Rumors of Russian Internet Service Degradation Are Greatly Exaggerated

Despite recent, unprecedented announcements from two of the world’s largest backbone internet providers that they would be leaving Russia following its invasion of Ukraine, reports of a collapse in Russian internet services have been greatly exaggerated.

Just as internet service providers (ISPs) connect individuals and organizations to the internet, backbone providers are the companies that connect ISPs in one part of the world to those in other regions. These so-called transit providers route massive amounts of traffic between ISPs and other backbone networks. Earlier this week, Russian ISPs saw the departure of two of their largest providers: Lumen, the biggest internet transit provider into Russia, and Cogent, one of the world’s largest backbone internet providers.

Additionally, the London Internet Exchange (LINX), which connects over 950 different network operators, reportedly also imposed sanctions by disconnecting two major Russian telecom companies: MegaFon (AS 1133) and Rostelecom (AS 12389). This move was unprecedented, as no transit provider had ever previously cut off internet access to a country as large as Russia. Many experts predicted that such actions would limit the overall bandwidth available from Russia. “A reduction in bandwidth could lead to congestion as the remaining international operators try to fill the gap,” said Doug Madory, Director of Internet Analysis at network analytics company Kentik.

Some even speculated that Russia could be effectively cut off from the global internet. However, nothing of the sort has happened. Network metrics show that all connections have remained intact. There are several reasons for this. First, the exit of one—or even two or three—transit providers from a country as large as Russia does not have enough impact to degrade overall service quality. Another reason is that both Lumen and Cogent continue to provide transit services to outposts of major Russian ISPs, as long as those outposts are located outside of Russia.

“While some U.S. transit providers are ‘disconnecting’ Russia from the internet, no single transit provider severing ties with Russian ISPs would achieve that goal,” wrote members of the ThousandEyes internet research group. “Many transit providers, both American and non-American, continue to connect their global customers, including providing transit between Russian users and others via major Russian ISPs located at exchange points outside Russia.”

As evidence, researchers provided images showing that Cogent continues to maintain connectivity to and from Russia through its relationships with Russian backbone providers Rostelecom (AS 12389) and Rascom (AS 20764):

• Traffic from Atlanta, Georgia, passes through Cogent to Rostelecom (AS 12389) at a peering point in Frankfurt as of March 7, 2022.
• Traffic from St. Petersburg, Russia, passes through Cogent and Rascom (AS 20764) at a peering point in Copenhagen, Denmark, on March 7, 2022.
• Bidirectional traffic between Moscow and Atlanta, Georgia, transits through Cogent and Rascom, which peer in Stockholm and Copenhagen.

Researchers also demonstrated how Cogent and Lumen (referred to by ThousandEyes by its former name, Level 3) continue to provide bandwidth thanks to Rostelecom’s Border Gateway Protocol (BGP) announcements, which advertise routes from one of its Russian ISP clients, RSNET (AS 8291), to Cogent, Lumen, and TeliaNet.

“There has been much discussion recently about the potential role of these companies in disconnecting Russia from the rest of the global internet,” the researchers added, referring to Cogent and Lumen. “However, Russia’s connectivity to the rest of the world through these critical networks remains unchanged, and major Russian ISPs like Rostelecom continue to work with global transit providers outside Russia, as they have long before recent events. As a result, Russians still have access to the global internet—at least at the infrastructure level.”

Both Lumen and Cogent stated on Friday that they were trying to balance the need to prevent Russian-backed cyberattacks on their networks with their commitment to a free and open internet. Cogent’s CEO reported that his company limited its actions to about 25 clients registered in Russia and directly within Russian networks. Russian companies using Cogent’s network outside the country through non-Russian state providers were not affected. “We are confident that the risk of these connections being used for offensive purposes outweighs the downside of discontinuing some services,” said Cogent CEO Dave Schaeffer.

Lumen gave a similar rationale for its limited move. “We decided to disconnect the network due to increased security risks inside Russia,” Mark Molzen, the company’s global issues director, told CNN. “We have not yet experienced network disruptions, but given the increasingly uncertain environment and heightened risk of state action, we took this step to ensure the safety of our networks and those of our customers, as well as the ongoing integrity of the global internet.”

The ThousandEyes report was published before the London Internet Exchange (LINX)—one of the world’s largest internet exchanges—stopped routing for Rostelecom and MegaFon, Russia’s second-largest mobile operator and a leading ISP. It is still unclear how this ban will affect transit services in the country.

ThousandEyes reports that while inbound and outbound traffic to and from Russia is currently normal, traffic to individual Russian sites—both inside and outside the country—has been inconsistent. Most disruptions, often resulting in 100% packet loss, were due to distributed denial-of-service (DDoS) attacks or Russian networks attempting to mitigate such attacks. “Russian sites have also shown signs of problematic network conditions indicative of DDoS attacks, as well as behavior consistent with route filtering, traffic firewalls, and, in some cases, cloud-based DDoS mitigation,” the researchers wrote. “The latest blocking mechanisms have mostly affected users outside Russia.”