CRAWDAD hasselt/glimps2015

A pcap file containing 122,989 anonymized Probe Requests sent by mobile devices at the Glimps 2015 music festival in Ghent, Belgium.A collection of 122,989 Probe Request frames captured by 8 monitoring stations at the Glimps music festival in Ghent, Belgium (10 - 12 December 2015). To minimize overhead, each monitoring station individually stored only the transmitter MAC address and Information Elements per unique MAC. The dataset was used to show that the high entropy in Information Elements can be used to deanonymize devices that use MAC address randomization.date/time of measurement start: 2015-12-10date/time of measurement end: 2015-12-12collection environment: Captured at Glimps 2015, a music festival that took place in Ghent, Belgium.network configuration: Eight monitoring stations spread out over the city, connected via a 4G uplink to a central server.data collection methodology: Each monitoring station captured one Probe Request per unique MAC address. Only the source MAC address and Information Elements were extracted from this frame and forwarded to the collection server over a 4G link.limitation: Since only one Probe Request was captured per unique MAC address, this dataset should not be used to make conclusions about the frequency or timing of the Probe Requests. The intent of this dataset is to provide a collection of different (combinations of) Information Elements.sanitization: The 3 least significant bytes of each MAC address were uniquely and consistently mapped to a different value, with exception of "ff:ff:ff" and "00:00:00".- The SSID IE has its SSID field replaced with the string "Hidden", with exception of the wildcard (empty) SSID.- The Vendor Specific WPS IE was replaced with a hash of its payload given the amount of sensitive information (device serial/model number, UUID, etc.) contained within it, and the length of the IE was updated accordingly. Unfortunately, Wireshark stops parsing the remainder of Probes containing this anonymized IE, so it should be noted that further parsing beyond the WPS IE must be done manually (e.g. by using Scapy or by changing the Wireshark dissector).hole: Due to fluctuations in 4G connectivity, the nodes sometimes could not forward the Probes in time (they were buffered and sent after connectivity was restored). Therfore, the timing of the Probes should again not be used. Gaps in timing might be present due to outages.error: Only the source MAC and Information Elements were captured by the node. This data was wrapped in a dummy Probe Request file in order to be able to store it as a pcap file. The timestamps indicate the time at which the Probe was received at the server.Traceset hasselt/glimps2015/information-elementsmeasurement purpose: Network Securityhasselt/glimps2015/information-elements/information-elements Trace information-elements: Source MAC and Information Elements of observed devices wrapped in a dummy Probe Request.file: glimps2015/glimps2015.tar.xzformat: pcap 

一个包含122,989条匿名化探针请求（Probe Request）的pcap文件，这些请求由2015年比利时根特市Glimps音乐节期间的移动设备发送。本数据集包含8个监测站在2015年12月10日至12日于比利时根特市Glimps音乐节期间捕获的122,989个探针请求帧。为最小化开销，每个监测站针对每个唯一MAC地址仅存储发送方MAC地址和信息元素（Information Element）。该数据集用于证明：信息元素中的高熵特征可用于对采用MAC地址随机化的设备进行去匿名化处理。
测量开始日期/时间：2015年12月10日
测量结束日期/时间：2015年12月12日
采集环境：于2015年12月10日至12日在比利时根特市举办的Glimps音乐节期间采集
网络配置：8个监测站分布于城市各处，通过4G上行链路连接至中央服务器
数据采集方法：每个监测站针对每个唯一MAC地址仅捕获一个探针请求，仅提取源MAC地址和信息元素，并通过4G链路转发至采集服务器
局限性：由于每个唯一MAC地址仅捕获一个探针请求，该数据集不应被用于推断探针请求的频率或时间特征。此数据集旨在提供不同（组合形式的）信息元素集合
匿名化处理：
- 每个MAC地址的3个最低有效字节被唯一且一致地映射为不同值，"ff:ff:ff"和"00:00:00"除外
- SSID信息元素（IE）的SSID字段被替换为字符串“Hidden”，空SSID除外
- 由于包含大量敏感信息（设备序列号/型号、UUID等），厂商特定的WPS信息元素（WPS IE）被其payload的哈希（hash）值替换，且信息元素长度相应更新。遗憾的是，Wireshark会停止解析包含此匿名化信息元素的探针请求剩余部分，因此需注意：WPS信息元素之后的进一步解析必须手动完成（例如使用Scapy工具或修改Wireshark dissector）
数据缺失：由于4G连接波动，节点有时无法及时转发探针请求（会缓存并在连接恢复后发送），因此探针请求的时间特征再次不应被使用，连接中断可能导致时间上的间隙
误差说明：节点仅捕获源MAC地址和信息元素，这些数据被封装在虚拟探针请求文件中以存储为pcap格式。时间戳表示探针请求到达服务器的时间
轨迹集：hasselt/glimps2015/information-elements
测量目的：网络安全
hasselt/glimps2015/information-elements/information-elements 轨迹：information-elements：观测设备的源MAC地址和信息元素，封装于虚拟探针请求中
文件：glimps2015/glimps2015.tar.xz
格式：pcap