Sudan Conflict Disrupts Internet Traffic, With ISP Outages and Shifts in Usage Patterns
When the armed conflict between rival factions of Sudan's military government began on Saturday, April 15, 2023, at 08:00 UTC, Cloudflare observed an immediate disruption in Internet traffic that deepened the following day. The situation has continued since, with different Internet Service Providers affected—in some cases losing up to 90% of their traffic. By May 2, traffic across Sudan remained roughly 30% lower than pre-conflict levels.
While major local providers experienced direct outages, the general decline in traffic may also stem from changing human behavior, as many people attempt to flee the country—a pattern Cloudflare also documented during the war in Ukraine. The hourly view from Cloudflare Radar over the past two weeks illustrates the lasting impact, with the orange shading marking the period since the conflict began.
A daily traffic view, dominated by mobile device usage (discussed below), shows a clear drop starting April 15. Saturday's traffic was down 27% compared to the previous Saturday, and the following day it fell 43% relative to the prior Sunday.
Multiple ISP Outages and Nationwide Disruptions
More significant disruptions occurred on April 23 and 24, affecting several ISPs and their autonomous systems, and bringing the country's Internet traffic even lower. While no official cause was given for these outages with nationwide impact, they also rippled into neighboring Chad, as Sudan's Sudatel (AS15706) serves as an upstream provider for some networks there.
Compared to pre-conflict baselines (April 9 and April 10), traffic dropped 74% on Sunday, April 23, and 70% on Monday, April 24. Some ISPs experienced particularly severe losses. MTN (AS36972) reportedly blocked Internet services after being ordered to restore them just hours later; Cloudflare observed a near-90% traffic drop lasting about ten hours, beginning at 00:00 UTC on April 16.
Other providers endured even more sustained outages. Sudatel (AS15706), Zain (AS36998), and Canar (AS33788) experienced almost complete failures, with Canar being offline the longest—83 hours from April 21 to 25. Sudatel followed with 40 hours of near-total blackout, and Zain with a 10-hour outage on April 24. The return of traffic coincided with the beginning of a nationwide 72-hour ceasefire on April 24.
Border Gateway Protocol (BGP) announcements—the mechanism networks use to exchange routing information—are a useful signal for detecting these disruptions. The largest BGP update spikes from Sudatel align with both the start of the outage and its recovery.
Mobile Traffic Grows as a Share of the Total
Sudan historically has one of the highest percentages of mobile device traffic worldwide—with a previously recorded average of 83% in 2021. In recent weeks, mobile traffic has grown as a share of all Internet traffic in the country. During the week of April 3, it accounted for 77%; the following week, which included April 15 and 16, rose to 80%. By the week of April 17, mobile devices drove 85% of traffic, and by April 24, that figure reached 88%, making Sudan the leading country in Cloudflare's worldwide ranking.
Recent Traffic Levels and Daily Patterns
Looking at week-over-week hourly comparisons, this past Friday's traffic was still around 55% lower than pre-April 15 levels. By May 2, traffic was still down roughly 30% from the pre-conflict baseline of April 11.
Besides the conflict related dips, this chart also reveals a regular traffic drop around 16:00 UTC (18:00 local time) each day—more visible before April 15 but persisting since. This pattern aligns with Ramadan trends Cloudflare has documented before: it tracks with the Iftar, the first meal after sunset, which in Khartoum occurs at 18:07, and is often shared as a family or community event.
Though traffic has partially recovered in the last couple of days, it remains much lower than before the conflict. As of the latest data, at 08:00 UTC, traffic levels were still ~30% lower than three weeks prior, a finding consistent with reports about continued Internet disruption coming out of Sudan. In Khartoum, where most of the population resides and where the conflict began, traffic was hit especially hard: on April 27, it was around 76% lower than the same weekday before the conflict (April 13).
Shift in Messaging and Social Media Use
Changes in online behavior have also emerged via DNS query patterns to Cloudflare's resolver. Since April 15, there has been a notable shift in messaging service usage: DNS traffic to WhatsApp-related domains has dropped while queries to Signal domains have risen correspondingly, suggesting users are adopting more secure alternatives.
Social media platforms like LinkedIn, TikTok, and YouTube saw clear decreases after April 15. By contrast, Facebook and Twitter usage increased, especially on April 15 and 16, with some disruption (likely due to connectivity issues), but with continued spikes at night—even briefly exceeding pre-conflict patterns—since then.
