ARPA47: 32-Day Zeek Telemetry from a South Asian Residential ISP

Overview:This dataset contains a continuous month of passive network measurement capture (August 26, 2026 – September 26, 2026) obtained from a residential Internet Service Provider (ISP) operating in Chattogram, Bangladesh. The dataset is specifically engineered to analyze the adoption rates and traffic engineering impacts of modern cryptographic protocols, including Transport Layer Security (TLS 1.3), Encrypted Client Hello (ECH), HTTP/3 (QUIC), and Post-Quantum Cryptography (PQC). Methodology & Vantage Point:Unlike most network measurement datasets originating from European or North American university campuses, this dataset provides a unique "Global South" vantage point. Traffic was mirrored via the TaZmen Sniffer Protocol (TZSP) from a production MikroTik Carrier-Grade NAT (CGNAT) core router. The capture targeted a continuous /24 PPPoE pool encompassing 225 active residential subscribers. Dataset Structure: The dataset consists of 31.3 million connections processed by a Zeek network security monitor (v8.0.10 LTS) and serialized into Apache Parquet format for optimized analysis. The data is partitioned across the following archives: conn.zip: TCP/UDP/ICMP volumetric flow metadata, durations, and byte ratios. quic.zip: UDP-based QUIC session logs tracking Server Name Indication (SNI) obfuscation. ssl.zip: TLS handshakes detailing legacy TLS 1.2, TLS 1.3, ECH dummy SNIs (e.g., cloudflare-ech.com), and the adoption of X25519MLKEM768 (PQC). dns.zip: Domain Name System transactions, including HTTPS Resource Records critical for ECH bootstrapping. statistics.zip: Aggregate daily CSV summaries tracking macroscopic network trends. Ethical Compliance & Anonymization:This collection strictly adheres to the ethical principles of the Menlo Report. Deep Packet Inspection (DPI) was disabled, and zero payload data (PCAPs) or application layer communications were captured. All subscriber IPv4 addresses were cryptographically anonymized at the time of capture using a salted, prefix-preserving HMAC-SHA256 (CryptoPan) algorithm. External destination IPs (CDNs, ASNs) remain preserved to facilitate geographic research.