CONCEPT Cited by 1 source
IPv6 withdrawal as a shutdown leading indicator¶
A selective IPv6 address-space withdrawal from a country's in-country ASes — hours before a traffic drop is externally observed — is a leading indicator that a nationwide government-directed Internet shutdown is imminent or already quietly underway.
The classic shape: IPv6 prefixes disappear from the global routing table several hours before IPv4 traffic collapses, even though IPv4 announcements and routing structure remain intact.
Why IPv6 first?¶
Several factors probably contribute to IPv6 being the first surface to shift during a state-coordinated shutdown:
- Lower customer blowback — in most countries, the primary user-facing Internet is still IPv4-reachable via dual-stack endpoints, so dropping IPv6 produces little immediate user-visible impact while allowing operators (or their state sponsors) to test the shutdown-execution pipeline.
- Asymmetric censorship tooling — some filtering and null-routing infrastructure was built for IPv4 and treats IPv6 as an afterthought, so disabling IPv6 is a cheap "close one door" move.
- Rehearsal / test signal — operators may use IPv6 withdrawal as a staged rehearsal before escalating to the full shutdown mechanism.
The Cloudflare Radar team is careful on causation: "Given the gap in timing between this change and the loss of traffic across the country, this may have been a leading indicator of what was about to happen, but likely not a direct cause of it."
Observational envelope¶
In the January 8, 2026 Iran shutdown:
- Several hours before the traffic drop, announced IPv6 address space across Iran collapsed.
- Asiatech (AS43754) alone lost 4.46 million /48-equivalents — ~9.4% of Iran's entire IPv6 space on one AS.
- RASANA (AS31549) lost 4.19 million /48-equivalents — ~8.8% of the country total.
- IPv4 announcements stayed nominally consistent through the same window.
- IPv6 share of traffic from Iran "going to zero" preceded the IPv4 collapse.
Per-AS breakdown of IPv6 withdrawal is accessible via the
systems/cloudflare-radar per-AS routing view
(radar.cloudflare.com/as43754, etc.), providing attribution
to specific networks rather than a country-aggregate signal.
Operational value¶
For observers, this is a predictive signal: if a country's largest IPv6-announcing ASes are shedding prefix coverage outside of scheduled maintenance windows, the geopolitical / operational context for a nationwide disruption may already be in motion. For incident-response teams at multi-region SaaS providers, this is an early hint to double-check regional failover readiness in the affected country before the main event.
For the shutdown itself (when it arrives), the IPv6 withdrawal is not the mechanism — the Iran January 8 shutdown landed with IPv4 traffic collapse via filtering, and the follow-on February 28 shutdown landed similarly via filtering with no meaningful shifts in either IPv4 or IPv6 announcements.
Seen in¶
- sources/2026-04-28-cloudflare-q1-2026-internet-disruption-summary — canonical wiki instance; Iran's January 8, 2026 shutdown was preceded by a coordinated IPv6 withdrawal across its largest in-country ASes (Asiatech, RASANA). Cloudflare's explicit interpretation: leading indicator, not direct cause. The accompanying observation "the share of IPv6 traffic in Iran going to zero" confirms that the withdrawal was effective in reducing live IPv6 reachability even before the main IPv4 traffic drop.