During the recent political unrest in the Middle East, researchers have observed significant changes in Internet traffic and connectivity. Typically people look at routing data, latencies when connecting to sites and search and query statistics. Here we show results from a previously unused source of data: unsolicited Internet traffic arriving from Libya. The traffic data we captured shows distinct changes in unsolicited traffic patterns since 17 February 2011.

Figure 1 above shows unsolicited one-way traffic for five weeks, including some “silent” gaps with absolutely no traffic, and other intervals with larger and more typical levels. During these five weeks there was an interval of about one-and-a-half days where the data collection server didn’t collect data, indicated in red and with labeled ‘no data’. For another period of about one day, traffic levels were almost always higher then 8 packets per second (pps), indicated in blue and labeled ‘denial-of-service’ (in the RIPE Labs article referenced at the bottom, you can find more details about this particular incident).

The Figure also shows a number of intervals with next to no traffic, notably overnight on 19 and 20 February. This is consistent with observations made by others. We also saw an outage between 3 March and 7 March. After 7 March the amount of unsolicited traffic is slowly picking up again, but not to the level from before 3 March.

Figure 2 shows the period between 1 – 8 March in more detail. The longer outage from approximately 3 March 18:00 UTC to 7 March 11:00 UTC is clearly visible. You can also see that the traffic levels after the outage were significantly lower then before. We observed a slow subsequent increase after this outage to roughly 20% of pre-outage traffic levels. This is something that we have not seen reported elsewhere.

For more information, please refer to the background article on RIPE Labs: Unsolicited Internet Traffic from Libya.

Please note that this research is based on collaboration between the RIPE NCC and CAIDA.