TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Internet Shutdown Monitoring

6 posts · Nov 2012 – Oct 2026

What this trail covers

Cloudflare Radar provides real-time tracking of global Internet traffic patterns, enabling the monitoring and analysis of Internet shutdowns, traffic mix changes, and country-specific data. This includes detailed views for domains and IP addresses, and the ability to analyze TCP connection resets and timeouts to infer network behavior and potential filtering or tampering. The platform's capabilities are used to corroborate external reports of network events, such as IP unblocking and firewall te This redesign focuses on making Radar more accessible to a wider audience by introducing a map-based interface for global traffic and outage visualization, and a tabbed flow for guided data exploration. The design language is unified with Cloudflare's brand, blending marketing, content, and product experiences. Future work will focus on tools, visualizations, and storytelling frameworks to empower users with real-time insights across security, performance, and traffic.

All Cloudflare trails
  1. Bridging technical depth and usability: The story behind Radar’s redesignThe post details the redesign of the Cloudflare Radar landing page. The previous design used a bento box layout that made information difficult to parse and felt intimidating to new users. The new design introduces a map-based interface for visualizing global traffic and outages, aiming to provide a more intuitive and familiar entry point. It also incorporates a tabbed flow for guided data exploration, moving away from overwhelming users with too much information at once. The design language was unified with Cloudflare's broader brand, blending aspects of marketing, content, and product experiences. The team iterated on map designs to balance data richness with approachability. The goal is to make Radar a more regular, self-serve resource for a broader audience, including journalists, policymakers, and everyday users, while preserving the depth and rigor of its data.
  2. Total eclipse of the Internet: traffic impacts in Iceland, Spain, and PortugalThis post details how Cloudflare Radar was used to analyze the impact of a total solar eclipse on Internet traffic in Iceland, Spain, and Portugal. It demonstrates the correlation between solar obscuration and HTTP request volume, showing traffic dips that align precisely with maximum obscuration. The analysis uses five-minute buckets of HTTP request volume compared to a normal-day baseline, and a scatter plot to show the relationship between peak solar obscuration and traffic dip. It also presents trend lines for individual countries, highlighting the most dramatic drops in traffic.
  3. Iran's Internet is partially restored, Cloudflare Radar data showsThis post details the observation and analysis of Internet traffic patterns in Iran during two prolonged national shutdowns in 2026. It uses Cloudflare Radar data to show a sharp drop in traffic and DNS queries during the shutdowns, followed by a partial restoration. The post highlights that traffic returned to approximately 40% of previous levels, with the majority of new traffic originating from Tehran. It also notes that IPv6 traffic and address space remained effectively zero throughout the shutdowns, while IPv4 address space remained stable, suggesting that the shutdown was achieved through application filtering or whitelisting rather than network-level routing changes.
  4. Shutdowns, power outages, and conflict: a review of Q1 2026 Internet disruptionsThis post details the observed impact of various Internet disruptions in Q1 2026 on global traffic patterns. It quantifies the impact of government-directed shutdowns in Uganda and Iran, noting traffic drops to near zero and analyzing shifts in announced IP address space (IPv6 loss in Iran). It also documents connectivity disruptions in Ukraine due to military action impacting energy infrastructure, leading to power outages and traffic drops. The post further details the physical damage to AWS data centers in the UAE and Bahrain from drone strikes, illustrating elevated connection failure rates. Other disruptions analyzed include power outages in Cuba, cable damage in the Republic of Congo, and technical issues with Verizon Wireless, Guinea, and the UK. The analysis uses Cloudflare Radar data, including bytes-based and request-based traffic graphs, and notes the use of IP address space announcements as potential indicators of shutdowns.
