Yes, actually. At around 12pm UTC Andree Toonk, Manager of Network Engineering here at OpenDNS, noticed a major disruption in DNS queries for the Syria (SY) country code top-level domain (ccTLD). Syria has one major Telco called Syrian Telecommunications Establishment (STE), which operates two autonomous systems AS29256 and AS29386 (both shown below):

as29256-ipv4

All prefixes for the 2 networks disappeared from the global routing tables at 12:25 UTC:

dns_drop

This can be verified via our own routers:

> show route aspath-regex ".* 29256" 
inet.0: 482433 destinations, 2234660 routes (482387 active, 1 holddown, 480712 hidden) 
inet.2: 177 destinations, 177 routes (177 active, 0 holddown, 0 hidden)
inet6.0: 16962 destinations, 84309 routes (16949 active, 1 holddown, 15 hidden)
{master}
> show route aspath-regex ".* 29386"    
inet.0: 482435 destinations, 2234663 routes (482388 active, 2 holddown, 480713 hidden)
inet.2: 177 destinations, 177 routes (177 active, 0 holddown, 0 hidden)
inet6.0: 16962 destinations, 84305 routes (16947 active, 3 holddown, 15 hidden)

There’s one other ISP in Syria operated by the Syrian Computer Society that serves Aleppo. Those networks (AS24814) are still reachable as can be seen here:

 > show route aspath-regex ".* 24814"    
inet.0: 482491 destinations, 2234957 routes (482444 active, 2 holddown, 480767 hidden)
+ = Active Route, - = Last Active, * = Both 
31.9.160.0/19      *[BGP/170] 01:02:35, MED 21551, localpref 100
                      AS path: 3356 9121 9121 24814 I
                    > to 212.72.47.61 via xe-1/1/0.0
                    [BGP/170] 01:02:58, MED 1, localpref 100
                      AS path: 2914 1299 9121 24814 I
                    > to 81.20.64.81 via xe-1/0/0.0
                    [BGP/170] 00:52:49, MED 15, localpref 100
                      AS path: 3257 1299 9121 24814 I
                    > to 77.67.66.69 via ge-0/2/0.309
                    [BGP/170] 01:02:58, localpref 100
                      AS path: 9121 9121 9121 9121 24814 I
                    > to 195.69.145.241 via ge-0/3/0.0
46.53.64.0/19      *[BGP/170] 01:02:35, MED 21551, localpref 100
                      AS path: 3356 9121 9121 24814 I
                    > to 212.72.47.61 via xe-1/1/0.0
                    [BGP/170] 01:02:58, MED 1, localpref 100
                      AS path: 2914 1299 9121 24814 I
                    > to 81.20.64.81 via xe-1/0/0.0
                    [BGP/170] 00:52:49, MED 15, localpref 100
                      AS path: 3257 1299 9121 24814 I
                    > to 77.67.66.69 via ge-0/2/0.309
                    [BGP/170] 01:02:58, localpref 100
                      AS path: 9121 9121 9121 9121 24814 I
                    > to 195.69.145.241 via ge-0/3/0.0
88.86.0.0/20       *[BGP/170] 01:03:13, MED 20658, localpref 100
                      AS path: 3356 9121 24814 I
                    > to 212.72.47.61 via xe-1/1/0.0
                    [BGP/170] 01:03:00, MED 1, localpref 100
                      AS path: 2914 3356 9121 24814 I
                    > to 81.20.64.81 via xe-1/0/0.0
                    [BGP/170] 1w6d 09:35:14, MED 5, localpref 100
                      AS path: 3257 3356 9121 24814 I
                    > to 77.67.66.69 via ge-0/2/0.309
                    [BGP/170] 01:02:58, localpref 100
                      AS path: 9121 9121 9121 9121 24814 I
                    > to 195.69.145.241 via ge-0/3/0.0
95.212.0.0/19      *[BGP/170] 01:02:35, MED 21551, localpref 100
                      AS path: 3356 9121 9121 24814 I
                    > to 212.72.47.61 via xe-1/1/0.0
                    [BGP/170] 01:02:58, MED 1, localpref 100
                      AS path: 2914 1299 9121 24814 I
                    > to 81.20.64.81 via xe-1/0/0.0
                    [BGP/170] 00:52:49, MED 15, localpref 100
                      AS path: 3257 1299 9121 24814 I
                    > to 77.67.66.69 via ge-0/2/0.309
                    [BGP/170] 01:02:58, localpref 100
                      AS path: 9121 9121 9121 9121 24814 I
                    > to 195.69.145.241 via ge-0/3/0.0
95.212.32.0/19     *[BGP/170] 01:02:35, MED 21551, localpref 100
                      AS path: 3356 9121 9121 24814 I
                    > to 212.72.47.61 via xe-1/1/0.0
                    [BGP/170] 01:02:58, MED 1, localpref 100
                      AS path: 2914 1299 9121 24814 I
                    > to 81.20.64.81 via xe-1/0/0.0
                    [BGP/170] 00:52:49, MED 15, localpref 100
                      AS path: 3257 1299 9121 24814 I
                    > to 77.67.66.69 via ge-0/2/0.309
                    [BGP/170] 01:02:58, localpref 100
                      AS path: 9121 9121 9121 9121 24814 I
                    > to 195.69.145.241 via ge-0/3/0.0
178.253.99.0/24    *[BGP/170] 01:02:36, MED 21551, localpref 100
                      AS path: 3356 9121 9121 24814 I
                    > to 212.72.47.61 via xe-1/1/0.0
                    [BGP/170] 01:02:59, MED 1, localpref 100
                      AS path: 2914 1299 9121 24814 I
                    > to 81.20.64.81 via xe-1/0/0.0
                    [BGP/170] 00:06:43, MED 15, localpref 100
                      AS path: 3257 1299 9121 24814 I
                    > to 77.67.66.69 via ge-0/2/0.309
                    [BGP/170] 01:02:59, localpref 100
                      AS path: 9121 9121 9121 9121 24814 I
                    > to 195.69.145.241 via ge-0/3/0.0
178.253.127.0/24   *[BGP/170] 01:02:36, MED 21551, localpref 100
                      AS path: 3356 9121 9121 24814 I
                    > to 212.72.47.61 via xe-1/1/0.0
                    [BGP/170] 01:02:59, MED 1, localpref 100
                      AS path: 2914 1299 9121 24814 I
                    > to 81.20.64.81 via xe-1/0/0.0
                    [BGP/170] 00:06:43, MED 15, localpref 100
                      AS path: 3257 1299 9121 24814 I
                    > to 77.67.66.69 via ge-0/2/0.309
                    [BGP/170] 01:02:59, localpref 100
                      AS path: 9121 9121 9121 9121 24814 I
                    > to 195.69.145.241 via ge-0/3/0.0

This network gets its connectivity via AS9121 which is owned and operated by Türk Telekomünikasyon A.S. which is still operational.

as9121-ipv4

AS29386 gets its connectivity via these 3 AS’s:

When compared to February 19-20, we can see what the expected DNS query pattern should be:

dns_compare

Unfortunately at this point, we can only speculate as to the reason for the outage. It’s fair to assume, however, that STE and 24814 are separate networks since they rarely have outages at the same time. As to why STE is down, this could be due to government ordered shutdown, or perhaps damage to the infrastructure, either cabling or power in a datacenter. Should we find out more information we’ll post a follow up to this blog entry.

References:

 

This post is categorized in: