{"id":17018,"date":"2022-05-10T16:09:34","date_gmt":"2022-05-10T16:09:34","guid":{"rendered":"https:\/\/prensa.lacnic.net\/news?p=17018"},"modified":"2022-06-13T14:04:09","modified_gmt":"2022-06-13T14:04:09","slug":"how-is-russia-connected-to-the-wider-internet","status":"publish","type":"post","link":"https:\/\/blog.lacnic.net\/en\/how-is-russia-connected-to-the-wider-internet\/","title":{"rendered":"How Is Russia Connected To The Wider Internet? \u00a0"},"content":{"rendered":"\n

By Emile Aben<\/a> – Research coordinator at the RIPE NCC<\/p>\n\n\n\n

Contributors: Romain Fontugne<\/a>, Rene Wilhelm<\/a><\/p>\n\n\n\n

Speculation about Russia disconnecting or being disconnected from the wider Internet abounds. In this article, we look at the connectivity of the Russian Internet to the wider Internet and how this evolved around the Russian invasion into Ukraine and sanctions related around that.<\/p>\n\n\n\n

At the network level the Russian Internet is very interconnected and resilient, and we don’t see sanctions having much of an effect at that level. In this article we take a closer look at what the Russian Internet looks like, what’s changed in recent weeks, and some of the possible effects for the Internet beyond Russia.<\/p>\n\n\n\n

Note that we will not be looking into issues of censorship here, but we strongly recommend the excellent tools and reporting on this available from OONI.<\/a><\/p>\n\n\n\n

Who connects Russian Internet users?<\/strong><\/h2>\n\n\n\n

The Internet consists of over 70,000 networks. Each of these connects to the rest of the Internet via one or more connections to other networks. A very rough way of categorising these networks would be: networks with users (“eyeball networks”); networks with servers (“content networks”); and networks that provide connectivity between networks (“transit networks”). In figure 1, we visualise interconnectivity of Russian eyeball networks specifically and how they connect to other networks both inside and outside of Russia (note: when we refer to ‘Russian networks’, we mean networks that have the country code RU in the delegated files of the RIRs<\/a>):<\/p>\n\n\n\n

\"\"
Figure 1: Interconnections between networks in Russia (red nodes) and other networks either inside or outside Russia. Networks outside Russia are blue nodes. Tier1 networks are green nodes.<\/figcaption><\/figure>\n\n\n\n

This is the current routing insofar as we can measure it.<\/p>\n\n\n\n

Figure 1 shows the interconnection between networks in Russia (red nodes) and other networks either inside or outside Russia (with the latter represented as blue nodes). Tier1 networks (see below) are added to the graph as green nodes. The size of a node is determined by its ‘importance’ for Internet routing for end-users – where importance is here measured in terms of the extent to which end users in Russia depend on this node for reaching the rest of the Internet (i.e. in terms of betweenness centrality<\/a> as estimated by AS Hegemony<\/a>). As for the smallest sized nodes, while we do not see these as important for traffic to and from Russian end-users, our data collection platform RISs’ data indicates these links do exist.<\/p>\n\n\n\n

What the visualisation does and doesn’t show<\/strong><\/h2>\n\n\n\n

It is important to be clear that the main focus of this visualisation is to show the interconnections that exist between the networks shown. As for traffic volume flowing over these interconnections, the only indication of this in the visualisation is the size of the nodes, as nodes with a higher estimated betweenness centrality will likely have a higher traffic volume. We don’t have data about the capacity of these links or the business (i.e. transit\/peering) relationships between networks.<\/p>\n\n\n\n

So for instance, the fact that Rascom (AS20764) connects to many foreign networks doesn’t mean it’s fundamentally dependent on these networks, it just shows the interconnections exist. Many of the networks we see around Rascom are registered in Europe, probably because Rascom peers in many IXPs in Europe, and we see these peering relationships here. Also, the fact that Rascom appears to be connected to more non-Russian networks than other networks in this picture could be due to us having better visibility into Rascom than into other networks.<\/p>\n\n\n\n