  5. Cable cuts, storms, and DNS: a look at Internet disruptions in Q4 2025This post details observed Internet disruptions in Q4 2025, including government-directed shutdowns in Tanzania, cable cuts affecting Digicel Haiti, Cybernet/StormFiber (Pakistan), and multiple providers in Cameroon, as well as power outages in the Dominican Republic and Kenya, and impacts from military action in Ukraine. It quantifies traffic drops and IP address space changes associated with these events, providing specific dates, times, and affected Autonomous Systems. It also references the Cloudflare Radar Outage Center for a comprehensive list of verified anomalies.
  7. The 2025 Cloudflare Radar Year in Review- the rise of AI, post-quantum, and record-breaking DDoS attacksThis post is the 2025 Cloudflare Radar Year in Review, detailing observed Internet trends based on Cloudflare's network data. Key findings include 19% global internet traffic growth, significant AI bot activity (Googlebot dwarfing others, 15x increase in AI 'user action' crawling), post-quantum encryption adoption reaching 52%, increased Starlink traffic, and a quarter of global bot traffic originating from AWS and Google Cloud. It also highlights 174 major internet outages, with nearly half due to government shutdowns, and continued improvement in routing security (RPKI). Hyper-volumetric DDoS attack sizes grew significantly, and over 5% of analyzed email messages were malicious.
  8. The tricky science of Internet measurementThis post introduces the scientific practice of Internet measurement, emphasizing its challenges due to the Internet's opacity and the need for rigor, repeatability, and reproduction. It outlines the measurement lifecycle (data curation, modeling, validation) and contrasts active (e.g., pings, probes) with passive (e.g., logs) measurement techniques, noting their complementary nature. It also explains direct (e.g., speed tests) versus indirect (e.g., packet pairs for bandwidth estimation) measurement, highlighting the trade-offs and potential for misleading results. A motivating example from Cloudflare's analysis of traffic spikes in Ukraine illustrates the importance of context and avoiding erroneous conclusions. The post emphasizes that high-quality data is the linchpin of the measurement lifecycle.
  9. Data at Cloudflare scale- some insights on measurement for 1,111 internsThis post details a research project that leverages Cloudflare's passive network data to detect middlebox interference. It describes the challenges encountered, including data scale (45M+ HTTP requests/sec, 285+ data centers), noisy data (millisecond time resolution, DoS traffic, Happy Eyeballs), and lack of ground truth. The project used IPTABLES rules to sample 1 in 10,000 TCP connections and logged the first 10 packets to develop 'tampering signatures' based on packet drop and RST patterns, and inconsistent TTL changes. The research highlights the difficulty of identifying the 'who' of tampering and the full scope of affected traffic even with large datasets.
  10. Internet measurement, resilience, and transparency: blog takeover from Cloudflare Research and friendsThis post announces a week-long series of blog posts from Cloudflare Research and friends, focusing on internet measurement, resilience, and transparency. It highlights upcoming topics such as foundational internet measurement concepts, tradeoffs in measurement, the evolution of Cloudflare Radar, and the mechanics of the internet speed test. It also introduces a framework for internet resilience, discusses post-quantum cryptography deployment, and explores cryptographic protocols for an agentic web, including Web Bot Auth and new protocols for protecting websites from attacks. The post emphasizes the collaborative and open nature of their research.
  11. Russian Internet users are unable to access the open InternetThis post details the observed throttling and blocking mechanisms employed by Russian ISPs, including injected packets, packet blocking, and a new 16 KB content limit. It presents data from Cloudflare Radar showing traffic reduction, increased NEL errors (TCP resets, QUIC protocol errors), and high packet loss to Russian data centers. The analysis correlates these observations with public reports and internal tooling, specifically focusing on TCP behavior post-PSH stage to confirm throttling.
  12. How the April 28, 2025, power outage in Portugal and Spain impacted Internet traffic and connectivityThis post details the impact of a large-scale power outage in Portugal and Spain on Internet traffic, network quality, and routing metrics. It quantifies traffic drops at country, network (ASN), and regional levels, showing immediate and sustained declines in request traffic to Cloudflare's services and DNS resolver. It also presents data on degraded network quality, including reduced download speeds and increased latency. Furthermore, the post illustrates the impact on routing by showing a decrease in announced IP address space from affected Portuguese providers. This analysis demonstrates Cloudflare Radar's capability to measure and report on the effects of major infrastructure disruptions on global connectivity.
