Background on Irans Internet Shutdowns
Iran experienced two major Internet shutdowns in 2023, severely restricting digital communication nationwide. The first shutdown began on January 8 at 16:30 UTC, causing near-total traffic disruptions. While a small amount of traffic briefly returned on January 21 and January 25, a more consistent restoration occurred only after January 27. The second and more prolonged shutdown began on February 28, coinciding with escalating military strikes. Traffic levels dropped to below 1% of their usual volume, with minimal web and DNS activity recorded.
These disruptions highlight the impact of intentional Internet outages on national and global connectivity. Such actions have widespread implications for communication, commerce, and access to critical information. Monitoring tools like Cloudflare Radar provide essential insights into these events, enabling a detailed understanding of their scope and effects.
Patterns Observed During the February Shutdown
The second shutdown, which started on February 28 at 10:30 local time (07:00 UTC), was marked by an immediate and sharp decline in traffic. Cloudflare Radar data captured traffic plummeting to levels well below 1% of normal activity. For nearly three months, Iranian citizens faced significant challenges in accessing the Internet, with only intermittent and minimal connectivity observed during this period.
Analysis of the data reveals that both web and DNS traffic originating from Iran were almost entirely curtailed. These indicators underscore the effectiveness of the measures in isolating the country digitally. However, the prolonged nature of the shutdown posed severe limitations on communication and likely exacerbated economic and social strains.
May 26: Signs of Restoration
On May 26, Cloudflare Radar data began to show signs of a partial restoration of Internet access in Iran. Starting at approximately 11:00 UTC, traffic levels exhibited a marked increase, breaking the near-total stagnation observed over the previous months. A significant spike occurred at 11:45 UTC, followed by a steady upward trend from 12:00 UTC onward.
The observed increase in traffic was approximately 15 times greater than the average levels recorded during the earlier weeks of the shutdown. This sudden change indicates a deliberate effort to restore connectivity. However, the re-emergence of diurnal traffic patterns, with activity dipping around 21:00 UTC and rising again by 03:00 UTC the next day, suggests that the restoration process is not yet complete or consistent.
Technical Metrics Highlighting Internet Activity
Data on bytes transferred across Cloudflares network provides further evidence of the partial restoration. The initial spike at 11:45 UTC was followed by sustained increases in transferred data volumes. This trend aligns with broader traffic recovery, which became more pronounced as the day progressed. Despite these improvements, the traffic levels remain below pre-shutdown norms, indicating lingering restrictions.
DNS query volumes also showed a parallel recovery, reinforcing the assessment of improving connectivity. These metrics are critical for understanding how much of the countrys population is regaining access to essential online services. The data also offers a glimpse into how infrastructure is being brought back online incrementally rather than in a single, sweeping action.
Implications and Monitoring Efforts
The partial restoration of Internet services in Iran has significant implications for both domestic and international stakeholders. Access to the Internet is crucial for enabling communication and supporting economic activities. While the observed recovery is a positive development, the inconsistencies in traffic patterns suggest that full restoration may still face hurdles.
Ongoing monitoring through tools like Cloudflare Radar will provide critical insights into the pace and completeness of the recovery. By analyzing traffic and DNS data, engineers and analysts can assess whether this partial restoration is sustainable or subject to potential reversals. Further scrutiny will help identify trends and inform responses to similar events in the future.