Proposal: Pakistan National Internet Observatory (PNIO)
Bringing Visibility, Accountability & Improvement to Pakistan's Internet
Prepared for: Pakistan Telecommunication Authority (PTA) Prepared by: Server4Sale (S4S) Technologies IT Partner: PASHA (Pakistan Software Houses Association) Contributing ISPs: Multiple ISPs already participating Date: February 2026 Version: 2.0 Status: Live Platform -- Active Data Collection
Executive Summary
Pakistan's internet serves over 130 million broadband subscribers across 19+ ISPs, 6 submarine cable systems, and thousands of domestic and international routes. Despite this scale, there is currently no independent, continuous, evidence-based system that gives PTA visibility into how Pakistan's internet actually performs at the routing level.
PNIO -- the Pakistan National Internet Observatory -- is a fully operational network monitoring platform that changes this. It is already live and collecting data.
What PNIO Does Today
PNIO monitors Pakistan's internet by tracing the actual path that data packets take when travelling to and from Pakistani networks. Using 100+ measurement servers worldwide and 3,600+ monitoring points across 112 countries, the platform continuously traces routes into Pakistan, measuring the distance and time between each network hop. Every trace is enriched with metadata identifying which ISP, which city, and which network each hop belongs to. Anomalies are detected automatically and analysed by AI.
Current data collected:
| Metric | Value |
|---|---|
| Total traceroute measurements | 175,000+ |
| Individual hop records analysed | 2,700,000+ |
| Unique IP addresses enriched | 35,000+ |
| Pakistani target endpoints monitored | 4,688 (banks, media, govt, social, cloud, e-commerce) |
| Measurement servers in use | 100+ VPS nodes worldwide |
| Monitoring vantage points | 3,600+ across 112 countries |
| Pakistani ISPs tracked | 19 |
| Cities with active targets | 8 locations across 3 cities |
| Submarine cables monitored | 6 |
| AI analysis providers | 21 active LLMs |
| Dashboard pages | 55+ interactive views |
| API endpoints | 95+ |
Current Limitations
While the system is operational and producing valuable data, the current accuracy is limited because:
- Most measurement nodes are outside Pakistan. We observe Pakistan's internet from the outside -- tracing routes that enter Pakistan and measuring hop-by-hop performance. This reveals international routing issues, submarine cable problems, and entry point congestion effectively.
- Only 8 target locations across 3 Pakistani cities have active monitoring. Domestic coverage needs significant expansion.
- Data quality is sufficient for investigation but not yet comprehensive. More in-country vantage points will dramatically improve accuracy and enable domestic inter-ISP monitoring.
What We Are Proposing
PTA directs major backbone ISPs -- particularly PTCL, Transworld (TWA), Cybernet, and Multinet -- to contribute lightweight monitoring nodes. These ISPs form Pakistan's internet backbone, and their participation is essential for comprehensive visibility.
Project Sponsorship
This project is already being sponsored by Server4Sale with PASHA as the IT industry partner. Several ISPs are already contributing to the platform. We are seeking PTA's support to expand participation to all major providers.
How PNIO Works
The Measurement Process
1. TRACE: A measurement server (e.g., in Dubai, London, or New York)
sends a traceroute to a Pakistani target (e.g., HBL banking server in Karachi)
2. RECORD: Every router along the path is recorded with its IP address
and the time taken to reach it (latency in milliseconds)
Server (Dubai) -> Router 1 (UAE) -> Router 2 (Submarine cable) ->
Router 3 (PTCL Karachi) -> Router 4 (PTCL internal) -> Target (HBL)
3. ENRICH: Each IP is identified -- which ISP owns it, which city
it is in, which country, what organisation operates it
4. SCORE: Anomaly detection rules check for problems:
- Unexpected route (traffic going through wrong countries)
- Latency spike (one hop taking much longer than expected)
- Packet loss (hops not responding)
- Route manipulation (paths changing unexpectedly)
5. ANALYSE: AI examines high-anomaly traces and produces a forensic
verdict identifying the problem and which ISP is responsible
6. PRESENT: Results appear on the dashboard in real-time with
drill-down to every individual hop
What Gets Measured Between Each Hop
For every single hop in every traceroute, PNIO records:
- Latency (RTT): How many milliseconds does it take to reach this router?
