Summary

  • Egypt’s global route visibility collapsed in stages on 27 January 2011, while a separate telescope continued to observe some packets sourced from Egyptian addresses.
  • Those packets did not establish that ordinary users could reach public services or that connections worked in both directions.

Three instruments, three different questions

The phrase “Internet shutdown” sounds like a switch: one moment connected, the next disconnected. The measurements from Egypt in January 2011 describe something less tidy. Researchers watched routes announced to the global routing system, packets arriving at a network telescope, and replies to active probes. Each instrument sampled a different layer of connectivity. Their records overlap, but they are not interchangeable.

The study’s BGP measurements began with 2,928 Egyptian IPv4 prefixes visible at 20:00 UTC on 27 January. Its timeline records an early loss of 15 prefixes at 20:24:11. The larger break came later: beginning at 22:12:26, roughly 2,500 prefixes disappeared over about 20 minutes. By 23:30, only 176 remained visible in that view. The sequence was dramatic, but the count described routes, not people, working websites, or functioning household lines.

That distinction is central. A prefix absent from global routing tables is difficult to reach from networks that rely on those tables. But its withdrawal does not tell us whether a local device still had a physical link, whether it could send traffic outward through another path, or whether a specific application worked. Conversely, a route still announced says that networks could see a path in the control plane; it does not guarantee that packets completed the journey.

The telescope saw a residue

A second stream came from the UCSD network telescope, which observes traffic directed at unused address space. It is a passive vantage point: the telescope does not ask Egyptian users to connect and does not measure a representative sample of household sessions. During the disconnection, traffic carrying Egyptian source addresses fell sharply, yet did not vanish.

That is a useful finding precisely because it is easy to overread. A packet with an Egyptian source address reaching the telescope means that some packet crossed a path from a source using that address. It may reflect a prefix that remained visible, an outbound path that survived after inbound reachability failed, or unsolicited traffic such as scanning. It does not reveal the sender’s identity, intention, application, or ability to receive a reply. It cannot establish that a person in Egypt could open a news site, send email, or sustain a conversation.

The control plane and the data plane can diverge. A network may stop advertising a prefix to the world while still sending some packets outward. Without an accepted return route, the same source may be unreachable from outside. An outbound observation and an inbound failure can therefore both be true. “Some packets got out” is a statement about a narrow observation, not a synonym for “the Internet remained available.”

Probes made the gap visible

The researchers also used CAIDA Ark, a system that sends active measurements toward address ranges. During the outage, about 1% of its probes to Egyptian IPv4 prefixes received a response, compared with roughly 16–17% on normal days. That sharp reduction corroborates a widespread loss of reachability from the probes’ vantage points. It still is not a user-access rate: the set of addresses probed, the machines able to answer, and the route from each probe shape the result.

Putting the streams together gives a stronger account than any one chart. BGP shows that most Egyptian prefixes disappeared from the global view. Active probing shows that responses became rare. The telescope shows that some packets with Egyptian source addresses continued to travel outward or otherwise reached an external observer. The streams establish a severe and broad disconnection with residual network activity. They do not collapse to a single percentage of Egyptians who were “online.”

The researchers later observed routes returning on 2 February; by roughly 09:56 UTC, more than 2,500 prefixes were again visible in their measurements. Restoration in the routing table marks a change in announced reachability. It does not, by itself, date the restoration of every carrier, application, or customer’s service.

What the route record cannot tell us

A route timeline is not a transcript of an order. The paper deliberately anonymized autonomous systems to reduce the risk that the measurements would expose individual operators. It also cautions that the order in which systems withdrew routes cannot reveal the underlying decision chronology. A timestamped sequence is evidence of network state as observed from outside; it is not a record of internal deliberation, legal authority, or who instructed whom.

That boundary matters in a politically charged event. The route data can establish that reachability changed on a large scale and over a short interval. They cannot independently identify the decision maker for every network or prove the mechanism behind every exception. Assigning responsibility from a graph would make the measurements carry claims they were designed not to support.

A useful analogy from Internet design is the difference between a published coordination state and the code or equipment participants actually run. Heng Lu’s Note 64 makes that distinction as a design principle: recorded rules do not themselves prove deployment. Here the analogy is limited to measurement discipline. The Egyptian evidence comes from the 2011 study, not from the note, and the note does not explain why routes changed.

The episode is therefore not best summarized as either “Egypt was completely offline” or “packets prove it was still online.” The first erases remaining routes and traffic; the second mistakes a narrow residue for public access. The more accurate account is layered: global route visibility collapsed; active replies became uncommon; some outward-sourced traffic persisted; and the available measurements cannot recover the private decision chain or the experience of every user.