North Korea: The Ping That Never Returns

Two articles ago, writing about Turkmenistan, we promised you North Korea. Last week, writing about the Caspian cable, we promised it again. We said traceroutes run toward North Korea and do not find a path at all. On 23 April 2026 we put that sentence to the test.

We fired fifteen RIPE Atlas probes across three continents — our own infrastructure in Minsk, Almaty, Tbilisi, and Jerusalem, two probes inside China, two inside Russia, two in South Korea, two in Japan, and one each in the United States, Germany, and Singapore — at four targets inside North Korea: the news agency KCNA, the public portal naenara.com.kp, a secondary IP in the country's second announced block, and a probe IP in a third block that is not used for public services. Four targets, fifteen probes, sixty ping attempts. Zero responded.

And yet the North Korean government's website opens in any browser on Earth. This article is about the distance between those two facts.

The Smallest National Internet

The entire globally routable IPv4 footprint of the Democratic People's Republic of Korea is four /24 blocks — 175.45.176.0/24 through 175.45.179.0/24. Four times 256 is 1,024 addresses. That is the international internet of a country of roughly 26 million people. One IP address per twenty-five thousand citizens.

Those four prefixes are announced by exactly one autonomous system, AS131279, STAR-KP, registered to an office in Ryugyong-dong, in Pyongyang's Potong-gang District. Star Joint Venture Co. was incorporated in 2008 as a partnership between the DPRK Ministry of Post and Telecommunications and Loxley Pacific, a Thai telecommunications company. On 21 December 2009, Star JV took over every international IP allocation that North Korea has. It has not, in the fifteen years since, delegated any of it anywhere else.

For contrast, the country we wrote about three weeks ago — Turkmenistan, also structurally one of the most closed internet topologies in the world — announces twenty-four IPv4 prefixes. Most small countries announce hundreds. Medium-sized countries, thousands. North Korea announces four.

Two Doors, Not Three

Those four /24s reach the rest of the world through three international transit relationships, of which only two are live:

Between those three, public routing tables show the country splitting its prefixes: the original block, 175.45.176.0/24, is reachable primarily via China Unicom; 175.45.177.0/24 has been routed primarily via TransTeleCom since its 2017 activation. The other two blocks, 175.45.178 and 175.45.179, appear under one or the other depending on BGP view.

That this matters less than it sounds is the next part.

The Ping That Never Comes Back

On 23 April 2026, at 16:24 UTC, we fired four simultaneous ICMP ping measurements — one to each of the four target IPs — from the fifteen probes listed above. All four measurements returned within seven minutes. Every single one of the sixty individual ping results looks identical:

From every vantage point we tested — including two probes inside China, the country that carries most of North Korea's outbound traffic — not one ICMP echo to any of the four KP prefixes was answered. Packet loss was not partial. It was total.

The Wall Inside China Unicom

The traceroutes that ran at the same time tell a more interesting story. They do not reach North Korea either — but the way they fail is not uniform.

For most of the fifteen probes, traceroute hop replies stop completely somewhere inside the transit operator's backbone, producing a trailing wall of stars: "* * * * *". But a handful of traces — one from a Chinese probe in Beijing, one from a Singaporean probe, one from a German probe — get one step further. In each case the last visible reply comes from the same IP address:

103.35.255.254

That address is not North Korean. It is in the range 103.35.252.0/22, registered in a WHOIS record to CENBONGT-HK, at a fourth-floor address in Mong Kok, Kowloon, Hong Kong. In the RIPE routing tables, 103.35.255.0/24 is not announced at all: zero of 331 RIPE RIS peer sessions see a route for it. The address responds to TTL-expired ICMP, but it is not itself a destination. It is a transit interface — specifically, a node inside China Unicom's network that sits, for all practical purposes, between China and North Korea. "Cenbong" is the name used in the literature for the Chinese automatic re-router that decides whether a DPRK-bound packet is handed to China Unicom's Pyongyang-facing interface or pushed back into the global routing table as unreachable.

From our own server in the Netherlands, we ran a TCP traceroute to port 80 on kcna.kp. The path is specific:

The packet does reach North Korea. But only the TCP SYN is forwarded through hops 14, 15, and 16 — the ICMP TTL-expired responses that a normal traceroute relies on are dropped, either by Cenbong, by an intermediate filter, or at the Star JV edge itself. For anyone using standard ping or traceroute to probe the country, the last thing they ever see is that address in Hong Kong.

