Rumors of downgrading Russian internet services have been greatly exaggerated, despite unprecedented announcements recently from two of the world’s largest backbone providers that they would be leaving the country after the invasion of Ukraine.
Just as ISPs provide links that connect individuals or organizations to the Internet, backbone services are the service providers that connect ISPs in one part of the world to those elsewhere. These so-called transit providers route huge amounts of traffic from one ISP or backbone to another. Earlier this week, Russian ISPs saw the departure of two of their largest providers. One of these was Lumen, the top provider of internet transit to Russia. The other was Cogent, one of the largest Internet backbone carriers in the world.
Still kicking
A transit provider disconnecting its customers in a country the size of Russia has never happened before, Doug Madori, director of internet analytics at network analytics firm Kentik, said earlier this week. He and others said the move would limit the total amount of bandwidth going in and out of Russia.
“This reduction in bandwidth could lead to congestion as the remaining international carriers try to catch up,” he added. Some people predicted that Russia would even be effectively separated from the global internet.
But so far, that hasn’t happened, researchers at network intelligence firm ThousandEyes said Friday. Network stats show that connectivity continues as it was in the past.
There are several reasons for this. One is that the departure of a single transit provider from a country the size of Russia — or two in this case — won’t have enough impact to degrade overall service. Another reason is that both Lumen and Cogent will continue to provide transit services to the outposts of major Russian ISPs, as long as those outposts are not located in Russia.
“Despite the idea that some US-based transit providers would ‘disconnect’ Russia from the Internet, no transit provider severing ties with Russian ISPs would achieve such a goal,” wrote members of the ThousandEyes Internet research team. That said, many transit providers, both US and non-US based, continue to connect their global customers – which may include offering transit to and from Russian users through major Russian ISPs located at exchange points not on Russian soil. are located.”
The post contained images showing that Cogent continues to provide a major pipeline to and from Russia through its relationship with Russian backbone providers JSC Rostelecom (AS 12389) and CJSC Rascom (AS 20764).
ThousandEyes
ThousandEyes
ThousandEyes
The researchers also showed how both Cogent and Lumen (formerly named Level 3 by ThousandEyes) continue to deliver bandwidth thanks to an announcement of a border gateway protocol by JSC Rostelecom that publishes advertising routes from one of its Russian ISP clients, RSNET (AS 8291). , to Cogent, Lumen, and TeliaNet.
ThousandEyes
“There has been much speculation lately about their possible role in decoupling Russia from the rest of the global internet,” the researchers added, citing Cogent and Lumen. “However, Russia’s connection to the rest of the world through these vital networks remains intact, with major Russian ISPs, such as JSC Rostelecom, continuing to partner with global transit providers outside of Russia, just as they did long before the recent events. As a result, the Russian people will continue to have access to the global internet – at least at the infrastructure level.”
Preventing Russian Cyber Attacks
Both Lumen and Cogent told CNN on Friday that they were trying to strike a balance between the need to prevent their networks from carrying out cyber-attacks supported by Russia, and their belief in a free and open internet. Cogent’s CEO told the news network that his company had limited its action to about 25 customers based in Russia and directly on Russian networks. Russian companies that rely on Cogent’s network outside the country through non-Russian state providers will remain unaffected.
“We felt that the downside of the possibility that these connections could be used offensively outweighed the downside of terminating some services,” said Dave Schaeffer, CEO of Cogent.
Lumen cited a similar reason for his limited movement.
“We have decided to disconnect the network due to an increased security risk in Russia,” Mark Molzen, the company’s director of global issues, told CNN. “We have not yet experienced any network outages, but given the increasingly uncertain environment and increased risk from government action, we have taken this step to ensure the security of our and our customers’ networks, as well as the continued integrity of the global internet. †
The ThousandEyes post was published before the London Internet Exchange – one of the largest internet exchanges for networks around the world to exchange or ‘peer’ traffic with each other – would stop routing for Rostelecom and MegaFon, its second-largest mobile phone operator. Russia and a best internet provider. It’s not clear how that termination will affect transit service for the country.
ThousandEyes said that while wholesale traffic to and from Russia is currently normal, traffic to select Russian sites — both inside and outside the country — has been hit or miss. Much of the disruption — in the form of dropped traffic that often reached 100 percent packet loss — was the result of distributed denial-of-service attacks or attempts by Russian networks to fend off the attacks.
“Russian sites have also shown evidence of distressed network conditions indicative of DDoS attacks, as well as behavior consistent with route filtering, traffic firewalling and, in some cases, cloud-based DDoS throttling,” company researchers wrote. “The latest blocking mechanisms have mainly impacted users outside of Russia.”