- IP Address: What is the router's public IP?
- ASN / ISP: Which ISP operates this router? (e.g., AS17557 = PTCL)
- City / Country: Where is this router physically located?
- Organisation: What company owns this IP range?
- Network Name: What is the network called? (e.g., "PTCL Backbone", "Nayatel-Islamabad")
- Hop Distance: How much latency was added between this hop and the previous one?
This hop-by-hop measurement is what makes PNIO fundamentally different from speed tests. We don't just know that "the internet is slow" -- we know exactly where it is slow, which ISP is responsible, and how long the problem has persisted.
Comprehensive Dashboard Features
What PTA Can See (Regulatory View)
| Feature | Description |
|---|---|
| ISP Performance Scoreboard | Real-time ranking of all 19 Pakistani ISPs by completion rate, latency, anomaly rate, and route stability |
| ISP Penalty Scoring | Composite penalty score (0--100) per ISP based on weighted performance metrics |
| Boomerang / Trombone Detection | Identifies when domestic Pakistani traffic is unnecessarily routed through other countries (e.g., Karachi-to-Lahore via Dubai), adding 100--200ms of unnecessary latency |
| Anomaly Score System | Every traceroute receives an anomaly score from 0.0 (normal) to 1.0 (critical). Scores above 0.7 trigger investigation. The scoring uses 10+ detection rules covering path integrity, latency spikes, blackholes, route manipulation, and AS boundary anomalies |
| Submarine Cable Monitoring | Tracks 6 cables (SEA-ME-WE-4, SEA-ME-WE-5, IMEWE, AAE-1, TW1, PEACE) with latency correlation and RSS-based event detection |
| International Route Issues | Detects when Pakistan's international connectivity degrades -- which cable, which ISP affected, how severe |
| City-to-City Connectivity Matrix | Real-time latency between all Pakistani cities, broken down by ISP |
| Evidence Dossier System | For enforcement actions: timestamped, SHA-256 hashed traceroute evidence that cannot be fabricated |
| Daily Health Reports | AI-generated narrative summaries of Pakistan's internet health |
| Historical Trend Analysis | Week-over-week, month-over-month ISP performance tracking |
| Real-Time Alerting | Configurable alerts via email, webhook, or Telegram for threshold breaches |
| War Room Dashboard | Full-screen operations view for monitoring during cable cuts or major incidents |
What ISPs Can See (ISP Admin View)
| Feature | Description |
|---|---|
| Their Own Performance | How their network compares to peers on latency, completion rate, and anomaly rate |
| Internal Fault Detection | Identifies latency spikes and packet loss within their own network hops |
| Route Analysis | Visualises their AS paths (Sankey diagrams) showing how traffic flows through their network |
| Chokepoint Identification | Pinpoints specific routers in their network causing congestion |
| Peer Comparison | Side-by-side trace comparison: same destination, same time, different ISP -- isolates who is at fault |
| Entry Point Analysis | Which international routers does their traffic enter Pakistan through? Is there redundancy? |
| City Coverage | Which cities are well-served by their network and which are underperforming? |
| Improvement Tracking | Historical data showing whether their fixes actually improved performance |
What the Public Can See (Citizen View)
| Feature | Description |
|---|---|
| Pakistan Internet Health Overview | Is the internet healthy today? Simple colour-coded map |
| ISP Leaderboard | Which ISP is performing best right now? Public transparency |
| Ask PNIO | Natural language query -- ask questions like "Is PTCL having issues in Karachi?" and get AI-powered answers with evidence |
| Live Feed | Real-time stream of traceroutes being collected (WebSocket) |
| City Performance | How is internet quality in my city compared to others? |
| Global Status | City-to-city ping matrix showing connectivity between Pakistani cities |
| Daily Reports | AI-generated daily summary of Pakistan's internet health |
| Data Export | Public API with API key for researchers and journalists (JSON/CSV export) |
How the Anomaly Score Works
Every traceroute is scored from 0.0 (completely normal) to 1.0 (critical anomaly) using these detection rules:
