{"id":120181,"date":"2014-02-17T16:04:56","date_gmt":"2014-02-17T10:34:56","guid":{"rendered":"https:\/\/www.colombotelegraph.com\/?p=120181"},"modified":"2014-03-10T02:35:52","modified_gmt":"2014-03-09T21:05:52","slug":"once-again-colombo-telegraph-blocked-dialog-and-etisalat-tamper-dns-responses","status":"publish","type":"post","link":"https:\/\/www.colombotelegraph.com\/index.php\/once-again-colombo-telegraph-blocked-dialog-and-etisalat-tamper-dns-responses\/","title":{"rendered":"Once Again Colombo Telegraph Blocked; Dialog And Etisalat Tamper DNS Responses"},"content":{"rendered":"

Continuing its undeclared war on media Sri Lanka\u2019s government of President Mahinda Rajapkasa blocked the Colombo Telegraph in Sri Lanka, this time with privately owned Telecommunication companies – \u00a0Dialog<\/span><\/a> and\u00a0Etisalat<\/span><\/a> –\u00a0further depriving the people\u2019s right to information.<\/p>\n

\"MR08102012E_1\"<\/a>For those of Colombo Telegraph’s more technically interested readers, please find below information on the\u00a0Blockade;<\/p>\n

<\/b>What is Colombo Telegraph?<\/b><\/p>\n

Colombo Telegraph is strictly a public interest website relating to Sri Lankan matters and is run completely voluntarily by a group of exiled journalists. The site gives space to a wide range of political views and censored\/ underreported stories. Colombo Telegraph has the honour of being first and only Sri Lankan site to be approved for inclusion in \u201cGuardian Select\u201d . It was checked and approved for Guardian Select membership by Guardian editorial. Guardian Select bring together the very best independent publishers from across the web.<\/p>\n

Chapter 1: HTTP connections reseted at Mobitel\u00a0 and Sri Lanka Telecom\u00a0<\/b><\/p>\n

Starting the Friday, 23rd of August 2013 a large number of connections to http:\/\/www.colombotelegraph.com were failing. Readers of the website started to report that the site was not available inside of Sri Lanka from some Internet providers.<\/p>\n

As the server has been blocked in the past, it was reasonable to believe that blocking was taking place once again. In order to verify the cause of the problem we checked 500 different connections inside of Sri Lanka to see from where such blocking was taking place.<\/p>\n

From our analysis we determined that connections from AS45356 and AS9329 were blocked.<\/p>\n

The blocking implemented in Mobitel and Sri Lanka Telecom consists in reseting the connections of the readers. More technical information of the blocking can be found here<\/span><\/a>.<\/p>\n

Chapter 2: DNS responses are tampered by Etisalat and Dialog\u00a0<\/b><\/p>\n

The 7th of January and 10th February 2014 we monitored a large drop of traffic coming from Dialog LK and Etisalat.<\/p>\n

\"Colombo<\/a><\/p>\n

Drop of traffic from Etisalat (10th February 2014) and Dialog (7th January 2014)<\/p>\n

A closer look into the Etisalat connections shows that traffic drops at around 10 AM, the 10th February 2014<\/p>\n

\"Colombo<\/a><\/p>\n

One interesting fact is that the traffic dropped 90% but not completely.\u00a0 After obtaining traffic samples inside of the country we determined that both Etisalat and Dialog are impersonating DNS responses for the colombotelegraph.com domain name.<\/p>\n

Etisalat tampering<\/b><\/p>\n

Etisalat claims that the name server of colombotelegraph.com is ns2.tigo.lk<\/p>\n