[Dataset] microsoft/osdi2006 (v. 2007-05-23)

top

the initial version

@MISC{microsoft-osdi2006-2007-05-23,
  author = {Ranveer Chandra and Ratul Mahajan and Venkat Padmanabhan and Ming Zhang},
  title = {{CRAWDAD} data set microsoft/osdi2006 (v. 2007-05-23)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/microsoft/osdi2006},
  month = may,  
  year = 2007
}
					

The authors gathered a detailed trace of network activity at 
OSDI 2006 to enable analysis of the behavior of a wireless
LAN that is (presumably) heavily used.

We gathered traces of wireless traffic at several monitoring nodes 
distributed across the conference floor and breakout areas. In addition, 
we gathered traces on the wired switch to which the wireless access points
connect.

The collection map ([AP-map.png] linked in this page) shows the locations 
of the APs and sniffers and the channels which they were operating on. 
There were five APs (AP8, AP9, AP10, AP11, and AP13) and these where set to 
one of three channels (1, 6, and 11). We used nine sniffers (S1 - S9) to gather 
the wireless traffic, each equipped with either one or two 802.11 NICs 
(labeled A and B) that are set up for sniffing. Each sniffer and the channel(s) 
it was set to sniff on are shown in blue in the figure. For instance, S1:6&11 
means S1 is sniffing channels 6 and 11 simultaneously. Note that we also had 
a wired sniffer (S10, not shown in the figure) to gather traffic between the wireless 
subnet and the wide-area network.

We recorded network protocol information from all packets sent on the air as well as 
on a wired switch that the access points connect to. The information being recorded
for each packet includes physical layer information such as the wireless signal 
strength as well as the 802.11, IP, TCP, UDP, and ICMP headers, depending on the packet type.
We did not record payloads (packet bodies) except for DHCP and DNS payloads. However, 
we anonymized or deleted potentially sensitive information such as MAC and IP addresses, 
and DNS names.

We have taken reasonable measures to secure the machines used for tracing: kept them 
up-to-date on patches, turned off unnecessary services, protected access with a strong 
password, etc.

We throw away the secret key used for the keyed one-way hash once the trace 
collection is concluded to make difficult a dictionary attack on the one-way hash.

Packet payload is recorded for DHCP and DNS requests and responses. However, information 
such as DNS names and IP addresses contained in the payload is anonymized before being stored.

Given that the traces are being anonymized, we believe that it would be extremely difficult 
for anyone to identify users or learn which Internet services or hosts they have communicated 
with. That said, we are not in a position to prove that no such information can be gleaned 
from the anonymized traces.

The traces is anonymized on-the-fly before they are stored on disk. However, certain information, 
such as the first 3 bytes of the MAC address, may turn out to violate the principle of k-anonymity 
(described below). If so, we further anonymize the trace offline before anyone else sees it; this kind 
of anonymization cannot be done online.

Much of the anonymization is performed on-the-fly, so no one should have access to the 
non-anonymized data, given that we intend to keep the tracing system as secure as possible. However, 
some of the anonymization can only be done offline, so the data authors have access to the partially 
anonymized data during the time it takes to perform the offline anonymization (no more than a few
days after the trace collection is concluded).

It may be possible to identify users using a side-channel attack, for instance, by exploiting 
information such packet sizes and packet timing; we do not plan to protect the data against 
such attacks.  Also, we would like to permit the identification of the manufacturer of a wireless 
NIC (which could be useful when analyzing the traces), so the first 3 bytes of the MAC address 
are left unanonymized.  However, this could violate the principle of k-anonymity, i.e., that 
it should not be possible to identify any user as being a member of a group with fewer than k members. 
If a group size is smaller than 10, our offline anonymization replaces this MAC-address prefix 
with another value so as to create a group of at least 10 nodes (i.e., we set k to 10). 
So it would be possible to identify the 3-byte prefix of a node's MAC address provided that 
there are at least 10 nodes that share the same prefix.

Despite the anonymization, it may be possible for some information to leak. For example, it may be 
possible to infer which website was visited based on the size of the response received. We are unable 
to obfuscate such information without damaging the data significantly.