| Rule | Weight | What It Detects |
|---|---|---|
| Latency Spike | High | A single hop adding >100ms unexpectedly |
| Boomerang / Trombone | High | Domestic traffic leaving Pakistan and returning |
| Blackhole | High | 3+ consecutive hops with no response (traffic being dropped) |
| Path Length Anomaly | Medium | Significantly more hops than expected for this route |
| AS Boundary Spike | Medium | Large latency increase when crossing from one ISP to another |
| Country Detour | Medium | Traffic passing through unexpected countries |
| Route Flap | Medium | AS path changing frequently (BGP instability) |
| Incomplete Trace | Low | Trace failing to reach the destination |
| High Base Latency | Low | Overall RTT significantly above baseline for this route |
| Timeout Ratio | Low | High percentage of hops not responding |
Scoring levels:
- 0.0 -- 0.3: Normal -- no action required
- 0.3 -- 0.5: Review -- minor anomaly detected, logged for pattern analysis
- 0.5 -- 0.7: Warning -- significant anomaly, AI analysis triggered
- 0.7 -- 1.0: Critical -- major issue detected, alert generated, full investigation
What PNIO Can Identify
1. Boomerang Routing (Trombone Detection)
The Problem: Pakistani domestic traffic (e.g., a user in Karachi accessing a server in Lahore) is unnecessarily routed through Dubai, Singapore, or Europe before returning to Pakistan. This adds 100--200ms of unnecessary latency and wastes international bandwidth capacity.
How PNIO Catches It: Every traceroute records the full hop-by-hop path with country identification for each router. When a Karachi-to-Lahore trace shows hops in UAE (AS5384) or Singapore (AS13335), PNIO flags it as a boomerang with:
- The exact hop where traffic exits Pakistan
- The countries it transits through
- The exact hop where it re-enters Pakistan
- The latency penalty caused by the detour
- Which ISP's routing decision caused the boomerang
2. ISP Internal Network Faults
The Problem: An ISP has a congested or faulty internal router causing packet loss or latency spikes for all traffic passing through it.
How PNIO Catches It: By comparing traces to the same destination from multiple ISPs simultaneously. If PTCL traces show 200ms at hop 4 (PTCL's own router) while Nayatel traces to the same target show 30ms, the fault is isolated to PTCL's internal network with specific router identification.
3. International Route Degradation
The Problem: When submarine cables develop faults, or international peering degrades, some ISPs are affected more than others depending on their routing configuration and cable diversity.
How PNIO Catches It: Continuous monitoring of latency to international destinations (Dubai, Singapore, London, Frankfurt, New York). When RTTs to European destinations spike across multiple ISPs simultaneously, PNIO correlates this with submarine cable events and identifies:
- Which cable is likely affected
- Which ISPs are impacted and by how much
- Which ISPs have resilient multi-cable routing vs single-cable dependency
- Recovery timeline tracking
4. Selective Service Degradation
The Problem: An ISP throttles or degrades traffic to specific services (e.g., VoIP, streaming, or specific websites).
How PNIO Catches It: By tracing to diverse target categories:
- Banking: HBL, Meezan, JazzCash, Easypaisa
- Social Media: WhatsApp, TikTok, Instagram, Facebook
- Media: Geo, Dawn, ARY, Express
- E-commerce: Daraz, Amazon
- Government: NADRA, FBR, PTA itself
- Cloud/Dev: GitHub, Teams, Azure, AWS
- Middle East: absher.sa, etisalat.ae (for diaspora route quality)
When one category performs significantly worse than others on the same ISP, selective degradation is identified with evidence.
5. BGP Route Instability
The Problem: Frequent AS path changes (route flaps) indicate misconfigured or unstable routing that causes intermittent connectivity issues.
How PNIO Catches It: By tracking the AS path sequence for every trace to the same destination over time. Path changes are recorded with before/after comparison, frequency analysis, and impact on latency.
6. Backbone Congestion Points
The Problem: Specific routers in Pakistan's backbone infrastructure become congestion points, affecting traffic for multiple ISPs.
