NAT Network Traffic Dataset

Network Address Translation (NAT), which is present in almost all routers and CPEs, maps private IP addresses to routable or public IP addresses. This feature has advantages such as reuse of private IP addresses but also has disadvantages such as creating “Shadow IT” where network admins do not have knowledge of all devices on their network. This dataset contains network traffic that is double-NATed thus replicating the scenario of shadow IT in an enterprise context. Network traffic in this dataset was collected over the course of two weeks with three sessions each day (morning, midday, and evening). Each session consists of 7 tests tackling different number of devices (up to 4 devices) at a time resulting in a total of 294 tests (294 capture files). Microsoft Network Monitor 3.4 was the tool used to capture the traffic.

网络地址转换（Network Address Translation，简称NAT）功能存在于几乎所有路由器和用户边缘设备（CPE）中，它将私有IP地址映射至可路由或公网IP地址。该功能具备诸如私有IP地址的重用等优势，但也存在诸如造成“影子IT”等劣势，即网络管理员无法了解其网络中所有设备。本数据集包含了经过双重NAT处理的网络流量，从而模拟了企业环境中“影子IT”的场景。该数据集中的网络流量收集持续了两周时间，每天分为早、中、晚三个时段进行，每个时段进行7次测试，每次测试针对不同数量的设备（最多4台设备）进行，总计完成了294次测试（294个捕获文件）。微软网络监控器3.4（Microsoft Network Monitor 3.4）是用于捕获流量的工具。