NATed Network Traffic Collection Datasets of Terminal Devices

 three-level network topology experimental environment was constructed based on a typical home network. An optical network terminal (Bell XE-140W-TD) was used as the starting point for Internet access, and a Gigabit wired connection was established with the core router (Huawei TC30) via a shielded Cat 6 cable. This router is a Huawei beta version that can obtain specific device information and corresponding traffic after NAT. The experimental evaluation of traffic attribution association in subsequent chapters will use this as ground truth label data for comparison. It is equipped with a dual-band wireless access module (2.4GHz/5GHz independent channels) and four Gigabit wired ports, forming a central node for network traffic distribution. An innovative port mirroring function is set up between the optical modem and the router, which replicates the entire network traffic in real time to a dedicated packet capture host (Asus Zenbook 14 Air). This host is equipped with a customised collection system that integrates toolchains such as Tcpdump and Wireshark to achieve full traffic capture and millisecond-level real-time analysis.The collection system has accumulated 8.6GB of valid traffic data, forming a database containing more than 11.23 million packet records.