Some other points are worth noting about figure 1. First, single links between networks represent links in network topology and might, on the physical layer, consist of multiple physical connections between these networks, potentially all across the globe. Second, note that we can’t see alternative routes that might exist. In that sense, BGP is an information hiding protocol, and only if the currently used routes are not used anymore, we can see what the first alternative is. Note that for some networks we have better visibility than others.<\/p>\n\n\n\n

Tier1s<\/strong><\/h2>\n\n\n\n

The so called “tier1” networks<\/a> are a fundamental part of how the Internet is interconnected. With the flattening of the Internet, their role is somewhat in decline (because there is more and more interconnection bypassing them), but if the Internet has anything that looks like the core of it, the tier1 networks would be that.<\/p>\n\n\n\n

As we can see in figure 1, a few of these networks that are currently very influential for Internet connectivity for Russian end-users; notably AS1299 (Arelion, aka Telia) and AS3356 (Lumen, aka Level3). In terms of sanctions, both Lumen and Cogent (AS174) made public statements about limiting services to Russia, as documented in this blog entry by Kentik<\/a>.<\/p>\n\n\n\n

If we look at the changes in network adjacencies between these three tier1s between 1 Feb and 19 March we see this:<\/p>\n\n\n\n

Changes in network adjacencies between selected tier1 networks from 1 Feb – 19 March<\/p>\n\n\n\n

Network<\/th>ASN<\/th>Added<\/th>Removed<\/th><\/tr><\/thead>
Arelion<\/td>AS1299<\/td>6<\/td>13<\/td><\/tr>
Lumen<\/td>AS3356<\/td>2<\/td>7<\/td><\/tr>
Cogent<\/td>AS174<\/td>0<\/td>8<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

As we understand transit contracts, these are typically on a year basis, so it might very well be that existing contracts won’t be renewed and the effects of service disconnects will be visible over the longer term.<\/p>\n\n\n\n

Cogent (AS174)<\/strong><\/h3>\n\n\n\n

Out of the networks above Cogent is the only one that did not add any Russian networks, according to the routing data we collect. It stopped being connected to eight networks registered in Russia, most notably Transtelecom (TTK, AS20485) and MTT (Multiregional Transittelecom, AS49476).<\/p>\n\n\n\n

<\/p>\n\n\n\n

We tried to use RIPE Atlas to see if the interconnection points between Cogent and Rostelecom changed, by following the ASN Tryst idea that was explored at a RIPE NCC Hackathon at RIPE 71<\/a>. In our exploration of this, while we see several cities where these networks interconnect, we did not find evidence of any of these major interconnect points disappearing between 1 February and 17 March.<\/p>\n\n\n\n

Latency<\/strong><\/h2>\n\n\n\n

The Internet Health Report<\/a> has latency graphs based on RIPE Atlas traceroutes. If we compare pre- and post- invasion latency for a number of Russian networks, we do see some changes. Where before the invasion (left side of Fig 2) this signal was pretty flat, after the invasion we see diurnal pattern appearing. We don’t exactly know what this means, but this kind of pattern typically starts to appear as a network begins to become more congested (as we saw at the beginning of the COVID pandemic<\/a>).<\/p>\n\n\n\n

Out of the major Russian networks Rostelecom (AS12389) and Transtelecom (AS20485) show this pattern as can be seen in figure 2:<\/p>\n\n\n\n

\"\"
Figure 2: Internet Health Report latency graphs for Russian networks<\/figcaption><\/figure>\n\n\n\n

IXPs (LINX)<\/strong><\/h2>\n\n\n\n

One of the most visible actions was the London Internet Exchange, LINX.<\/p>\n\n\n\n

Looks like @LINX_Network<\/a> has just decided what they’re doing about sanctions: pic.twitter.com\/Wytcj098LJ<\/a><\/p>\u2014 Bill Woodcock (@woodyatpch) March 11, 2022<\/a><\/blockquote>