  13. TikTok ban takes hold: data reveals sharp traffic decline and rapid shift to alternativesThis post details how Cloudflare Radar's DNS and network traffic analysis capabilities were used to monitor the impact of the US ban on TikTok. It quantifies the traffic decline for TikTok and ByteDance's network (AS396986) and the surge in traffic for alternatives like RedNote (Xiaohongshu) in the US and other countries. It also notes the subsequent partial restoration of TikTok service and ongoing monitoring.
  14. Global elections in 2024: Internet traffic and cyber threat trendsThis post details the impact of global elections in 2024 on internet traffic and cyber threat trends. It highlights specific instances of DDoS attacks targeting political campaigns and infrastructure in the US, France, UK, Netherlands, Romania, South Africa, Portugal, Taiwan, and Japan, providing peak request per second (rps) metrics for several of these. It also documents election-related internet shutdowns in Comoros and Pakistan, quantifying the traffic drop. Additionally, it analyzes election-day internet traffic patterns in Taiwan, Finland, Indonesia, Portugal, Russia, and South Korea, correlating them with polling hours, device usage, and media broadcasts.
  15. Resilient Internet connectivity in Europe mitigates impact from multiple cable cutsThis post details the analysis of two submarine cable cuts in the Baltic Sea (BCS East-West Interlink and C-Lion1) and demonstrates how resilient Internet infrastructure in Europe mitigated their impact. It presents Cloudflare Radar data (NetFlows, bandwidth, latency) for Lithuania, Sweden, Finland, and Germany, showing no observable traffic disruptions or significant quality degradation at the time of the incidents. It also analyzes BGP announcements and IP address space, which remained unaffected. The post highlights the redundancy of submarine cables and terrestrial fiber networks in the region as key factors in maintaining connectivity.
  16. Impact of Verizon's September 30 outage on Internet trafficThis post quantifies the impact of a Verizon mobile network outage on Internet traffic by analyzing HTTP request volume from AS6167. It provides specific metrics for traffic decline (e.g., -5% to -9% globally for the ASN, up to -30% in Omaha) and timing of restoration. It also compares traffic trends in specific cities, noting variations and continued week-over-week increases in some locations during the outage. The analysis uses Cloudflare Radar data to illustrate these observations.
  17. Introducing HTTP request traffic insights on Cloudflare RadarThis post introduces a new metric to Cloudflare Radar: HTTP request count. This metric is derived from aggregated NetFlow data and complements existing byte-based traffic volume metrics. The new data is integrated into the Overview and Traffic sections of Radar, providing users with the ability to compare HTTP request volume with HTTP byte volume over time. The post explains the value of this new metric for resilience, distinguishing real events from data pipeline issues, and providing a cleaner signal for user activity, especially for API traffic. It also details how the new graphs are displayed and the underlying data is accessible via the Radar API.
  18. A recent spate of Internet disruptionsThis post details specific instances of Internet disruptions observed by Cloudflare Radar in Bangladesh, Syria, and Pakistan. It provides granular data on traffic volume and announced IP address space changes for affected network providers (ASNs) during these events. The post also includes analysis of Internet Quality measurements in Bangladesh and details the timeline of restoration efforts for both broadband and mobile services. For Syria, it distinguishes between planned exam-related shutdowns and an unplanned outage caused by data center maintenance. For Pakistan, it highlights the impact on major ISPs.
  19. French elections: political cyber attacks and Internet traffic shiftsThis post analyzes internet traffic shifts in France during the 2024 legislative election runoff, correlating a 16% drop in overall traffic at 20:00 local time with the announcement of initial results. It details regional traffic drops, with Bourgogne-Franche-Comté and Grand Est experiencing a 19% decrease. The post also notes an increase in mobile device traffic share to 58% on election day and analyzes DNS traffic trends for news outlets and social media, showing higher traffic for news during the runoff. It also quantifies DDoS attacks against political parties, with one peaking at 151,000 requests per second.