[Traceset] microsoft/osdi2006/pcap (v. 2007-05-23)

top

the initial version

@MISC{microsoft-osdi2006-pcap-2007-05-23,
  author = {Ranveer Chandra and Ratul Mahajan and Venkat Padmanabhan and Ming Zhang},
  title = {{CRAWDAD} trace set microsoft/osdi2006/pcap (v. 2007-05-23)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/microsoft/osdi2006/pcap},
  month = may,  
  year = 2007
}
					

A detailed traceset of network activity at OSDI 2006 to enable analysis of 
the behavior of a wireless LAN that is (presumably) heavily used.

Each monitor captures all of the 802.11 frames it sees, including:

1. Data frames
2. Management frames (e.g., association, authentication)
3. Control frames (e.g., RTS, CTS, ACK)

For each wireless frame captured at a monitor, we record the following information:

1. Per-frame PHY information, including:
	a. Channel frequency
	b. RSSI
	c. Modulation rate

2. Entire MAC header, with only the source and destination MAC addresses being 
anonymized as follows:

	a. In real-time, the first 3 bytes of the MAC address are copied over as is. 
	The last 3 bytes are replaced with a one-way hash.
	b. Offline, we replace all the 3-byte MAC prefixes that occur fewer than 10 times 
	with a common prefix. This ensures k-anonymity, for k=10.

3. The entire IP and TCP/UDP header, with the source and destination IP addresses 
anonymized as follows:

	a. The IP address is replaced with a one-way hash.
	b. In addition, we record which of the following categories the IP address belongs to:
		i. Auto conf (169.254/16).
		ii. Locally allocated.
		iii. Other.

4. The entire DHCP payload, with the following anonymization:

	a. All IP addresses (e.g., client IP address (ciaddr), your IP address (yiaddr)) are 
	anonymized as in 3.
	b. All MAC addresses (e.g., client hardware address (chaddr)) are anonymized as in 2.
	c. All names (e.g., server name (sname)) are replaced with a one-way hash.
	d. All identifying options (e.g., client identifier) are replaced with a one-way hash.

5. The DNS request/response payload, with the following anonymization/deletion:
	a. The domain name in the question section is replaced with a one-way hash.
	b. The resource records are deleted.

[Trace] microsoft/osdi2006/pcap/S1 (v. 2007-05-23)

top

the initial version

@MISC{microsoft-osdi2006-pcap-S1-2007-05-23,
  author = {Ranveer Chandra and Ratul Mahajan and Venkat Padmanabhan and Ming Zhang},
  title = {{CRAWDAD} trace microsoft/osdi2006/pcap/S1 (v. 2007-05-23)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/microsoft/osdi2006/pcap/S1},
  month = may,  
  year = 2007
}
					

A detailed trace of network activity at OSDI 2006, captured by a monitor node

The tarballs of some monitors are split across multiple files. 
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. 
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar") 
to get the original tarball.

The trace files collected by all the wireless and wired sniffers (S1-S10) 
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is 
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated 
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

Each trace file is in the libpcap format with PRISM header. It can be 
opened with standard packet parsing tools, such as Ethereal or Tcpdump. 
(However, these tools might report checksum errors because of the anonymization 
performed on the trace.) Note that we use several fields in the PRISM header 
to encode wireless-specific information. For convenience, we include the C-style 
definition of PRISM header below.

struct wlan_ng_val_t {
	uint32 did;
	uint16 status;
	uint16 len;
	uint32 data;
};

struct wlan_ng_prism_hdr_t {
	uint32 msgcode;
	uint32 msglen;
	char devname[16];
	wlan_ng_val_t hosttime;
	wlan_ng_val_t mactime;
	wlan_ng_val_t channel;
	wlan_ng_val_t rssi;
	wlan_ng_val_t sq;
	wlan_ng_val_t signal;
	wlan_ng_val_t noise;
	wlan_ng_val_t rate;
	wlan_ng_val_t istx;
	wlan_ng_val_t frmlen;
};

The following fields are used to record information:

- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

[Trace] microsoft/osdi2006/pcap/S2 (v. 2007-05-23)

top

the initial version

@MISC{microsoft-osdi2006-pcap-S2-2007-05-23,
  author = {Ranveer Chandra and Ratul Mahajan and Venkat Padmanabhan and Ming Zhang},
  title = {{CRAWDAD} trace microsoft/osdi2006/pcap/S2 (v. 2007-05-23)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/microsoft/osdi2006/pcap/S2},
  month = may,  
  year = 2007
}
					

A detailed trace of network activity at OSDI 2006, captured by a monitor node

The tarballs of some monitors are split across multiple files. 
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. 
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar") 
to get the original tarball.

