Speculation about Russia disconnecting or being disconnected from the wider Internet abounds. In this article, we look at the connectivity of the Russian Internet to the wider Internet and how this evolved around the Russian invasion of Ukraine and the related sanctions. At the network level, the Russian Internet is very interconnected and resilient, and we don’t see sanctions having much of an effect at that level. In this article, we take a closer look at what the Russian Internet looks like, what’s changed in recent weeks, and some of the possible effects for the Internet beyond Russia.
Co-authored by Emile Aben, Senior Research Engineer at RIPE NCC, Romain Fontugne, Researcher at IIJ Research Lab and René Wilhelm, System Architect at RIPE NCC.
At the network level, the Russian Internet is very interconnected and resilient, and we don’t see sanctions having much of an effect at that level. In this article, we take a closer look at what the Russian Internet looks like, what’s changed in recent weeks, and some of the possible effects for the Internet beyond Russia.
Note that we will not be looking into issues of censorship here, but we strongly recommend the excellent tools and reporting on this available from OONI.
Who connects Russian Internet users?
The Internet consists of over 70,000 networks. Each of these connects to the rest of the Internet via one or more connections to other networks. A very rough way of categorizing these networks would be: networks with users (“eyeball networks”); networks with servers (“content networks”); and networks that provide connectivity between networks (“transit networks”). In figure 1, we visualize the interconnectivity of Russian eyeball networks specifically and how they connect to other networks both inside and outside of Russia (note: when we refer to ‘Russian networks,’ we mean networks that have the country code RU in the delegated files of the RIRs):
This is the current routing insofar as we can measure it.
Figure 1 shows the interconnection between networks in Russia (red nodes) and other networks either inside or outside Russia (with the latter represented as blue nodes). Tier1 networks (see below) are added to the graph as green nodes. The size of a node is determined by its ‘importance’ for Internet routing for end-users—where importance is here measured in terms of the extent to which end-users in Russia depend on this node for reaching the rest of the Internet (i.e. in terms of betweenness centrality as estimated by AS Hegemony). As for the smallest sized nodes, while we do not see these as important for traffic to and from Russian end-users, our data collection platform RISs’ data indicates these links do exist.
What the visualization does and doesn’t show
It is important to be clear that the main focus of this visualization is to show the interconnections that exist between the networks shown. As for traffic volume flowing over these interconnections, the only indication of this in the visualization is the size of the nodes, as nodes with a higher estimated betweenness centrality will likely have a higher traffic volume. We don’t have data about the capacity of these links or the business (i.e., transit/peering) relationships between networks.
So, for instance, the fact that Rascom (AS20764) connects to many foreign networks doesn’t mean it’s fundamentally dependent on these networks; it just shows the interconnections exist. Many of the networks we see around Rascom are registered in Europe, probably because Rascom peers in many IXPs in Europe, and we see these peering relationships here. Also, the fact that Rascom appears to be connected to more non-Russian networks than other networks in this picture could be due to us having better visibility into Rascom than into other networks.
Some other points are worth noting about figure 1. First, single links between networks represent links in network topology and might, on the physical layer, consist of multiple physical connections between these networks, potentially all across the globe. Second, note that we can’t see alternative routes that might exist. In that sense, BGP is an information hiding protocol, and only if the currently used routes are not used anymore, we can see what the first alternative is. Note that for some networks we have better visibility than others.
The so-called “tier1” networks are a fundamental part of how the Internet is interconnected. With the flattening of the Internet, their role is somewhat in decline (because there is more and more interconnection bypassing them), but if the Internet has anything that looks like the core of it, the tier1 networks would be that.
As we can see in figure 1, a few of these networks that are currently very influential for Internet connectivity for Russian end-users, notably AS1299 (Arelion, aka Telia) and AS3356 (Lumen, aka Level3). In terms of sanctions, both Lumen and Cogent (AS174) made public statements about limiting services to Russia, as documented in this blog entry by Kentik.
If we look at the changes in network adjacencies between these three tier1s between 1 Feb and 19 March we see this:
As we understand transit contracts, these are typically on a yearly basis, so it might very well be that existing contracts won’t be renewed, and the effects of service disconnects will be visible over the longer term.
Out of the networks above, Cogent is the only one that did not add any Russian networks, according to the routing data we collected. It stopped being connected to eight networks registered in Russia, most notably Transtelecom (TTK, AS20485) and MTT (Multiregional Transittelecom, AS49476).
We tried to use RIPE Atlas to see if the interconnection points between Cogent and Rostelecom changed, by following the ASN Tryst idea that was explored at a RIPE NCC Hackathon at RIPE 71. In our exploration of this, while we see several cities where these networks interconnect, we did not find evidence of any of these major interconnect points disappearing between 1 February and 17 March.
The Internet Health Report has latency graphs based on RIPE Atlas traceroutes. If we compare pre- and post- invasion latency for a number of Russian networks, we do see some changes. Where before the invasion (left side of Fig 2), this signal was pretty flat, after the invasion, we see diurnal pattern appearing. We don’t exactly know what this means, but this kind of pattern typically starts to appear as a network begins to become more congested (as we saw at the beginning of the COVID pandemic).
Out of the major Russian networks Rostelecom (AS12389) and Transtelecom (AS20485) show this pattern as can be seen in figure 2:
One of the most visible actions was the London Internet Exchange, LINX.