Measurement dataset for a security and resilience assessment of Syrian internet infrastructure (2026)

Release artifacts for a security and resilience assessment of Syria's national internet infrastructure, covering seven autonomous systems and 1,230,080 unique IPv4 addresses, built entirely on measurements that existing platforms collected for their own purposes (RIPEstat, crt.sh, RIPE Atlas, IODA, OONI, Cloudflare Radar, Shodan InternetDB). No packets were sent to Syrian infrastructure by this project at any point. Everything in this record derives from the RIPE NCC Routing Information Service, read through the RIPEstat Data API; see ATTRIBUTION.md.

Contents of this version:

• as29256_visibility_5min_dec2024_2026-08-05.csv — reconstructed visibility of a fixed cohort of 45,149 (peer, prefix) pairs for all 451 AS29256 prefixes across 597 collector peers, at 5-minute resolution, 2024-12-06 to 2024-12-09. The deepest trough left 98.16% of the cohort visible: the evidence that no coordinated national routing shutdown occurred during the December 2024 political transition, which refutes a claim the project itself previously made.
• as29256_withdrawals_per_minute_dec2024_2026-08-05.csv — per minute with a withdrawal, the distinct prefixes and distinct observing peers: broad-prefix and broad-peer withdrawals never coincide.
• rpki_coverage_by_asn_2026-08-05.csv and rpki_invalid_announcements_2026-08-05.csv — route-origin validation coverage per origin ASN over 574 announcements, and the two RPKI-invalid AS29256 announcements.
• as29256_updates_distilled_2026-08-05.csv.gz — the distilled BGP UPDATE record both December 2024 series are computed from: 3,240,608 rows of prefix, timestamp, type, peer for all 451 AS29256 prefixes across 597 collector peers, 2024-12-05 to 2024-12-09, from RIPEstat bgp-updates queried per prefix. Queried per origin AS the same endpoint returns no withdrawals at all — a pitfall the README documents and the RIPE NCC has confirmed.
• as29256_updates_2026-08-05.jsonl.gz — the undistilled bgp-updates responses behind it, every attribute retained (AS paths, communities, next hop), 79 MB gzipped. This record is its archival copy.
• rpki_validation_2026-08-05.csv — route-origin validation status for each of the 574 announcements, one row per announcement with every covering ROA preserved, from RIPEstat rpki-validation; the two coverage files above are computed from it.
• query_log_2026-08-05.jsonl — every API query issued during collection, with outcome, for reproducibility. 787 entries, released with its gaps intact: 454 carry not_recorded because early collectors logged intent before issuing the request.
• README.md, DATASET.md, ATTRIBUTION.md — schemas, row counts, provenance, every cleaning pass applied, the documented reuse traps, and the licence position.

RIPE NCC data. The three files that are RIPEstat Data in the sense of the RIPEstat Service Terms and Conditions (Article 3.3) — the raw bgp-updates capture, its distillation and the per-announcement RPKI table — are re-distributed with the RIPE NCC's written permission, requested on 2026-09-11 and granted by the RIPEstat team on 2026-09-21, whose one condition is that the data is attributed to the RIPE NCC. ATTRIBUTION.md quotes the permission and gives the form of attribution. The record's CC BY 4.0 licence is the author's grant over the author's files; the three RIPE NCC files are redistributed under that permission for attributed research reuse, and it covers redistribution, not a review of the analysis. The RIPE NCC was notified of the results under Article 3.2 in the same exchange.

Each data file ships with a SHA-256 checksum.

Ethics. Findings were disclosed to every operator named in the accompanying report on 2026-08-05, with a window to 2026-09-20 before publication. Aggregate statistics only; no specific IP address is tied to a vulnerability.