What Cloudflare Radar shows about Turkmenistan’s mid-2024 unblocking
Cloudflare generally works with live data, but there are times when the past offers more insight than the present. A turkmen.news report from 2024 described what it called “an unprecedented easing in blocking” in Turkmenistan, making over 3 billion previously blocked IP addresses reachable. The same report suggested the unblocking may have coincided with the testing of a new national firewall.
Cloudflare Radar confirms that request traffic from Turkmenistan did jump in mid-June 2024, consistent with those reports. But Radar’s data on TCP connection resets and timeouts offers a second, independent view: ungraceful connection terminations also shifted around the same period in ways that could reflect firewall behaviour.
Requests from Turkmenistan rise after mid-June
If IP blocks were lifted, an increase in HTTP requests would be expected. That is exactly what Cloudflare observed starting in mid-June 2024, when traffic from Turkmenistan began to climb.
TCP resets and timeouts: what they indicate
TCP carries roughly 70% of HTTP traffic to Cloudflare, and its connection lifecycle follows defined conventions for graceful closure. Resets and timeouts are the ungraceful exceptions—they terminate connections abruptly. Some such terminations are tied to software design or user behaviour, but they can also be caused by third-party interference: school or enterprise firewalls, mobile zero-rating systems, or state-level filtering.
Radar’s reset and timeout data for Turkmenistan shows a combined increase in these ungraceful closures starting on June 13, 2024. The breakdown by connection stage also changed, meaning the relative mix of where in the connection lifetime terminations occur shifted as well.
Over the following weeks, the profile continued to evolve. A rise in Post-PSH (orange) anomalies became visible from about July 4; Post-ACK (light blue) anomalies declined around July 13; and anomalies later in the connection (green) increased starting July 22.
These shifts would be consistent with a large-scale firewall in operation. Individually, browser implementations or user actions could produce such signals at any one stage, but reproducing the observed magnitudes would require a great many users or browsers behaving identically at the same time.
Network-level differences
Looking at individual autonomous systems (ASes) within Turkmenistan can reveal patterns that are otherwise masked. The country-wide trends closely align with those of AS20661 (TurkmenTelecom), unsurprising given its role as a major carrier for Turkmenistan’s traffic to Cloudflare. The data for TurkmenTelecom shows an notable reduction in Post-ACK anomalies starting around July 26.
AS51495 (Ashgabat City Telephone Network) tells a different story. Post-ACK anomalies there nearly disappear on July 12, while Post-PSH anomalies concurrently increase. The same AS also shows a rise in later-stage (green) connection anomalies on July 22.
For AS59974 (Altyn Asyr), there is a clear jump in Post-ACK anomalies starting July 22. This is the connection stage in which an intermediary that has read the Server Name Indication (SNI) — effectively the domain name — can drop the packets before they ever reach Cloudflare’s servers.
Reading connection anomalies with caution
Reset and timeout proportions are informative only when checked against other measurements. Radar’s visualizations show share of total traffic, so an increased proportion of anomalies could result from either more anomalous connections or a drop in legitimate traffic.
The AS59974 case makes this point. Post-ACK anomalies rose sharply on July 22, but HTTP request volume to that same AS fell just as sharply on the same date, as shown below.
Prior to July 22, reset and timeout figures for AS59974 did not track the large swings in request counts.
Older data, earlier signals
What Radar recorded mid-2024 does not prove that Turkmenistan was testing a new firewall. But taken together, the reset, timeout, and request data are consistent with such a scenario. They can also serve as a reminder that historical data is useful for context when interpreting current or breaking events.
Consider the period before the purported unblocking. Radar data for October and November 2023 shows signals from Turkmenistan were already changing well before the turkmen.news report prompted this retrospective look.
The resets and timeouts dashboard on Cloudflare Radar is among the few operator-side views of TCP connection tampering. Beyond that, Cloudflare has published the methodology behind its tampering detection and logging, allowing others to build comparable observability on their own infrastructure.
