Speculation about Russia disconnecting or being disconnected from the wider Internet abounds. In this article, we look at the connectivity of the Russian Internet to the wider Internet and how this evolved around the Russian invasion of Ukraine and the related sanctions. At the network level, the Russian Internet is very interconnected and resilient, and we don’t see sanctions having much of an effect at that level. In this article, we take a closer look at what the Russian Internet looks like, what’s changed in recent weeks, and some of the possible effects for the Internet beyond Russia.

Co-authored by Emile Aben, Senior Research Engineer at RIPE NCC, Romain Fontugne, Researcher at IIJ Research Lab and René Wilhelm, System Architect at RIPE NCC.

At the network level, the Russian Internet is very interconnected and resilient, and we don’t see sanctions having much of an effect at that level. In this article, we take a closer look at what the Russian Internet looks like, what’s changed in recent weeks, and some of the possible effects for the Internet beyond Russia.

Note that we will not be looking into issues of censorship here, but we strongly recommend the excellent tools and reporting on this available from OONI.

Who connects Russian Internet users?

The Internet consists of over 70,000 networks. Each of these connects to the rest of the Internet via one or more connections to other networks. A very rough way of categorizing these networks would be: networks with users (“eyeball networks”); networks with servers (“content networks”); and networks that provide connectivity between networks (“transit networks”). In figure 1, we visualize the interconnectivity of Russian eyeball networks specifically and how they connect to other networks both inside and outside of Russia (note: when we refer to ‘Russian networks,’ we mean networks that have the country code RU in the delegated files of the RIRs):

This is the current routing insofar as we can measure it.

Figure 1 shows the interconnection between networks in Russia (red nodes) and other networks either inside or outside Russia (with the latter represented as blue nodes). Tier1 networks (see below) are added to the graph as green nodes. The size of a node is determined by its ‘importance’ for Internet routing for end-users—where importance is here measured in terms of the extent to which end-users in Russia depend on this node for reaching the rest of the Internet (i.e. in terms of betweenness centrality as estimated by AS Hegemony). As for the smallest sized nodes, while we do not see these as important for traffic to and from Russian end-users, our data collection platform RISs’ data indicates these links do exist.

What the visualization does and doesn’t show

It is important to be clear that the main focus of this visualization is to show the interconnections that exist between the networks shown. As for traffic volume flowing over these interconnections, the only indication of this in the visualization is the size of the nodes, as nodes with a higher estimated betweenness centrality will likely have a higher traffic volume. We don’t have data about the capacity of these links or the business (i.e., transit/peering) relationships between networks.

So, for instance, the fact that Rascom (AS20764) connects to many foreign networks doesn’t mean it’s fundamentally dependent on these networks; it just shows the interconnections exist. Many of the networks we see around Rascom are registered in Europe, probably because Rascom peers in many IXPs in Europe, and we see these peering relationships here. Also, the fact that Rascom appears to be connected to more non-Russian networks than other networks in this picture could be due to us having better visibility into Rascom than into other networks.

Some other points are worth noting about figure 1. First, single links between networks represent links in network topology and might, on the physical layer, consist of multiple physical connections between these networks, potentially all across the globe. Second, note that we can’t see alternative routes that might exist. In that sense, BGP is an information hiding protocol, and only if the currently used routes are not used anymore, we can see what the first alternative is. Note that for some networks we have better visibility than others.

Tier1s

The so-called “tier1” networks are a fundamental part of how the Internet is interconnected. With the flattening of the Internet, their role is somewhat in decline (because there is more and more interconnection bypassing them), but if the Internet has anything that looks like the core of it, the tier1 networks would be that.

As we can see in figure 1, a few of these networks that are currently very influential for Internet connectivity for Russian end-users, notably AS1299 (Arelion, aka Telia) and AS3356 (Lumen, aka Level3). In terms of sanctions, both Lumen and Cogent (AS174) made public statements about limiting services to Russia, as documented in this blog entry by Kentik.

If we look at the changes in network adjacencies between these three tier1s between 1 Feb and 19 March we see this:

As we understand transit contracts, these are typically on a yearly basis, so it might very well be that existing contracts won’t be renewed, and the effects of service disconnects will be visible over the longer term.

Cogent (AS174)

Out of the networks above, Cogent is the only one that did not add any Russian networks, according to the routing data we collected. It stopped being connected to eight networks registered in Russia, most notably Transtelecom (TTK, AS20485) and MTT (Multiregional Transittelecom, AS49476).

We tried to use RIPE Atlas to see if the interconnection points between Cogent and Rostelecom changed, by following the ASN Tryst idea that was explored at a RIPE NCC Hackathon at RIPE 71. In our exploration of this, while we see several cities where these networks interconnect, we did not find evidence of any of these major interconnect points disappearing between 1 February and 17 March.

