Behind the Firewall — A Look at Six Iranian ISPs Forty Days Later

By: Craig Labovitz -

In this post (likely our last on the topic), we look behind the great Iranian firewall.

Specifically, we explore forty days of post election traffic to six of the major in-country Iranian Internet providers (based on ASPath traffic data from the Internet Observatory). The traffic fluctuations of these six Iranian providers provides additional insight into Iranian traffic engineering and possible motives behind Iran’s Internet filtering.

The first graph shows Internet traffic originating or terminating in DCI (the state owned telecommunication company) between June 7 and July 23. As mentioned earlier, the graph shows expected peaks and valleys corresponding to weekly traffic patterns (i.e. Internet usage declines at night and over the Iranian weekend). You can see the dramatic drop off in traffic following the June 12 election followed by a return to near normal traffic levels by the week of June 27.

In contrast, the ISPs behind DCI in the graph below show very different traffic patterns.

The below graphs shows the six largest Iranian ISPs (by traffic volume): ShaTel, Saba, Pars Online, Datak Telecom, AFRNet and Soroush Rasaneh. In all, roughly 90 smaller ISPs, research networks and enterprises manage their own ASNs within Iran (and most exhibit similar traffic patterns).

All of the six above ISPs offer consumer / enterprise DSL and dial-up connectivity. A few like ShaTel and Pars Online also provide cell and fixed-line telephony. Several also maintain their own satellite Internet infrastructure (e.g. Pars Online), but we also note that Iranian ISPs (and all satellite communication) are licensed by the state.

For background on Iranian providers, I found this (somewhat dated) overview of Iranian Internet and blog on Iran ISP web filtering helpful. Also see this Wikipedia article.

Looking at the graphs, ShaTel and Saba Networks show similar traffic patterns:

  1. an abrupt drop off after the June 12 election
  2. followed by a return to near normal levels around June 16
  3. and then a significant June 27 to June 19 80% drop in traffic
  4. a rise in traffic on June 19
  5. and then a drop in traffic again on July 21

Interestingly, Pars Online was one of the few providers to gain traffic immediately following the June 12 election (suggesting diversion of traffic from other ISPs through Pars Online filtering infrastructure).

Other differences in Internet traffic patterns amongst the above six providers may be explained by customer base and relationship with the ruling party. For example, the AFR@Net web site explains “our client base includes many government ministries and organizations”.