  20. How the UEFA Euro 2024 football games are impacting local Internet trafficThis post details how major sporting events like UEFA Euro 2024 can cause significant drops in local Internet traffic, with an average drop of 6% observed in European countries during games. It also highlights observed DDoS attacks targeting various websites in Germany during the event, with one attack reaching 105 million requests per hour. The analysis uses Cloudflare's global network data to observe these trends.
  21. Exam-ining recent Internet shutdowns in Syria, Iraq, and AlgeriaThis post details the analysis of Internet shutdowns implemented by Syria, Iraq, and Algeria for exam cheating prevention. It specifically examines the impact on traffic patterns, routing information, and Cloudflare services like 1.1.1.1 DNS Resolver and Authoritative DNS. The analysis reveals that Syria implements shutdowns by not announcing IP address space, causing asymmetrical traffic flow and spikes in UDP DNS requests due to unreturned responses. Iraq's approach is also analyzed, and Algeria's content blocking strategy is noted. The post highlights how these shutdowns are detected and measured using Cloudflare Radar.
  22. Exploring the 2024 EU Election: Internet traffic trends and cybersecurity insightsThis post analyzes internet traffic trends and cyberattack activity during the 2024 European Parliament election. It quantifies traffic drops during voting hours across 27 EU countries, correlating them with local times and regional patterns. It also details specific traffic anomalies caused by political announcements in Belgium and France. The post further presents data on increased DNS traffic to election-related domains and news outlets, and reports on DDoS attacks targeting government websites, including specific metrics like requests per second. The analysis leverages Cloudflare Radar data and historical election data for comparison.
  23. Internet insights on 2024 elections in the Netherlands, South Africa, Iceland, India, and MexicoThis post details the analysis of traffic patterns and cyberattacks during elections in the Netherlands, South Africa, Iceland, India, and Mexico. It highlights observed decreases in internet traffic during polling hours, spikes in traffic around election results, and specific DDoS attacks targeting political websites. The analysis leverages Cloudflare Radar's data to provide insights into the impact of elections on internet usage and security.
  24. An Internet traffic analysis during Iran's April 13, 2024, attack on IsraelThis post analyzes internet traffic patterns in Israel and the Palestinian territories during Iran's April 13, 2024, attack. It details a surge in traffic in Israel driven by mobile devices seeking news updates, and a noticeable drop in traffic in the Palestinian territories, attributed to users pausing online activities or turning to television. It also notes a decline in traffic in Iran linked to the conclusion of Ramadan, with a subsequent increase on April 14. The post also reports no significant application-layer attacks targeting Israel, contrasting with a notable uptick in October 2023.
  25. How the Brazilian Presidential elections affected Internet trafficThis post analyzes the impact of the Brazilian presidential elections on internet traffic using Cloudflare Radar and 1.1.1.1 DNS query data. It details how overall internet traffic decreased during voting hours on election days, with higher drops observed during the runoff election. Mobile device usage increased on election days. DNS queries to election-related websites and news organizations spiked significantly, with higher interest in the runoff election for election sites and the first round for news sites. Traffic to candidate domains also showed spikes, with the winner's domain seeing a significant increase post-announcement. The analysis highlights the correlation between election events and internet traffic patterns.
  26. What Cloudflare is doing to keep the Open Internet flowing into Russia and keep attacks from getting outThis post details Cloudflare's observations and actions regarding internet traffic and cyberattacks in Russia and Ukraine following the invasion of Ukraine. It highlights the Russian government's control over its internet infrastructure, the adoption of privacy tools like Cloudflare WARP by Russian citizens seeking access to the global internet, and the increase in DDoS attacks originating from Russia. Cloudflare's role in protecting Ukrainian infrastructure and its decision not to withdraw services from Russia to maintain internet openness for the Russian people are also discussed.
