Starlink vs Iran: A technical analysis of blocking and countermeasures in cyberwarfare

By Kike Gandia · Defense & Geopolitics · 5 min read

Iran uses a multilayered strategy to block Starlink that combines control of terrestrial infrastructure, deep packet inspection and physical import restrictions. The last of these is the most effective, because satellite links inherently bypass traditional censorship infrastructure. SpaceX has shown it can respond quickly with software updates that neutralize jamming attempts, as it did in Ukraine, where it rolled out countermeasures in under 24 hours.

The key context is September 2022: after Mahsa Amini died in police custody, Iran imposed severe internet restrictions during the protests that followed. Elon Musk announced that Starlink was being activated for Iran, and the US Treasury Department (OFAC) issued a general license authorizing internet services. Technical and regulatory barriers, however, have sharply limited actual deployment.

2-4: international gateway points controlled by Iran's TIC
60×: stronger Starlink's LEO signal is than a GEO satellite's
5,000+: operational satellites in the constellation
<24 h: to roll out software-based anti-jamming countermeasures (demonstrated in Ukraine)

The asymmetry of the problem, in four figures taken from the article itself.

Iran's internet control architecture

The backbone of Iranian control is the National Information Network (NIN/SHOMA), a domestic intranet designed to route internal traffic without international transit and to allow rapid isolation from the global internet during unrest. The Telecommunication Infrastructure Company (TIC) controls roughly 2-4 international gateway points, which act as natural chokepoints for inspection, throttling and total shutdowns.

This centralized architecture lets Iran implement:

Mandatory routing of traffic through government checkpoints
Domestic DNS infrastructure separate from the global DNS
The ability to impose a complete shutdown within hours

Against Starlink specifically, this architecture falls short: direct satellite links bypass the terrestrial gateways, which forces Iran to rely on alternative methods such as RF detection of terminals and import controls.

Deep packet inspection (DPI) systems

Iran has deployed DPI technology from multiple vendors. Documented reports point to Huawei and ZTE (China) equipment for network infrastructure, historical involvement by Nokia Siemens Networks (pre-2009) in monitoring centers, and significant homegrown capabilities.

Its DPI capabilities include protocol fingerprinting to identify VPNs (OpenVPN, WireGuard, Tor), SNI filtering to block specific domains using TLS metadata, traffic pattern analysis, and bandwidth detection to throttle connections that look like satellite links.

To identify Starlink traffic, DPI systems would need to detect specific packet patterns and signatures, terminal registration/authentication traffic, characteristic latency patterns (20-40 ms for LEO satellites), and traffic flows consistent with satellite uplinks. Starlink's end-to-end encryption, however, makes content inspection considerably harder.

DNS blocking and BGP manipulation

Iran uses several DNS manipulation techniques: DNS poisoning (returning fake IP addresses), DNS injection (intercepting queries), a mandatory national DNS, and blocking of DoH (DNS over HTTPS) servers.

For Starlink, this affects connectivity to SpaceX infrastructure for terminal activation, firmware updates and account management. Iran can block DNS resolution for starlink.com domains, SpaceX API endpoints and ground station coordination servers.

BGP (Border Gateway Protocol) manipulation enables null-routing of traffic to specific IP ranges, redirection through inspection points, and blocking of entire AS numbers associated with Starlink infrastructure.

The SIAM surveillance system and RF detection

The reported SIAM system (an integrated analysis and monitoring system) provides real-time monitoring of user activity, cross-referencing of communications data, and integration with telecommunications infrastructure.

Starlink-specific detection methods include RF spectrum monitoring for satellite uplink transmissions (Ku band, 12-18 GHz), analysis of power consumption in areas with suspected terminals, import/customs tracking, and social media monitoring for Starlink-related discussions. This RF triangulation capability is one of the most serious threats facing Iranian users.

SpaceX's technical countermeasures

Starlink builds in several layers of resilience against interference:

Antenna Phased arrays: Terminals use flat arrays with no moving parts that can steer beams electronically, create "nulls" to reject interference from specific directions, maintain links with multiple satellites at once and adapt the beam pattern to maximize the signal-to-noise ratio.
Orbit The LEO advantage: At an altitude of 550 km (versus 35,786 km for GEO satellites), Starlink delivers signals roughly 60 times stronger, which demands proportionally more jamming power. Each satellite stays overhead for only 4-8 minutes, forcing jammers to retarget constantly.
Scale A massive constellation: With 5,000+ operational satellites, the redundancy is extraordinary. Inter-satellite laser links (V2 satellites) let traffic be routed around terrestrial interference by hopping between satellites.

The three layers of resilience that let Starlink absorb interference.

Software updates as a dynamic defense

SpaceX's over-the-air update capability has proved crucial. In March 2022, Musk stated publicly: "Some Starlink terminals near conflict areas were being jammed for several hours at a time. Our latest software update bypasses the jamming." Gwynne Shotwell confirmed that SpaceX had countered Russian jamming attempts with software updates, and Pentagon officials praised Starlink's resilience and rapid adaptation to electronic warfare threats.

This continuous update cycle allows countermeasures to be rolled out in under 24 hours from the detection of new interference patterns, with no user action required.

Security risks for Iranian users

Starlink users in Iran face several risk vectors:

Detection Triangulated RF emissions: The terminals' RF emissions can be triangulated by surveillance teams.
Supply The terminal leaves a trail: Terminals have to be smuggled in, which creates a paper trail.
Legal Possession is a crime: Possessing the equipment is a criminal offense carrying severe penalties.
Network One arrest exposes the network: A single arrest can expose entire distribution networks.

The four risk vectors facing anyone who uses Starlink in Iran.

What actually works. The combination of physical import controls and RF detection is Iran's most effective weapon against Starlink, because neither method depends on the internet infrastructure that Starlink bypasses.

How effective each Iranian method is

Method	Effectiveness against Starlink	Reason
Import controls	High	Shortage of terminals
RF monitoring	High	Active detection of emissions
Legal deterrence	High	Intimidation effect
Blocking activation/authentication	Moderate	Affects initial setup
DPI	Limited	Encrypted traffic
Gateway control	Low	Satellite bypasses the infrastructure

International and human rights implications

Iran's blocking of Starlink exposes a tension between enforcing sanctions and enabling communication tools. Article 19 of the ICCPR protects the freedom to seek and receive information, and UN Human Rights Council resolutions (2012, 2016) affirmed internet access as a human right.

Organizations such as Access Now, OONI, NetBlocks and Freedom House have extensively documented Iranian censorship. Freedom House consistently rates Iran as "Not Free" in its annual Freedom on the Net reports.

The central technical paradox

Iran's fundamental challenge is that Starlink's satellite-to-ground link inherently bypasses terrestrial internet infrastructure, so traditional network-level filtering becomes far less effective once a terminal is up and running. That forces Iran to rely on pre-operational methods (import controls) and physical detection (RF monitoring), areas where it holds significant advantages but which demand resource-intensive surveillance.

SpaceX has shown that combining architectural resilience (a massive LEO constellation, redundancy, laser links) with software agility (rapid over-the-air updates) makes Starlink one of the most jamming-resistant commercial satellite systems ever deployed. Even so, the scarcity of physical terminals in Iran remains the main bottleneck to access, and it is the most significant success of Iran's blocking strategy.

Related service

Threat intelligence and analysis

Keep reading

Talk to the team