How PNIO Catches It: The chokepoint analysis aggregates hop data across all traces and identifies IP addresses that consistently show high latency or packet loss. These are displayed on the Chokepoints page with:
- Router IP and owning ISP
- Number of traces affected
- Average latency spike caused
- Time-of-day patterns (peak hour congestion)
7. Entry Point Concentration Risk
The Problem: Pakistan's international traffic enters through a limited number of routers. If these fail, large portions of the internet become unreachable.
How PNIO Catches It: The Entry Points page maps every international router where traffic enters Pakistan, showing:
- Which ISPs operate these entry points
- How much traffic depends on each one
- Redundancy analysis (single point of failure risk)
- Geographic distribution of entry points
The Goal: Improvement & Visibility for Pakistan
PNIO's purpose is not punitive -- it is to bring measurable improvement to Pakistan's internet infrastructure. The platform enables:
For PTA
- Evidence-based regulation instead of complaint-driven reaction
- Objective ISP comparison that ISPs cannot dispute (the data is independently collected and cryptographically timestamped)
- Early warning for infrastructure issues before they become public complaints
- Progress tracking -- when PTA directs an ISP to improve, the improvement (or lack thereof) is objectively measurable
- International benchmarking -- how does Pakistan's internet quality compare to regional peers?
For ISPs
- Visibility into their own blind spots -- faults they may not be aware of
- Competitive motivation -- public leaderboard creates healthy competition
- Evidence for investment -- data to justify infrastructure upgrades to their boards
- Peer collaboration -- identifying inter-ISP peering issues that require bilateral fixes
For Pakistan
- Digital economy enablement -- reliable internet is the foundation of e-commerce, fintech, and IT exports
- Consumer protection -- citizens deserve to know the quality of service they are paying for
- International reputation -- demonstrating that Pakistan takes internet quality seriously attracts investment
- Infrastructure planning -- data-driven decisions about where to invest in new capacity
What We Need: In-Country Monitoring Nodes
The Gap
Currently, PNIO monitors Pakistan from the outside -- 100+ servers worldwide trace routes into Pakistan. This is effective for detecting international routing issues, submarine cable problems, and entry point congestion.
What we cannot fully see today:
- Domestic inter-city latency as experienced by actual users
- ISP-to-ISP peering quality within Pakistan
- Last-mile performance from ISP edge routers to endpoints
- Regional network quality in underserved areas (Balochistan, KPK, rural areas)
What Each ISP / Data Centre Provides
| Requirement | Specification |
|---|---|
| VPS instances | 2--3 per ISP/DC location |
| CPU | 1 core (minimal requirement) |
| RAM | 2 GB |
| Disk | 10 GB |
| Network | Standard internet access |
| Bandwidth | < 1 GB/month (traceroutes are tiny packets) |
| Data collected | ICMP/TCP traceroutes only -- no subscriber data, no DPI, no traffic capture |
| Effort | Provision VPS, provide SSH access for initial setup. Automated thereafter. |
Priority Backbone Providers
The following ISPs form Pakistan's internet backbone and their participation is critical:
| Provider | Role | Why Critical |
|---|---|---|
| PTCL (AS17557) | Incumbent, largest backbone | Carries the majority of Pakistan's domestic and international traffic. N-5 highway fibre corridor operator. |
| Transworld (TWA) (AS38193) | Major backbone, TW1 cable operator | Operates the TW1 submarine cable (Karachi-Fujairah), critical international link. |
| Cybernet (AS9541) | Backbone provider | Major transit provider for other ISPs. |
| Multinet (AS17911) | Backbone provider | Significant transit and enterprise connectivity. |
| Nayatel | Fibre ISP (Islamabad/Rawalpindi/Faisalabad) | Best fibre coverage in twin cities. |
| Jazz (AS45669) | Mobile + fixed broadband | Largest mobile operator, growing fixed broadband. |
| StormFiber | Fibre ISP (Karachi/Lahore) | Growing urban fibre network. |
| NTC | Government backbone | Serves government institutions nationwide. |
Proposed City Coverage
| City | Province | Importance | Proposed Nodes |
|---|---|---|---|
| Karachi | Sindh | Submarine cable landing station, financial hub, largest city | 6--8 |
