There has been a lot of news regarding Syria’s Internet shutdown that lasted for over 2 days before service has been restored on Saturday. One item that has not been covered in detail is traffic going *into* servers hosted within Syria and how they were affected.

While monitoring this case firsthand we saw that on Thurs. Nov 29th 10 a.m. UTC, there was a sudden rise in the number of failing DNS queries (servfail DNS response) to domains whose name servers are hosted in Syria. These failing queries kept rising, ultimately reaching a peak at 4 p.m. UTC on Fri. Nov 30th.

Everything seemed to go back to normal around 2 p.m. UTC on Sat. Dec 1st. DNS queries to Syrian domains seemed to no longer be failing.

Here are the Syrian domains with the most failing DNS queries during the blackout:

aloola.sy – a Syrian ISP
mail.sy – a mail server
albailassan.com – a popular web portal
aya.sy – a Syrian ISP
damascusuniversity.edu.sy – Damascus university
kadmoos.com – a web portal
mail.syriantelecom.sy – a mail server
massar.sy – a website for development programs for Syrian youth
aicotorrent.com – A torrent site
mla-sy.org – Syrian Ministry of Local Administration

You can see a video on the virtualization of this traffic here: Syrian Traffic Visualization