence Map (OIM) data confirmed these disruptions, which primarily affected Fars Province, Khuzestan Province and Hamedan Province.<\/p>\n

\n
\n
\n
\n
\n
<\/div>\n
\"\"
Loading...<\/figcaption><\/figure>\n<\/div>\n<\/div>\n<\/div>\n<\/div>
<\/figcaption><\/figure>\n

8 February \u2014 Fewer providers affected by disruption<\/strong><\/h2>\n

According to OIM data, the number of providers affected by the disruption decreased from 13 to 7.<\/p>\n

\n
\n
\n
\n
\n
\"\"
Loading...<\/figcaption><\/figure>\n<\/div>\n<\/div>\n<\/div>\n<\/div>
<\/figcaption><\/figure>\n

On 8 February, TIC Director\u00a0Hamid Fatahi<\/a>\u00a0and TIC board member\u00a0Sajjad Bonabi<\/a>\u00a0claimed that the disruptions were caused by DDoS attacks originating from outside Iran. Authorities provided no further information to prove this claim, and our research was unable to gain insights into the source of the alleged attack.<\/p>\n

A source close to the ICT Ministry told Filterwatch that \u201cthere is no specific evidence\u201d due to be published about the origin of the DDoS attack.<\/p>\n

\n
\n
\n
\n
\n
<\/div>\n
\"\"
Loading...<\/figcaption><\/figure>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n

According to the\u00a0Arvan Cloud network monitoring system<\/a>, Arsia Tech, Irancell, HiWEB and Respina were among the most severely affected providers. Later, on 16 February, Arvan Cloud itself was affected in a way that caused a number of its VPSs to be disconnected from the Internet and become limited to local websites, apps and services.<\/p>\n

13 February \u2014 Severe disruptions recorded on two major providers<\/strong><\/h2>\n

OIM provided an impact rating of 93.5 for the period of disruption in which Aria Shatel Company Ltd and Pars Online were almost completely disconnected from the internet for a very short period of time.<\/p>\n

The fall in traceroutes on Aria Shatel and Pars Online demonstrates that these two providers were almost completely disconnected from the internet.<\/p>\n

\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n
\n
\n
\n
\n
<\/div>\n

<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n

14 February \u2014 New Internet Exchange Point introduced<\/strong><\/h2>\n

Significantly, a new Internet Exchange Point (IXP) was introduced, named \u2018Rikeza Ltd\u2019. Later, on 21 February, we observed significant data shifts from other IXPs to this new one.<\/p>\n

16 February \u2014 Data centres disconnected from the Internet<\/strong><\/h2>\n

Our research found that Arvan Cloud VPSs on MobinNet and Asiatech data centres were disconnected from the Internet. Later that day, Peivast\u00a0reported<\/a>\u00a0that Arvan Cloud was affected by a DDoS attack originating from both inside and outside Iran. Our investigation found no evidence that other data centers were affected by this attack.<\/p>\n

17 February \u2014 TIC blames domestic competitors for DDoS attacks<\/strong><\/h2>\n

During the period of network disruptions between 2\u201317 February, Iranians officials repeatedly claimed that external hackers were responsible for sustained DDoS attacks.<\/p>\n

But on 17 February, TIC board member Sajjad Bonabi,\u00a0tweeted<\/a>\u00a0that: \u201cthe companies\u2019 domestic competitors are likely to be the source of the attack.\u201d<\/p>\n

21 February \u2014 Traffic shifts to new IXP<\/strong><\/h2>\n

According to the Tehran IXP\u00a0website<\/a>, the new IXP launched on 14 February has 16 members, including:<\/p>\n