How the Internet went out in Egypt

We think of the Internet as universal. We think of it in terms of a utility like electricity or water. It's none of those things. In some countries, like the U.S., it would be very hard to 'turn off' the Internet. In places like Egypt, though, with a limited number of Internet backbones and a handful of Domain Name Service (DNS) servers, it's easy. Here's how it appears the Egyptian government turned their country's Internet off.

First, here are some bare basics on how the Internet works. Every time you go to a Web site, you use its domain name such as Yahoo, ZDNet, etc. to find it.  That's not what the Internet's software uses though to hook you up to a Web site. Instead, your network connection uses address resolver software to look up the site's IP (Internet Protocol) address at a DNS server from the natural language address you've given it work work with. DNS is the Internet master address list. With it, instead of writing out an Internet IPv4 address like "http://209.85.135.99/," one of Google's many addresses, you can simply type in "http://www.google.com" and you'll be you on your way. But, DNS can only work if it has the right address information in it.

One of the things that Egypt has done to block out the Internet is remove access to its DNS servers. As Mark Hoffman of the Internet Storm Center, which monitors malicious activity on the Internet, explained, "From an IT security perspective how do you shut down a country? From what I can see for us external to the country access to the DNS servers is removed."

Hoffman used the Unix/Linux dnstracer command, which determines where a given DNS server gets its information from, and then follows the chain of DNS servers back to where they got their address information from. He found, as I did too when I tried, that you can only follow the Egyptian sites addresses so far and then the full address resolution process breaks down.

You can see this in Hoffman's attempt to get the address for the Egyptian government site: www.eeaa.gov.eg

|___ FRCU.EUN.eg [gov.eg] (193.227.1.1) * * * |___ RIP.PSG.COM [gov.eg] (147.28.0.39) | |___ NS2.TEDATA.NET [eeaa.gov.eg] (No IP address) | ___ NS1.TEDATA.NET [eeaa.gov.eg] (No IP address)

I used another tool for the www.idsc.gov.eg and found that its name servers:

frcu.eun.eg returned (SERVFAIL) ns.idsc.gov.eg returned (SERVFAIL)

were also failing,

In short, you can't currently get the Internet IP addresses for most Egyptian Web sites. In Egypt, the reverse is true. They can't get to the right Internet addresses of the world's Web sites.

There are ways to get around that kind of DNS trouble though. For example, all the Egyptian government's Web sites are under the Internet's IPv4 address range: 81.21.104.0/24. So, you might think you could get to an Egyptian government Web site using an address such as 81.21.104.1. No, that won't work either. Here's why.

Page 2: [Breaking the Internet Connection] »

Breaking the Internet Connection

Egypt didn't stop with just locking down its DNS servers. The Egyptian government has also, according to BGPmon.net, a Border Gateway Protocol (BGP) [the Internet's routing protocol] monitoring and analyzer software company, appears to have ordered "ISPs' to stop routing all networks."

Specifically, before the shutdown "There were 2903 Egyptian networks, originated from 52 ISPs. Transit was provided via 45 unique ISPs. Today at 2am UTC, the numbers look quite different, there were only 327 Egyptian networks left on the Internet. These were originated by 26 ISPs. So 88% of the Egyptian networks is unreachable!"

How was Egypt able to do this? It didn't take much. Egypt has only a handful of high-bandwidth Internet backbones entering the country. You may recall that in 2008 Egypt briefly lost 70% of its Internet connectivity when a mere two submarine fibre-optic cables in the Mediterranean Sea were cut by accident.

As Craig Labovitz, chief scientist for Arbor Networks, a network security company, explained in an AP interview that since Egypt only had a few major Internet pipelines, "It's probably a phone call that goes out to half a dozen folks who enter a line on a router configuration file and hit return. It's like programming your TiVo--you have things that are set up and you delete one. It's not high-level programming."

You don't have to worry about that happening here, well, not yet anyway. As Jim Cowie, the CTO of Renesys, a network security firm said in the same AP story: "How many people would you have to call to shut down the U.S. Internet? Hundreds, thousands maybe? We have enough Internet here that we can have our own Internet."

With the erosion of net neutrality and certain mis-guided efforts to try to give the Federal Government to create some kind of Internet kill switch, it may be a different story tomorrow.

People who think that giving our government might want to consider how well it's worked out for Egypt. Yes, Egypt has prevented protesters from organizing over the Internet, but how would you feel if you could no longer talk to your friends or get news over the Internet? Even if you were politically indifferent wouldn't you be more worried, upset and angry than ever?

I believe that in disconnecting their people from each other and the world, the Egyptian government instead of smothering the fires of discontent has poured gasoline on the flames instead. Indeed, as I write this, the ruling party headquarters in Cairo has gone up in flames.