NATed Network Traffic Collection Datasets of Terminal Devices

 three-level network topology experimental environment was constructed based on a typical home network. An optical network terminal (Bell XE-140W-TD) was used as the starting point for Internet access, and a Gigabit wired connection was established with the core router (Huawei TC30) via a shielded Cat 6 cable. This router is a Huawei beta version that can obtain specific device information and corresponding traffic after NAT. The experimental evaluation of traffic attribution association in subsequent chapters will use this as ground truth label data for comparison. It is equipped with a dual-band wireless access module (2.4GHz/5GHz independent channels) and four Gigabit wired ports, forming a central node for network traffic distribution. An innovative port mirroring function is set up between the optical modem and the router, which replicates the entire network traffic in real time to a dedicated packet capture host (Asus Zenbook 14 Air). This host is equipped with a customised collection system that integrates toolchains such as Tcpdump and Wireshark to achieve full traffic capture and millisecond-level real-time analysis.The collection system has accumulated 8.6GB of valid traffic data, forming a database containing more than 11.23 million packet records.

本实验基于典型家庭网络架构搭建了三级网络拓扑实验环境。以贝尔XE-140W-TD型号的光网络终端（Optical Network Terminal）作为互联网接入起点，并通过屏蔽六类网线与核心路由器（华为TC30）建立千兆有线连接。该路由器为华为内部测试版本，可在网络地址转换（Network Address Translation，NAT）后获取特定设备信息与对应流量，后续章节中针对流量归属关联的实验评估，将以该数据作为对比用的真实标签数据集。该核心路由器搭载双频段无线接入模块（2.4GHz/5GHz独立信道）与四个千兆有线端口，作为网络流量分发的核心节点。本实验在光调制解调器（Optical Modem）与核心路由器之间部署了创新型端口镜像功能，可将全量网络流量实时复制至专用数据包捕获主机——华硕灵耀14 Air（Asus Zenbook 14 Air）。该捕获主机搭载定制化流量采集系统，集成了Tcpdump、Wireshark等工具链，可实现全流量捕获与毫秒级实时分析。目前该采集系统已累计获取8.6GB有效流量数据，构建了包含超1123万条数据包记录的数据库。