Internet service in Russian-occupied Kherson, Ukraine was disabled at 16:12 UTC (6:12pm local) on Saturday, 30 April. #UkraineRussiaWar
Khersontelecom service was restored ~24hrs later via Russian transit from nearby Crimea. pic.twitter.com/uN31jLrzEc
— Doug Madory (@DougMadory) May 2, 2022
The AS47598 experienced an outage shortly after 2022-04-30T16:10:00 and then resumed connectivity 2022-05-01T16:15:00 (both UTC time). After the outage, the AS47598 is then connected via a different upstream provider, AS201776.
The upstream provide change can also be seen on IIJ's Internet Health Report.
Prefixes
AS47598 announces only one prefix 91.206.110.0/23 (data from Hurricane Electric). Most of the BGP announcements are for this prefix. However, after the provider change happened, there were also a IPv6 prefix announcements for this V6 prefix as well 5bce:6e00::/23. It is possible that this prefix is a V4-translated prefix propagated to a V6 collector peer, but we do not know for sure.
We can also confirm the outage of the prefix with RIPEstat’s Routing History data widget. (uncheck the No low visibility box to reveal the outage).
BGP Messages
We can visualize the overall BGP announcements volume with Cloudflare Radar’s AS-level page.
The following are the UTC timestamps for the corresponding BGP message spikes.
2022-04-30T16:10:00: announcements with old provider12883in the paths.2022-05-01T16:00:00: announcements with the new provider201776in the paths2022-05-03T10:45:00: similar announcements with a new provider in the paths.
During the first gap time (2022-04-30T16:15:00 to 2022-05-01T16:00:00), there were 0 BGP updates for the prefix or from the ASN.
The old provider paths look like this where AS12883 is the next hop for AS47598. See the full list of messages from rrc00 here: https://gist.github.com/digizeph/c58b77f755d7fec8a7969807fb17d5ba.
207564 56655 3257 12883 47598
The new provider paths look like this where AS12389 and AS201776 are the next hops for AS47598. See the full list of messages from rrc00 here: https://gist.github.com/digizeph/896a4a7e4de23082b496b92ab5bdab5b
207564 28824 28824 1299 12389 201776 47598
BGP Data Tooling
The analysis is done using a privately hosted open-source BGPKIT parser web API. You can host it on your infrastructure, and the source code is freely available at https://github.com/bgpkit/pybgpkit-api. Comments and feedback are welcome!
Update on 2022-05-04T09:20:00 Pacific
#Kherson — Internet connectivity is returning to the occupied city in South of #Ukraine, after an outage since Saturday. @Cloudflare data shows growth in requests since 04:15 UTC, and telecom connection was confirmed by the Ukrainian Vice PM @FedorovMykhailo. pic.twitter.com/JxT3kcM234
— Cloudflare Radar (@CloudflareRadar) May 4, 2022
The upstreams for AS47598 has reverted back to the original ASes, and the traffic has started coming back to normal.