More as a pedantic nitpick, and not that it's necessarily relevant, in the sense that it may not undermine the veracity of the claim "Libya shuts down Internet"

More as a pedantic nitpick, and not that it's necessarily relevant, in the sense that it may not undermine the veracity of the claim "Libya shuts down Internet": Traceroutes (or pings) halting at a certain point does not a dead route necessarily make. Traceroute operates by setting the TTL (Time to Live) field of a packet to 1 and forwarding it along. In principle, routers that reach a value of 0 when they decrement the TTL drop the packet and send a backward ICMP TTL-exceeded-in-transit notification to the sender, which is how the address of the router is discovered. Then traceroute sends out another datagram, increases the TTL by 1, and so on until the desired endpoint is reached or a maximum TTL value is exceeded (to avoid getting the datagram into routing loops). In practice, some networks - especially at the edge, outside the core infrastructure of large backbone haulers - block outgoing ICMP TTL-exceeded-in-transit messages, and sometimes all ICMP, including ICMP echo reply, administratively prohibited, and port unreachable messages. These are all diagnostically useful, but can also be used to profile an endpoint or map the interior of a network. I would especially expect a government like Libya's to make a policy of blocking such revealing messages at all border routers associated with national-level Internet egress points. There is a constant and lively debate in the BGP and inter-domain networking community about the relative benefit of ICMP messages for troubleshooting and normal operations (after all, there was a reason the protocol was created) vs. the perceived security liabilities of having unrestricted two-way ICMP interactions with the rest of the Internet. So, it's not clear what it means for traceroutes through the Telecom Italia AS to "fail," nor does this necessarily indicate that Libya has gone dark. It would be more convincing if all BGP announcements associated with Libyan blocks were withdrawn, although that would only happen if every one of their blocks was a provider-independent, RIR (regional Internet registry, RIPE in Libya's case)-issued block, not a delegated part of a foreign provider's larger aggregate announcement, so even then, who knows. For what it's worth, I am unable to reach the same conclusion as the article, at least at this moment. Here is the latest list of allocations to Libya from http://countries.nerd.dk[1] http://countries.nerd.dk[1]: sasha@octavia:~$ egrep 'ly$' zz.countries.nerd.dk.rbldnsd 41.208.64.0/18 :127.0.1.178:ly 41.252.0.0/14 :127.0.1.178:ly 62.68.32.0/19 :127.0.1.178:ly 62.240.32.0/19 :127.0.1.178:ly 80.231.6.0/23 :127.0.1.178:ly 80.231.214.0/23 :127.0.1.178:ly 82.205.146.0/27 :127.0.1.178:ly 82.205.154.128/27 :127.0.1.178:ly 82.205.174.208/28 :127.0.1.178:ly 82.205.175.64/28 :127.0.1.178:ly 82.205.182.24/29 :127.0.1.178:ly 82.205.182.128/27 :127.0.1.178:ly 82.205.183.0/24 :127.0.1.178:ly 82.205.186.0/24 :127.0.1.178:ly 82.205.213.0/24 :127.0.1.178:ly 82.205.214.0/24 :127.0.1.178:ly 82.205.218.144/28 :127.0.1.178:ly 82.205.221.0/29 :127.0.1.178:ly 82.205.221.160/29 :127.0.1.178:ly 82.205.222.64/27 :127.0.1.178:ly 82.205.227.0/24 :127.0.1.178:ly 82.205.232.0/24 :127.0.1.178:ly 82.205.251.0/25 :127.0.1.178:ly 84.11.13.32/27 :127.0.1.178:ly 84.11.13.176/28 :127.0.1.178:ly 84.11.13.192/28 :127.0.1.178:ly 84.11.13.224/27 :127.0.1.178:ly 84.11.14.96/27 :127.0.1.178:ly 84.11.45.48/28 :127.0.1.178:ly 86.62.4.0/30 :127.0.1.178:ly 88.202.120.0/23 :127.0.1.178:ly 91.188.4.96/27 :127.0.1.178:ly 91.188.7.16/29 :127.0.1.178:ly 91.188.7.40/29 :127.0.1.178:ly 91.188.7.64/29 :127.0.1.178:ly 91.188.7.96/27 :127.0.1.178:ly 213.209.168.4/30 :127.0.1.178:ly 213.209.168.16/30 :127.0.1.178:ly 213.255.224.160/29 :127.0.1.178:ly 213.255.226.104/29 :127.0.1.178:ly 213.255.226.120/29 :127.0.1.178:ly 213.255.229.208/29 :127.0.1.178:ly 213.255.240.128/29 :127.0.1.178:ly 213.255.247.16/29 :127.0.1.178:ly 213.255.247.232/29 :127.0.1.178:ly 213.255.248.200/29 :127.0.1.178:ly 217.194.135.152/29 :127.0.1.178:ly 217.194.136.192/29 :127.0.1.178:ly 217.194.136.240/29 :127.0.1.178:ly 217.194.137.160/29 :127.0.1.178:ly If you go find your nearest BGP looking glass (such as: 'telnet route-server.gblx.net' as I prefer the Cisco interface, you can find others at www.bgp4.as/looking-glasses) and do, for example: show ip bgp 41.208.64.0/18 ... you will find the announcements for all of the above alive and well. P.S. Why does everyone who says "if you have a .ly domain, you are supporting the Gaddafi regime!" assume that the .ly TLD is managed directly by Libya? [2] Many smaller, less Internet-involved (if not wholly Internet-unconnected) countries outsource management and use of their TLD to foreign companies in exchange for licensing fees. EDIT: It does appear that '.ly' is managed from inside Libya now, but if so, that's a relatively recent development. There was a UK company that managed the 'ly' zone for quite some time. Now the primary nameserver seems to be dns1.lttnet.net, associated with Libyan Telecom and Technology, and whose IP is 62.68.42.9 and indeed part of one of the Libyan allocations above (62.68.32.0/19). If it's stability you're concerned about, then look who else is involved as a backup other than lttnet.net: sasha@octavia:~$ host -t SOA ly ly has SOA record dns.lttnet.net. khaleds.lttnet.net. 201102220 3600 900 2419200 600 sasha@octavia:~$ host -t NS ly ly name server dns1.lttnet.net. ly name server ns-ly.ripe.net. ly name server dns.lttnet.net. ly name server phloem.uoregon.edu. ly name server auth02.ns.uu.net. Don't jump to conclusions. --- [1] Most of these are /27s and smaller that are part of larger aggregates. I can't quite put my finger on why such small subnets are listed, given that the smallest announcement allowed in the global BGP table is a class C (/24). I would guess this list was compiled from the more granular delegation data found in WHOIS records, not a full BGP view. [2] Also, you only started caring about this now?