CONCEPT Cited by 1 source
Capital-localized Internet restoration¶
A capital-localized Internet restoration is the recurring shape in which the first phase of recovery from a government-directed shutdown is disproportionately concentrated in the country's capital city — typically more than 80% of the recovered traffic originating from that single metropolitan area while the rest of the country shows minor or no change.
The shape is structurally mechanism-diagnostic: it is only producible by a filtering-based shutdown architecture. A route-withdrawal shutdown's recovery propagates uniformly across all in-country ASes within minutes once prefixes are re-advertised, with no available primitive to "re-advertise this prefix only for users in the capital." Capital-localized recovery therefore confirms — in the recovery direction — the same mechanism diagnosis that "routes stay up, traffic drops" confirms in the shutdown direction.
Canonical instance: Tehran, May 26, 2026¶
Iran's February 28 2026 nationwide shutdown began its first partial restoration on May 26, 2026 — 87 days into the shutdown:
- 91.6% of post-restoration HTTP requests originated from Tehran.
- "While other regions show minor increases, they are not nearly as significant."
- All four of Iran's named operators (TCI, IranCell, RighTel, MCCI) showed simultaneous traffic increases — so the localisation is per-region, not per-operator.
The geographic concentration is observed via Cloudflare Radar's per-region breakdown (radar.cloudflare.com/ir), which combines per-AS traffic with end-user geolocation.
Why capital-first restoration is operationally rational for the state¶
Several factors make capital-first restoration the natural first phase when a state walks back a filtering shutdown:
- Political optics. The diplomatic, journalistic, and international-business population is concentrated in the capital. A capital-first restoration produces the most visible signal of "things are getting back to normal" per unit of relaxed control.
- Operational containment. The state retains control over whether to extend restoration to other regions or to claw it back. If the recovery causes problems (mass coordination events, dissent flare-ups), the loosened filters can be retightened in the capital while the rest of the country was never released in the first place.
- Economic concentration. Banking, payment systems, and cross-border commerce are disproportionately routed through the capital. Restoring there produces immediate economic relief while keeping the broader population offline.
- Whitelist infrastructure was capital-first. The pre-existing [white-SIM
- approved-domain whitelist](<./whitelist-internet-access.md>) infrastructure is typically most densely deployed in the capital because that's where the original "approved user" cohort (government employees, state-aligned businesses, military personnel) is concentrated. Loosening the filter for already-mostly-white- SIM regions is operationally cheaper than expanding the whitelist to new regions.
What the shape looks like on Radar¶
A capital-localized restoration produces a distinctive signature on Cloudflare Radar:
- Aggregate country-level traffic rises significantly (in Iran's case, ~15× prior-week levels) — visible on the per-country dashboard.
- Per-region breakdown shows >80% of the new traffic concentrated in one region, with neighboring regions showing minor (<5×) increases.
- Per-AS breakdown shows simultaneous rises across all major in-country operators — the recovery is per-region, not per-network. A per-network recovery would imply a single carrier was unblocked while others stayed dark, which is a different (and rarer) shape.
- DNS query rate ( 1.1.1.1) rises in proportion to HTTP traffic — confirming human-driven activity rather than synthetic traffic from state-permitted automation.
- Diurnal pattern (concepts/diurnal-traffic-pattern) re-establishes within hours — confirming consumer rather than state-only access.
Distinguishes from peer recovery shapes¶
| Shape | Geographic profile | Implied mechanism |
|---|---|---|
| Capital-localized restoration | >80% one region (capital) | Filtering, per-region selective |
| Uniform restoration | Balanced across regions | BGP re-advertisement OR uniform filter relaxation |
| Operator-localized restoration | One AS recovers, others stay dark | Per-carrier filter / per-carrier deal |
| Service-localized restoration | Specific domains/services back | Whitelist expansion |
These shapes are not mutually exclusive — the capital-localized shape can co-occur with service-localized (specific domains unblocked in the capital first) or with diurnal restoration (restoration windows during specific hours). Iran's May 26 recovery is structurally a capital-localized + likely service-localized combination given the pre-existing whitelist architecture.
Diagnostic value¶
For external observers — incident-response teams at multi-region SaaS providers, journalists, civil-society researchers — the capital-localized shape provides several inferences:
- The shutdown was filtering-based, not route-withdrawal-based, regardless of what the original observability evidence said.
- The state retains capacity to roll back the relaxation cheaply if the recovery becomes politically inconvenient.
- Recovery of non-capital regions is not implied by the capital recovery; subsequent regional recovery requires its own observed signals.
- The state has functioning whitelist / DPI infrastructure in the capital that is operationally healthy enough to support selective relaxation — not just a binary on/off switch.
Seen in¶
- sources/2026-05-27-cloudflare-irans-internet-is-partially-restored-cloudflare-radar-data-shows — canonical wiki instance. Iran's February 28 2026 shutdown began its first partial restoration on May 26 with 91.6% of restored HTTP requests originating from Tehran, all four major Iranian operators (TCI, IranCell, RighTel, MCCI) simultaneously rising, while "other regions show minor increases" — the structurally diagnostic shape of a filtering-based shutdown being walked back selectively by region rather than turned off uniformly.