Behind the Firewall — A Look at Six Iranian ISPs Forty Days Later

In this post (likely our last on the topic), we look behind the great Iranian firewall.

Specifically, we explore forty days of post election traffic to six of the major in-country Iranian Internet providers (based on ASPath traffic data from the Internet Observatory). The traffic fluctuations of these six Iranian providers provides additional insight into Iranian traffic engineering and possible motives behind Iran’s Internet filtering.

The first graph shows Internet traffic originating or terminating in DCI (the state owned telecommunication company) between June 7 and July 23. As mentioned earlier, the graph shows expected peaks and valleys corresponding to weekly traffic patterns (i.e. Internet usage declines at night and over the Iranian weekend). You can see the dramatic drop off in traffic following the June 12 election followed by a return to near normal traffic levels by the week of June 27.


In contrast, the ISPs behind DCI in the graph below show very different traffic patterns.

The below graphs shows the six largest Iranian ISPs (by traffic volume): ShaTel, Saba, Pars Online, Datak Telecom, AFRNet and Soroush Rasaneh. In all, roughly 90 smaller ISPs, research networks and enterprises manage their own ASNs within Iran (and most exhibit similar traffic patterns).


All of the six above ISPs offer consumer / enterprise DSL and dial-up connectivity. A few like ShaTel and Pars Online also provide cell and fixed-line telephony. Several also maintain their own satellite Internet infrastructure (e.g. Pars Online), but we also note that Iranian ISPs (and all satellite communication) are licensed by the state.

For background on Iranian providers, I found this (somewhat dated) overview of Iranian Internet and blog on Iran ISP web filtering helpful. Also see this Wikipedia article.

Looking at the graphs, ShaTel and Saba Networks show similar traffic patterns:

  1. an abrupt drop off after the June 12 election
  2. followed by a return to near normal levels around June 16
  3. and then a significant June 27 to June 19 80% drop in traffic
  4. a rise in traffic on June 19
  5. and then a drop in traffic again on July 21

Interestingly, Pars Online was one of the few providers to gain traffic immediately following the June 12 election (suggesting diversion of traffic from other ISPs through Pars Online filtering infrastructure).

Other differences in Internet traffic patterns amongst the above six providers may be explained by customer base and relationship with the ruling party. For example, the AFR@Net web site explains “our client base includes many government ministries and organizations”.

6 Responses to “Behind the Firewall — A Look at Six Iranian ISPs Forty Days Later”

August 05, 2009 at 12:15 am, Random bits « Equilibrium Networks said:

[…] Random bits More from Arbor on the Iranian firewall […]

August 08, 2009 at 11:25 am, Iran gets better at Internet filtering said:

[…] appears that they are getting very good at filtering at the ISP level.  Arbor Networks looked at recent data and found some interesting results. Looking at the graphs, ShaTel and Saba Networks show similar […]

January 11, 2010 at 10:46 pm, Technology, Thoughts, and Trinkets» Dispelling FUD: Iran and ISP Surveillance said:

[…] quickly data could be transmitted to, and received from, the ‘net as a whole. This claim is substantiated by Arbor Networks’ (Internet) border reports, which demonstrate how, immediately after the presidential election, there was a plummet in the […]

January 12, 2010 at 2:08 am, Iran & Social Media: Dispelling Fear, Uncertainty, and Doubt (Parsons) | Enduring America said:

[…] how quickly data could be transmitted to, and received from, the ‘net as a whole. This claim is substantiated by Arbor Networks’ (Internet) border reports, which demonstrate how, immediately after the presidential election, there was a plummet in the […]

January 24, 2011 at 2:21 pm, Is Iran Now Actually Using Deep Packet Inspection? | Technology, Thoughts, and Trinkets said:

[…] August 3, 2009, Arbor Networks released data suggesting that slow Internet speeds experienced during the attempted Green Revolution was likely […]

February 02, 2011 at 5:30 pm, GiulianovaNews » Blog Archive » Egitto. segnalo un grafico realizzato da Arbor Networks, leader nelle soluzioni per il controllo della sicurezza delle reti mondiali, che mostra come alle h 17.20 del 27 Gennaio il traffico Internet da e verso l said:

[…] analoghe interruzioni del traffico Internet, come per esempio quelle che erano avvenute in Iran (/blog/asert/2009/08/1132/ )o in Birmana (/blog/asert/2010/11/attac-severs-myanmar-internet/), la invitiamo […]

Comments are closed.