CONCEPT Cited by 2 sources

IPv6 withdrawal as a shutdown leading indicator¶

A selective IPv6 address-space withdrawal from a country's in-country ASes — hours before a traffic drop is externally observed — is a leading indicator that a nationwide government-directed Internet shutdown is imminent or already quietly underway.

The classic shape: IPv6 prefixes disappear from the global routing table several hours before IPv4 traffic collapses, even though IPv4 announcements and routing structure remain intact.

Why IPv6 first?¶

Several factors probably contribute to IPv6 being the first surface to shift during a state-coordinated shutdown:

Lower customer blowback — in most countries, the primary user-facing Internet is still IPv4-reachable via dual-stack endpoints, so dropping IPv6 produces little immediate user-visible impact while allowing operators (or their state sponsors) to test the shutdown-execution pipeline.
Asymmetric censorship tooling — some filtering and null-routing infrastructure was built for IPv4 and treats IPv6 as an afterthought, so disabling IPv6 is a cheap "close one door" move.
Rehearsal / test signal — operators may use IPv6 withdrawal as a staged rehearsal before escalating to the full shutdown mechanism.

The Cloudflare Radar team is careful on causation: "Given the gap in timing between this change and the loss of traffic across the country, this may have been a leading indicator of what was about to happen, but likely not a direct cause of it."

Observational envelope¶

In the January 8, 2026 Iran shutdown:

Several hours before the traffic drop, announced IPv6 address space across Iran collapsed.
Asiatech (AS43754) alone lost 4.46 million /48-equivalents — ~9.4% of Iran's entire IPv6 space on one AS.
RASANA (AS31549) lost 4.19 million /48-equivalents — ~8.8% of the country total.
IPv4 announcements stayed nominally consistent through the same window.
IPv6 share of traffic from Iran "going to zero" preceded the IPv4 collapse.

Per-AS breakdown of IPv6 withdrawal is accessible via the systems/cloudflare-radar per-AS routing view (radar.cloudflare.com/as43754, etc.), providing attribution to specific networks rather than a country-aggregate signal.

Operational value¶

For observers, this is a predictive signal: if a country's largest IPv6-announcing ASes are shedding prefix coverage outside of scheduled maintenance windows, the geopolitical / operational context for a nationwide disruption may already be in motion. For incident-response teams at multi-region SaaS providers, this is an early hint to double-check regional failover readiness in the affected country before the main event.

For the shutdown itself (when it arrives), the IPv6 withdrawal is not the mechanism — the Iran January 8 shutdown landed with IPv4 traffic collapse via filtering, and the follow-on February 28 shutdown landed similarly via filtering with no meaningful shifts in either IPv4 or IPv6 announcements.

The withdrawal can outlast the shutdown's traffic phase¶

The May 26 2026 partial restoration of Iran's February 28 shutdown surfaced a structural follow-on observation: the IPv6 address-space withdrawal can persist for months after the IPv4 traffic recovery starts. From Cloudflare Radar's 2026-05-27 follow-up: "While a partial restoration of the country's networks appears to be underway, the volume of announced IPv6 address space — and thus IPv6 traffic from Iran — remains effectively zero." The IPv6 withdrawal began as a leading indicator on January 8 2026 and remained in place through at least late May 2026 — ~5 months and counting — even as IPv4 traffic began its first recovery.

This decoupling implies that the IPv6 retraction was not just staging for a single shutdown; it has become a structural fact about Iran's Internet posture, with its own (likely political or operational) maintenance loop separate from the day-to-day IPv4 filtering apparatus. For external observers, this means:

A country that has executed an IPv6 withdrawal during a shutdown should not be expected to restore its IPv6 posture automatically when the IPv4 traffic recovery begins. The two layers can recover on independent timelines, with IPv6 trailing by months or longer.
Asiatech (AS43754) and RASANA (AS31549) continue to be the primary missing-IPv6-prefix sources; tracking their per-AS Radar pages remains the high-resolution window into whether IPv6 posture is actually being restored.

Seen in¶

sources/2026-04-28-cloudflare-q1-2026-internet-disruption-summary — canonical wiki instance; Iran's January 8, 2026 shutdown was preceded by a coordinated IPv6 withdrawal across its largest in-country ASes (Asiatech, RASANA). Cloudflare's explicit interpretation: leading indicator, not direct cause. The accompanying observation "the share of IPv6 traffic in Iran going to zero" confirms that the withdrawal was effective in reducing live IPv6 reachability even before the main IPv4 traffic drop.
sources/2026-05-27-cloudflare-irans-internet-is-partially-restored-cloudflare-radar-data-shows — persistence-direction follow-up: the IPv6 withdrawal that began January 8 2026 remained in place ~5 months later as the IPv4 partial restoration began. "The volume of announced IPv6 address space — and thus IPv6 traffic from Iran — remains effectively zero." IPv4 traffic recovery and IPv6 posture are decoupled. Establishes the pattern that an IPv6 withdrawal can become a structural feature of a country's Internet posture beyond its initial role as shutdown-staging.