Latency

The Internet Health Report has latency graphs based on RIPE Atlas traceroutes. If we compare pre- and post- invasion latency for a number of Russian networks, we do see some changes. Where before the invasion (left side of Fig 2), this signal was pretty flat, after the invasion, we see diurnal pattern appearing. We don’t exactly know what this means, but this kind of pattern typically starts to appear as a network begins to become more congested (as we saw at the beginning of the COVID pandemic).

Out of the major Russian networks Rostelecom (AS12389) and Transtelecom (AS20485) show this pattern as can be seen in figure 2:

IXPs (LINX)

One of the most visible actions was the London Internet Exchange, LINX.

Looks like @LINX_Network has just decided what they're doing about sanctions: pic.twitter.com/Wytcj098LJ
Bill Woodcock (@woodyatpch) March 11, 2022

We zoom in to the case of MegaFon, a major Russian network, as we have the most clear indication of what changed there. Figures 3 and 4 show what we see changing on 11 March during the day. The analysis backing this is the same as we used for analysis of outages at IXPs in the last few years (see our previous analyses for AMS-IX, DE-CIX, and LINX).

In short, in order to see what was going on on 11 March, we look at periodic traceroutes in RIPE Atlas from the day before (10 March) that have the following two properties:

• They always reach a responding target (so we can see if reachability between src/dst got affected) and;
• They always “pass through” the infrastructure element we want to study (e.g. the specific MegaFon port at LINX)

Note that due to the nature of traceroute, this type of analysis only shows inbound paths to MegaFon (AS31133).

In figure 3, we see how connectivity changes in terms of IXPs visible on paths that previously went exclusively through the MegaFon LINX IXP port. The blue line (labeled linx-lon1-port-mf) shows the count of paths that include the MegaFon IXP port at LINX. As can be seen in this figure, at around 16:00 UTC on 11 March, we see a significant decrease in paths through this port. It is unclear why this doesn’t drop to zero.

The orange line (labeled linx-lon1-other) represents paths that go through other ports at LINX. These start to be visible around the same time the paths via the MegaFon port decrease. This indicates a shift of the paths to other networks also at LINX. Around the same time, we also see two other IXPs in these paths: AMS-IX (Amsterdam) and DE-CIX (Frankfurt). As many networks have redundant peerings at LINX, AMS-IX and DE-CIX, this type of shifting is to be expected.

In figure 4, we see how connectivity changes with regards to the networks in the paths that we monitor. The destinations of these paths are in the customer cone of MegaFon, so they are very likely Russian networks. The plot only shows the networks with the most dramatic shifts. For this set, we see a shift at around 16:00 UTC. Before 16:00, only AS31133 (MegaFon) was visible—this is because of the specific set of traceroutes that we calibrated this analysis on. After this time, we see roughly 25% of the paths remain with MegaFon, while in the rest of the paths, we start seeing other networks that provide transit in Russia: AS3216 (Vimpelcom), AS12389 (Rostelecom), AS20485 (Transtelecom) and AS9002 (RETN). What this shows is redundancy in interconnectivity: as long as there are alternative paths on the Internet, taking out, a single transit network will cause rerouting.

When we look at the reachability of the destinations in the set of traceroutes that we did this analysis on, we don’t see any significant changes, which indicates reachability of the destinations was not affected, at least not for the set of destinations that this analysis looks at.

Effects beyond Russia

While we don’t see massive changes in network connectivity, the latency effects we see could be indicative of an increase of traffic and/or a decrease in available capacity between Russia and the rest of the world. This made us wonder: what effects would decreased bandwidth for Russian (transit) networks have for other countries?

We looked at which countries have dependencies on Russian transit networks. These networks, if they have redundancy in their network, will be able to shift routes. But removing the Russian transit networks can have an effect on the available bandwidth in and out of these countries if the Internet traffic can’t be routed via the major Russian networks anymore. The other effect might be financial. For usage-based Internet capacity moving away from Russian networks would be less income for them and more income for the other networks.

Although we haven’t carried out a full analysis of this, a preliminary look into these effects shows a major dependency of users in Kazakhstan on the Russian networks Vimpelcom (AS3216) and MegaFon (AS31133) as shown in figure 5 (from the Internet Health Report):

This dependence might explain why the major Kazakh eyeball network (AS9198, Kazakh Telecom) started showing similar diurnal patterns as Russian networks:

Conclusion

In this post, we show the high-level structure of interconnection of Russian networks as well as how it is connected to the wider Internet. We show examples of things that changed, but the larger picture is that not much has changed since the start of the Russian invasion of Ukraine.

We intend to monitor this and keep an eye out on the big picture here, and as our current analysis still leaves open a number of further questions, we encourage the use of our open tooling and those of others we have pointed to here as a basis for further research. We plan to make some of the toolings we used for the analyses above available as open-source prototypes.

NORDVPN DISCOUNT - CircleID x NordVPN
Get NordVPN  [74% +3 extra months, from $2.99/month]