Home / Blogs

Amount of Unsolicited Internet Traffic Reflecting Situation in Libya

Daniel Karrenberg

During the recent political unrest in the Middle East, researchers have observed significant changes in Internet traffic and connectivity. Typically people look at routing data, latencies when connecting to sites and search and query statistics. Here we show results from a previously unused source of data: unsolicited Internet traffic arriving from Libya. The traffic data we captured shows distinct changes in unsolicited traffic patterns since 17 February 2011.

Figure 1 above shows unsolicited one-way traffic for five weeks, including some "silent" gaps with absolutely no traffic, and other intervals with larger and more typical levels. During these five weeks there was an interval of about one-and-a-half days where the data collection server didn't collect data, indicated in red and with labeled 'no data'. For another period of about one day, traffic levels were almost always higher then 8 packets per second (pps), indicated in blue and labeled 'denial-of-service' (in the RIPE Labs article referenced at the bottom, you can find more details about this particular incident).

The Figure also shows a number of intervals with next to no traffic, notably overnight on 19 and 20 February. This is consistent with observations made by others. We also saw an outage between 3 March and 7 March. After 7 March the amount of unsolicited traffic is slowly picking up again, but not to the level from before 3 March.

Figure 2 shows the period between 1 – 8 March in more detail. The longer outage from approximately 3 March 18:00 UTC to 7 March 11:00 UTC is clearly visible. You can also see that the traffic levels after the outage were significantly lower then before. We observed a slow subsequent increase after this outage to roughly 20% of pre-outage traffic levels. This is something that we have not seen reported elsewhere.

For more information, please refer to the background article on RIPE Labs: Unsolicited Internet Traffic from Libya.

Please note that this research is based on collaboration between the RIPE NCC and CAIDA.

By Daniel Karrenberg, Chief Scientist at the RIPE NCC

Related topics: Access Providers

WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

To post comments, please login or create an account.

Related Blogs

Related News

Topics

Industry Updates – Sponsored Posts

DotConnectAfrica Attends Transform Africa 2013 Summit in Rwanda

Dyn Research: CDN Adoption Across Our Customer Base

Neustar Expands Professional Services Offerings for Communications Service Providers

Reducing the Risks of BYOD with Nominum's Security Solution

Nominum and IBM Partner Around Big Data

Virgin Media Selects Nominum to Support London Underground WiFi Roll-out

How Secure is Your Mobile Network? And Does It Even Matter? (Webinar)

Nominum Survey of World's Leading ISPs Shows Nearly 60% of ISPs Plan to Roll-Out IPv6 by End of 2012

Nominum Launches Comprehensive Suite of DNS-Based Security Solutions for Russian Service Providers

Nominum Sets New Record for Network Speed and Efficiency

Implementing a Cyber-Security Code of Conduct: Real-Life Lessons From Australia (Webinar)

Australian ISP iiNet selects ARI Registry Services to Help It Apply for and Operate .iinet TLD

Nominum Launches World's First Purpose-Built Suite of DNSā€Based Solutions for Mobile Operators

Verisign to Award New Infrastructure Research Grants

Breaking the DNS: Another Look at How SOPA Could Be Destructive

eComm 2009: Discussions on Restructuring Global Telecoms

Nominum CEO: Commercial vs. Open Source - Let Customers Choose

Ben Scott and Free Press in the Network Age

Supernova Interview: David Isenberg

Wendy Seltzer Interview: How Law Impacts the Network Age

Sponsored Topics

Minds + Machines

Top-Level Domains

Sponsored by
Minds + Machines
Afilias

DNSSEC

Sponsored by
Afilias
dotMobi

Mobile

Sponsored by
dotMobi
Verisign

Security

Sponsored by
Verisign