When Networks Stay Up, But Services Disappear

Internet shutdowns occur when Internet connectivity is deliberately restricted or disrupted across a country, region, or network. They are often described in broad terms: routes disappear, networks become unreachable, or network traffic drops.

My colleagues' and my paper, “Characterizing Iran’s Phased National Internet Shutdown in 2025: A Progressive and Distributed Action”, looks at Iran’s June 2025 Internet shutdown from a different angle: network service availability.

We found that Iran’s networks remained largely visible in the global routing system, while many services hosted within them—including DNS, web, email, and VPN services—became unreachable from outside the country. We refer to this pattern as a service-level shutdown.

The Challenge of Measuring Service-Level Shutdowns

Measuring whether Internet services hosted inside a country’s networks are available is difficult because the service space is so large. A country can host millions of services across many networks, and it is not possible to test every service within a short time window.

To address this, we used randomized measurements rather than scanning services in a fixed order. By spreading measurements across different networks and services, each short time window provided a broad sample of which services were reachable from outside Iran, while reducing bias caused by the timing or order of measurement.

We then compared these measurements with normal service activity during comparable time periods. This helped us see when service availability dropped in a way that looked unusual, widespread, and consistent with the shutdown.

What Service-Level Measurements Revealed

Our service-level measurements revealed that Iran’s June 2025 Internet shutdown was not a single switch-off event. It unfolded in phases, expanded over time, and affected different networks and services in different ways.

We identified four phases (Figure 2): two localized disruption phases, a nationwide shutdown, and a staged recovery. It began with smaller disruptions, escalated into a much broader shutdown, and then recovered unevenly.

The impact also expanded over time. In our measurements, early disruptions affected infrastructure and tunneling-related services, including DNS, NTP, and VPN-related protocols, such as IKEv2 and L2TP. Later, the impact spread to more familiar services, including web, email, and file transfer (Figure 3).

Across networks, the shutdown and recovery were also uneven. Some networks were affected earlier than others, and some recovered later, suggesting that the event was not uniformly applied or removed.

Moving Beyond Network Reachability

Cases like Iran’s June 2025 Internet shutdown suggest that Internet shutdowns may not always look like full national blackouts. A network may still be reachable at the IP layer, while important Internet services inside that network become difficult or impossible to access from outside. In such cases, asking only whether an IP address or network is reachable can miss how access to services is actually restricted.

Service-level shutdown monitoring provides a complementary view. By measuring multiple protocols and services over time, it can reveal which services are disrupted, which networks are affected, and how disruption and recovery unfold.

This matters beyond the technical community. For journalists and civil society groups, service-level measurements can help avoid describing a shutdown only as “online” or “offline.” For policymakers and network operators, they show that different networks and services can be affected in different ways, helping prioritize critical services and assess recovery more carefully.

Read the full paper, and follow our poster presentation at WWW 2026 to learn more.

Shibo Cui is a PhD student at Tsinghua University, advised by Baojun Liu and working closely with Mingxuan Liu. His research focuses on Internet measurement and Internet outage monitoring.