  27. Sudan's exam-related Internet shutdownsThis post details the use of Cloudflare Radar to track and analyze Internet shutdowns in Sudan, which were implemented during exam hours. It highlights the ability to identify specific timings of these shutdowns, observe the impact on mobile vs. desktop traffic, and provides a link to the live data for ongoing monitoring. The post also mentions the potential for future shutdowns based on announced schedules.
  28. Syria’s exam-related Internet shutdownsThis post details the use of Cloudflare Radar to monitor scheduled Internet shutdowns in Syria during exam periods. It highlights how Radar's country-specific pages and historical data can visualize these disruptions, showing drops to near-zero traffic corresponding to exam times. The post includes specific UTC times for the outages and links to live data on the Radar Syria page.
  29. Uganda's January 13, 2021 Internet Shut DownThis post details the observation and analysis of Uganda's January 13, 2021 internet shutdown using Cloudflare Radar. It showcases the platform's ability to detect and visualize traffic drops, confirm them with exchange point statistics, and monitor BGP routing. The update on January 18th shows the re-establishment of connections and return to near-normal traffic levels, while noting continued social media blocking.
  30. Internet traffic disruption caused by the Christmas Day bombing in NashvilleThis post details the analysis of internet traffic disruption in Nashville caused by the Christmas Day bombing. It uses Cloudflare's traffic flow data to show the impact of the explosion on AT&T's network, illustrating the outage duration and recovery period. The post includes two graphs showing the drop and subsequent recovery of traffic.
  31. Introducing Cloudflare RadarThis post introduces Cloudflare Radar, a new service that exposes insights, threats, and trends based on aggregated data from Cloudflare's network. It launches with three key components: Radar Internet Insights (news, trend data, domain popularity, attack activity, technology trends), Radar Domain Insights (domain configuration, content categories, popularity trends), and Radar IP Insights (network, geographic, and speed information for IP addresses). Future plans include adding more data points, a 30-day time frame, and filtering by industry.
  32. On the shoulders of giants: recent changes in Internet trafficThis post details observed shifts in global internet traffic patterns correlated with COVID-19 related quarantines and government announcements. It presents data showing increased traffic to video conferencing, streaming, and news services, and decreased traffic from business and university networks. Specific examples include traffic surges in the US following a State of Emergency announcement, dips in France after lockdown measures, and overall increases in Italy. The post also highlights increased traffic at Internet Exchange Points (IXPs) in Europe and Asia, correlating with regional lockdowns. It concludes by emphasizing the robustness of the internet infrastructure in handling changing load patterns.
  33. Power outage hits the island of Taiwan. Here’s what we learned.This post details observations from a major power outage in Taiwan, demonstrating that internet usage (requests per second) did not necessarily decrease, and even spiked initially, while bandwidth usage dropped significantly due to a shift from desktop to mobile devices. It highlights the resilience of data center infrastructure with backup power.
  34. How eero mesh WiFi routers connect to the cloudThis post details how eero uses Cloudflare as a 'cloud canary' to check internet availability from their devices. They store a small file in Amazon S3 and use Cloudflare to serve this file to hundreds of thousands of eero devices. This provides an out-of-band, highly available, and low-cost method to test internet availability, independent of eero's own cloud infrastructure. Cloudflare's API is used to track requests to this secondary check, enabling alerts when eeros cannot reach the cloud. The use of Cloudflare's edge significantly reduces S3 costs.
  35. How Syria Turned Off the InternetThis post details the analysis of a complete internet blackout in Syria on November 29, 2012. It describes how BGP routes to Syrian IP space were simultaneously withdrawn by its upstream providers (PCCW, Turk Telekom, Telecom Italia, and TATA), effectively cutting the country off the Internet. The analysis suggests this was a deliberate configuration update rather than a physical cable cut, based on the systematic withdrawal of routes. It also lists the last few websites accessed by Syrian users before the outage.