Insights into an Iranian Internet Shutdown

This repository contains the PCAP measurements as described in the paper “Insights into an Iranian Internet Shutdown”

The measurements directly relate to Table 1 in the paper.

PCAPS

How to interpret PCAP files

• 3 major scans: Scan 1–3
• Scan 1: three scan executions of 9000 domains of Tranco top 100k list
• Scan 2: one scan execution of 9000 domains of Traco top 100k list
• Scan 3: two scan executions of 9000 domains of Tranco top 100k list

Each execution of a scan includes 5 tries per domain and protocol.

For anonymization purposes, we changed the IP addresses of our vantage points:

10.10.10.1: Control vantage point outside Iran 10.10.10.2: Vantage point in Iran

Notably, Scan 2 does not contain measurement results for domain 3501–4500 due to the shutdown occured during their evaluation.

Explanation of File Names

Scan[1-3]_<run>_<index>_<scan_date>.pcap

• run indicates from which scan execution the file is recorded
• index describes last scanned domain captured in the pcap
• in Scan1 every PCAP file contains traces of 2000 scanned domains (e.g., Scan1_1_4000_2025-06-01 11:10.pcap contains traces of the scans of the domains 2001 to 4000 in first run of Scan 1)
• the range of scanned domains per pcap file differs in Scan1 and Scan3 -> implicitly given by index of previous file
• the first domain scanned in the pcaps is thus index of previous file plus one
• date and time at the end of the file names descibes the start time of the scan, i.e., the capture time of the first packet in the pcap file