In this post (likely our last on the topic), we look behind the great Iranian firewall.
Specifically, we explore forty days of post election traffic to six of the major in-country Iranian Internet providers (based on ASPath traffic data from the Internet Observatory). The traffic fluctuations of these six Iranian providers provides additional insight into Iranian traffic engineering and possible motives behind Iran’s Internet filtering.
The first graph shows Internet traffic originating or terminating in DCI (the state owned telecommunication company) between June 7 and July 23. As mentioned earlier, the graph shows expected peaks and valleys corresponding to weekly traffic patterns (i.e. Internet usage declines at night and over the Iranian weekend). You can see the dramatic drop off in traffic following the June 12 election followed by a return to near normal traffic levels by the week of June 27.
The below graphs shows the six largest Iranian ISPs (by traffic volume): ShaTel, Saba, Pars Online, Datak Telecom, AFRNet and Soroush Rasaneh. In all, roughly 90 smaller ISPs, research networks and enterprises manage their own ASNs within Iran (and most exhibit similar traffic patterns).
Looking at the graphs, ShaTel and Saba Networks show similar traffic patterns:
- an abrupt drop off after the June 12 election
- followed by a return to near normal levels around June 16
- and then a significant June 27 to June 19 80% drop in traffic
- a rise in traffic on June 19
- and then a drop in traffic again on July 21
Interestingly, Pars Online was one of the few providers to gain traffic immediately following the June 12 election (suggesting diversion of traffic from other ISPs through Pars Online filtering infrastructure).
Other differences in Internet traffic patterns amongst the above six providers may be explained by customer base and relationship with the ruling party. For example, the AFR@Net web site explains “our client base includes many government ministries and organizations”.