Rumors about the degradation of Russian Internet services are greatly exaggerated, despite the recent unprecedented statements by two of the world’s largest backbone providers that they are leaving the country after its invasion of Ukraine.
Just as ISPs provide channels connecting people or organizations to the Internet, backbone services are service providers that connect ISPs in one part of the world to providers in other parts of the world. These so-called transit providers direct huge volumes of traffic from one ISP or backbone to another. Earlier this week, Russian Internet service providers saw the departure of their two largest providers. One of them was Lumen, the largest provider of Internet transit to Russia. The other was Cogent, one of the largest backbone ISPs in the world.
Also yesterday, the London Internet traffic exchange point LINX (London Internet Exchange Network), which unites networks of more than 950 different operators, although it is not a commercial company, nevertheless, according to foreign sources, was also forced to apply sanctions — the board of directors of LINX decided to disconnect two major telecommunications companies: Megafon (AS 1133) and Rostelecom (AS 12389).
Previously, there were no precedents when a transit provider turned off the Internet in such a large country as Russia. Many experts said that such actions would limit the total amount of network bandwidth originating from Russia. «A reduction in capacity could lead to congestion as the remaining international operators try to fill the gap“,” said Doug Madory, director of Internet analysis at network analytics company Kentik.
Some even predicted that Russia might even be effectively cut off from the global Internet. However, nothing happened. Network metrics show that all connections are preserved unchanged. There are several reasons for this. Firstly, the departure of one transit provider from a country the size of Russia — or two or three in this case – does not have enough impact to worsen the quality of service as a whole. Another reason is that both Lumen and Cogent continue to provide transit services to outposts of major Russian Internet service providers until these outposts are located inside Russia.
«Despite the fact that some transit providers in the United States will “disconnect” Russia from the Internet, no transit provider severing ties with Russian Internet providers would achieve such a goal“,” wrote members of the Internet research group ThousandEyes. «Many transit providers, both American and non-American, continue to connect their global customers to each other, including providing transit between and from Russian users through major Russian Internet service providers located at exchange points outside of Russia.».
As evidence, they cited images showing that Cogent continues to provide connectivity to and from Russia thanks to its relations with Russian backbone providers Rostelecom OJSC (AS 12389) and Rascom CJSC (AS 20764).
Traffic from Atlanta, Georgia passes through Cogent to Rostelecom JSC (AS 12389) at the peer-to-peer point in Frankfurt on March 7, 2022.
Traffic from St. Petersburg, Russia, passes through Cogent via Rascom CJSC (AS 20764) at a peering point in Copenhagen, Denmark, on March 7, 2022.
Bidirectional traffic between Moscow and Atlanta, Georgia, transits through Cogent and Ruscom CJSC, which are peer-to-peer in Stockholm and Copenhagen.
The researchers also showed how Cogent and Lumen (referred to by Thousands under their former name Level 3) continue to provide bandwidth thanks to Rostelecom’s announcement of the Border Gateway Protocol (BGP) announcing routes from one of its Russian provider clients, RSNET (AS 8291)., to Cogent, Lumen and TeliaNet.
Rostelecom JSC announced routes from one of its Russian Internet service providers, RSNET (AS 8291), to its global transit partners Cogent, Level 3 and TeliaNet on March 8, 2022.
«Recently, much has been said about their potential role in disconnecting Russia from the rest of the global Internet“,” the researchers added, referring to Cogent and Lumen. «However, Russia’s connection to the rest of the world through these vital networks remains unchanged, and major Russian Internet providers, such as Rostelecom, continue to cooperate with global transit providers outside Russia, as they did long before recent events. As a result, Russians have access to the global Internet — at least at the infrastructure levely».
Both Lumen and Cogent said on Friday that they were trying to balance the need to prevent cyber attacks on their Russian-backed networks with their beliefs in favor of a free and open Internet. The CEO of Cogent said that his company limited its actions to about 25 clients registered in Russia and directly in Russian networks. Russian companies using the Cogent network outside the country through non-Russian state suppliers were not affected. «We are sure that the downside of the possibility that these connections can be used for offensive purposes outweighs the negative side of the termination of some services“,” said Cogent CEO Dave Schaeffer.
Lumen gave a similar justification for his limited move.
«We decided to disconnect the network due to the increased security risk inside Russia“,” Mark Molzen, the company’s director of global affairs, told CNN. “MWe have not yet experienced network disruptions, but given the increasingly uncertain environment and the increased risk of government action, we have taken this step to ensure the security of our networks and our customers’ networks, as well as the continued integrity of the global Internet. ”
The ThousandEyes message was published before the London Internet traffic Exchange point LINX, one of the largest Internet exchanges for networks around the world, stopped routing for Rostelecom and MegaFon, the No. 2 mobile operator in Russia and the leader among providers in Russia. It is not yet clear how the ban will affect transit services in the country.
ThousandEyes reports that while traffic coming in and out of Russia is currently normal, traffic to individual Russian sites – both inside and outside the country – has been uneven. Most of the failures occurring in the form of dropped traffic, which often reached 100 percent packet loss, were the result of distributed denial-of-service attacks or attempts by Russian networks to repel attacks. «Russian sites have also shown signs of problematic network conditions indicative of DDoS attacks, as well as behavior consistent with route filtering, inter-network traffic screening and, in some cases, cloud-based DDoS mitigation tools.“, – the company’s researchers write. «The latest blocking mechanisms mainly affected users outside of Russia».