| Lahore | Punjab | Second largest city, IT hub | 6--8 |
| Islamabad/Rawalpindi | ICT/Punjab | Capital, government services, IT corridor | 6--8 |
| Faisalabad | Punjab | Industrial hub, growing connectivity | 3--4 |
| Peshawar | KPK | Provincial capital, CPEC connectivity | 3--4 |
| Quetta | Balochistan | Provincial capital, underserved region | 2--3 |
| Multan | Punjab | Southern Punjab hub | 2--3 |
| Hyderabad | Sindh | Second Sindh city | 2--3 |
| Sialkot | Punjab | Export industry hub | 1--2 |
| Gwadar | Balochistan | PEACE cable landing, CPEC port | 1--2 |
| Total | 32--45 nodes |
What In-Country Nodes Enable
| Capability | Without In-Country | With In-Country |
|---|---|---|
| International route monitoring | Full visibility | Full visibility |
| Submarine cable health | Full visibility | Full visibility |
| Domestic inter-city latency | Estimated only | Direct measurement |
| ISP-to-ISP peering quality | Cannot measure | Full visibility |
| Last-mile performance | Cannot measure | Direct measurement |
| Balochistan/KPK coverage | Minimal | Direct measurement |
| ISP internal routing quality | Partial (from outside) | Complete visibility |
| Data accuracy | Good for investigation | Comprehensive evidence |
Expected Domestic Baselines
| Route | Expected RTT | Max Acceptable | Beyond This = Problem |
|---|---|---|---|
| Islamabad -- Rawalpindi | 1--3 ms | 8 ms | ISP internal fault |
| Islamabad -- Lahore | 8--15 ms | 35 ms | Backbone congestion |
| Karachi -- Hyderabad | 4--8 ms | 20 ms | Regional link issue |
| Karachi -- Lahore | 22--35 ms | 80 ms | Backbone or boomerang |
| Karachi -- Islamabad | 25--40 ms | 90 ms | Major backbone issue |
| Islamabad -- Peshawar | 5--12 ms | 30 ms | KPK link quality |
| Karachi -- Quetta | 20--35 ms | 80 ms | Balochistan link quality |
| Lahore -- Faisalabad | 5--10 ms | 25 ms | Punjab backbone quality |
Live Demo Available
A live demonstration of the platform is available with real data being collected in real-time:
Demo Access
| URL | |
|---|---|
| Live Platform | https://pnio.s4s.host |
| Backup Instance | https://pmiobackup.hkru2.s4s.host |
| Proposal Document | https://pmiobackup.hkru2.s4s.host/proposal |
What You Will See in the Demo
- Dashboard -- Pakistan health map with city markers, live metrics, health score
- Live Feed -- Real-time WebSocket stream of traceroutes being collected right now
- ISP Leaderboard -- Performance ranking of all tracked Pakistani ISPs
- Sankey Diagram -- Visual AS path flows showing how traffic routes through Pakistan
- Anomaly Detection -- High-anomaly traces with AI forensic verdicts
- Trace Detail -- Drill into any single traceroute to see every hop with latency bars, ISP attribution, and issue highlighting
- War Room -- Full-screen operations dashboard for real-time monitoring
- Ask PNIO -- Natural language query interface: ask questions in plain English
- Submarine Cables -- Monitor all 6 cables serving Pakistan with latency correlation
- City Matrix -- City-to-city connectivity grid
- ISP Detail Pages -- Deep-dive into any ISP's performance, cities, routes, and faults
- Daily Reports -- AI-generated narrative summaries of internet health
The live feed demonstrates data actively flowing into the system from measurement points worldwide. The platform is under continuous development with improvements being made regularly.
Technical Architecture Summary
| Component | Details |
|---|---|
| Backend | FastAPI (Python), 95+ API endpoints, 12 router modules |
| Frontend | Next.js (React/TypeScript), 55+ pages, dark theme, mobile responsive |
| Database | PostgreSQL + TimescaleDB (time-series optimised) |
| AI Engine | 21 LLM providers with automatic fallback for forensic analysis |
| Anomaly Detection | 10+ rule-based detectors, scored 0.0--1.0, applied at ingest time |
| Authentication | JWT with role-based access: Citizen, ISP Admin, PTA Admin, System Admin |
| Real-Time | WebSocket live feed with PostgreSQL NOTIFY triggers |
| Alerting | Email, webhook, Telegram notification channels |
| Public API | Rate-limited, API key authenticated, JSON/CSV export |
| Measurement Infrastructure | 100+ VPS servers, 3,600+ vantage points, 112 countries |
| Backup & Redundancy | PostgreSQL streaming replication to offsite server, automated snapshots |
Privacy & Security
What PNIO Does NOT Do
- No subscriber data is collected. Only public infrastructure IPs (routers, servers) are recorded.