Why HTTP Works Anyway

From the same Dutch server, a plain HTTP request to each of the three publicly-addressed KP IPs returns a clean HTTP 200 response in well under a second:

North Korea wants you to be able to read its news. That is the entire point of the country's thin slice of the global internet. The government's foreign-language propaganda outlets, the KCNA news wire, the Rodong Sinmun state newspaper, the Naenara portal — all of it is served on these 1,024 IP addresses, and all of it is deliberately open to TCP traffic from the outside world. What is not open is ICMP. Ping and traceroute, the two tools every network engineer reaches for first, are not a threat vector the DPRK wants you to have working against its infrastructure. So the stack accepts 80/tcp and silently discards 1/icmp.

The fourth prefix, 175.45.178.0/24, doesn't serve anything on port 80 either. From the routing tables, it exists and is announced. From the network, it is as silent as the /178 block immediately adjacent. These are the addresses Star JV holds in reserve — for internal government systems, for future allocation, for nothing at all. We do not know. Nobody outside the building we can't reach does.

The Intranet Everyone Actually Uses

The framing of this piece — and the previous two — has implicitly been that the internet of a country is its international connectivity. For most places, that is true. For North Korea, it is misleading. By every plausible estimate, the vast majority of North Korean internet users are not on the internet at all. They are on Kwangmyong, the national intranet — a completely separate IP network, unreachable from outside, that carries domestic government sites, university resources, and a state-curated slice of the outside web mirrored by hand. The 1,024 addresses you can reach from outside are the government's window facing outward. The window facing inward is to a different country.

This is a genuine double-internet, and it is not widely replicated elsewhere. Iran operates a national intranet (NIN) that is partially, imperfectly separated from the global internet. China's domestic-only hosts are mostly reachable globally but heavily filtered at the GFW. No one else has gone quite as far as Pyongyang.

The Probe Graveyard, Again

Three weeks ago we noted that Turkmenistan had hosted, in the history of the RIPE Atlas measurement network, five probes — all of them Abandoned, offline long enough to be presumed gone. For North Korea the number is smaller still:

One probe. Probe ID 1011805. Country code KP. Status: Disconnected. Address: none recorded. We do not know which ASN it briefly lived on, which building, or who plugged it in. We know only that it was, and then it was not.

No other RIPE Atlas probe has ever been hosted in North Korea. Not one has been installed since. There is no one measuring this country from the inside.

Try It Yourself

The eight measurement IDs we ran on 23 April 2026 are public and can be retrieved from the RIPE Atlas API at any time: 167145509, 167145510, 167145511, 167145512, 167145513, 167145514, 167145515, 167145516. Rerun any of them and you will get the same result: no ICMP replies, walls of stars, and if you look carefully at the traces that get furthest, the same Hong Kong-registered address as the last thing anyone sees.

Then, from any shell anywhere, try curl http://175.45.176.71/. You will get a response. If you know the Korean for "workers' daily," you can read the news. The packets go through. You just cannot watch them get there.

The End of the Series

This is the third and final piece in a series that began with Turkmenistan, a country routing around the physical world, and continued with Azerbaijan and Kazakhstan, a region routing with the physical world once a cable goes down. North Korea ends the series with a question neither of the first two could raise: what does it mean for a country's "internet" to be reachable for only certain protocols, from only certain origins, for only certain reasons?

The usual framing of internet freedom indices is censorship — what citizens inside a country can and cannot see. That framing is useful but incomplete. The view from outside, measured with the oldest tools the network has, says something additional: there is no symmetry. A country that will not let its users reach the world is a country whose network you cannot probe either. The outward-facing wall and the inward-facing wall are the same wall, and it does not open for ICMP from any direction.

We started by asking what happens when a country's international internet is constrained — by terrain, by policy, by geopolitics. Turkmenistan showed us a country that had accepted this shape. Azerbaijan and Kazakhstan showed us a region pouring cable into the seabed to escape it. North Korea shows us what the limit case looks like. The limit case is a ping request that never comes home.