There has been a lot of news regarding Syria’s Internet shutdown that lasted for over 2 days before service has been restored on Saturday. One item that has not been covered in detail is traffic going *into* servers hosted within Syria and how they were affected.

While monitoring this case firsthand we saw that on Thurs. Nov 29th 10 a.m. UTC, there was a sudden rise in the number of failing DNS queries (servfail DNS response) to domains whose name servers are hosted in Syria. These failing queries kept rising, ultimately reaching a peak at 4 p.m. UTC on Fri. Nov 30th.

Everything seemed to go back to normal around 2 p.m. UTC on Sat. Dec 1st. DNS queries to Syrian domains seemed to no longer be failing.

Here are the Syrian domains with the most failing DNS queries during the blackout: – a Syrian ISP – a mail server – a popular web portal – a Syrian ISP – Damascus university – a web portal – a mail server – a website for development programs for Syrian youth – A torrent site – Syrian Ministry of Local Administration

You can see a video on the virtualization of this traffic here: Syrian Traffic Visualization