- No Deep Packet Inspection. Only standard ICMP/TCP traceroute -- a basic network diagnostic tool.
- No traffic interception. Measurement nodes generate outbound traceroutes only. They do not sit in the data path.
- No private information. All data collected is about public internet infrastructure, not individuals.
Security Measures
- All communication encrypted via HTTPS with TLS certificates
- Bearer token authentication for collector nodes
- SHA-256 integrity hashes on every measurement (tamper-proof evidence)
- Role-based access control with JWT authentication
- SQL injection prevention via parameterised queries throughout
- Rate limiting on all API endpoints
Cost & Sustainability
Current Infrastructure
| Item | Monthly Cost |
|---|---|
| Primary server (OVH VPS, France) | ~$50 |
| Backup server (Hetzner, EU) | ~$25 |
| IP enrichment service (ip-api.com PRO) | $13 |
| AI analysis (free-tier LLM providers) | $0--50 |
| Domain & TLS certificates (Let's Encrypt) | $0 |
| Total platform operating cost | ~$90/month |
In-Country Node Cost
| Item | Cost |
|---|---|
| VPS provided by ISP/DC | $0 (ISP contribution) |
| Software (open-source Python agent) | $0 |
| Bandwidth (< 1 GB/month) | $0 (negligible) |
Total incremental cost for 40 in-country nodes: $0 -- ISPs provide the VPS as their contribution to improving Pakistan's internet visibility.
Sponsorship
- Server4Sale is sponsoring the platform development and central infrastructure
- PASHA is the IT industry partner
- Multiple ISPs are already contributing measurement resources
- The platform is designed to be self-sustaining at minimal cost
Implementation Roadmap
| Phase | Timeline | Milestone |
|---|---|---|
| Phase 1: Live Demo | Immediate | Platform demonstration for PTA decision-makers |
| Phase 2: PTA Dashboard | 2--4 weeks | Dedicated regulatory views, penalty scoring, evidence export |
| Phase 3: Backbone ISP Nodes | 4--8 weeks | PTCL, TWA, Cybernet, Multinet deploy nodes in Karachi, Lahore, Islamabad |
| Phase 4: Consumer ISP Nodes | 6--10 weeks | Jazz, Nayatel, StormFiber, Telenor deploy nodes |
| Phase 5: City Expansion | 8--14 weeks | Faisalabad, Peshawar, Multan, Hyderabad, Quetta, Sialkot |
| Phase 6: Full Coverage | 14--20 weeks | Gwadar (PEACE cable), remaining cities, 40+ nodes operational |
| Phase 7: Operational Maturity | 20--24 weeks | PTA staff training, SLA integration, automated compliance reporting |
Call to Action
We request PTA to:
- View the live platform at https://pnio.s4s.host (real data, real-time collection)
- Schedule a demonstration for PTA leadership and technical teams
- Direct backbone ISPs (PTCL, Transworld, Cybernet, Multinet) to provision 2--3 VPS nodes each in their Karachi, Lahore, and Islamabad data centres
- Encourage all licensed ISPs to participate by contributing monitoring nodes
- Define PTA-specific requirements for the dedicated regulatory dashboard
Pakistan deserves world-class internet monitoring. The technology is built. The data is flowing. The investment required is minimal. What is needed now is PTA's leadership to bring every major ISP to the table.
PNIO -- Pakistan National Internet Observatory Monitoring Pakistan's Internet Integrity at Layer 3 Sponsored by Server4Sale | IT Partner: PASHA
Live Platform: https://pnio.s4s.host Proposal: https://pmiobackup.hkru2.s4s.host/proposal