The trace files collected by all the wireless and wired sniffers (S1-S10) 
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is 
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated 
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

Each trace file is in the libpcap format with PRISM header. It can be 
opened with standard packet parsing tools, such as Ethereal or Tcpdump. 
(However, these tools might report checksum errors because of the anonymization 
performed on the trace.) Note that we use several fields in the PRISM header 
to encode wireless-specific information. For convenience, we include the C-style 
definition of PRISM header below.

struct wlan_ng_val_t {
	uint32 did;
	uint16 status;
	uint16 len;
	uint32 data;
};

struct wlan_ng_prism_hdr_t {
	uint32 msgcode;
	uint32 msglen;
	char devname[16];
	wlan_ng_val_t hosttime;
	wlan_ng_val_t mactime;
	wlan_ng_val_t channel;
	wlan_ng_val_t rssi;
	wlan_ng_val_t sq;
	wlan_ng_val_t signal;
	wlan_ng_val_t noise;
	wlan_ng_val_t rate;
	wlan_ng_val_t istx;
	wlan_ng_val_t frmlen;
};

The following fields are used to record information:

- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

[Trace] microsoft/osdi2006/pcap/S3 (v. 2007-05-23)

top

the initial version

@MISC{microsoft-osdi2006-pcap-S3-2007-05-23,
  author = {Ranveer Chandra and Ratul Mahajan and Venkat Padmanabhan and Ming Zhang},
  title = {{CRAWDAD} trace microsoft/osdi2006/pcap/S3 (v. 2007-05-23)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/microsoft/osdi2006/pcap/S3},
  month = may,  
  year = 2007
}
					

A detailed trace of network activity at OSDI 2006, captured by a monitor node

The tarballs of some monitors are split across multiple files. 
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. 
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar") 
to get the original tarball.

The trace files collected by all the wireless and wired sniffers (S1-S10) 
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is 
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated 
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

Each trace file is in the libpcap format with PRISM header. It can be 
opened with standard packet parsing tools, such as Ethereal or Tcpdump. 
(However, these tools might report checksum errors because of the anonymization 
performed on the trace.) Note that we use several fields in the PRISM header 
to encode wireless-specific information. For convenience, we include the C-style 
definition of PRISM header below.

struct wlan_ng_val_t {
	uint32 did;
	uint16 status;
	uint16 len;
	uint32 data;
};

struct wlan_ng_prism_hdr_t {
	uint32 msgcode;
	uint32 msglen;
	char devname[16];
	wlan_ng_val_t hosttime;
	wlan_ng_val_t mactime;
	wlan_ng_val_t channel;
	wlan_ng_val_t rssi;
	wlan_ng_val_t sq;
	wlan_ng_val_t signal;
	wlan_ng_val_t noise;
	wlan_ng_val_t rate;
	wlan_ng_val_t istx;
	wlan_ng_val_t frmlen;
};

The following fields are used to record information:

- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

[Trace] microsoft/osdi2006/pcap/S4 (v. 2007-05-23)

top

the initial version

@MISC{microsoft-osdi2006-pcap-S4-2007-05-23,
  author = {Ranveer Chandra and Ratul Mahajan and Venkat Padmanabhan and Ming Zhang},
  title = {{CRAWDAD} trace microsoft/osdi2006/pcap/S4 (v. 2007-05-23)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/microsoft/osdi2006/pcap/S4},
  month = may,  
  year = 2007
}
					

A detailed trace of network activity at OSDI 2006, captured by a monitor node

The tarballs of some monitors are split across multiple files. 
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. 
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar") 
to get the original tarball.

The trace files collected by all the wireless and wired sniffers (S1-S10) 
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is 
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated 
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

Each trace file is in the libpcap format with PRISM header. It can be 
opened with standard packet parsing tools, such as Ethereal or Tcpdump. 
(However, these tools might report checksum errors because of the anonymization 
performed on the trace.) Note that we use several fields in the PRISM header 
to encode wireless-specific information. For convenience, we include the C-style 
definition of PRISM header below.

struct wlan_ng_val_t {
	uint32 did;
	uint16 status;
	uint16 len;
	uint32 data;
};

struct wlan_ng_prism_hdr_t {
	uint32 msgcode;
	uint32 msglen;
	char devname[16];
	wlan_ng_val_t hosttime;
	wlan_ng_val_t mactime;
	wlan_ng_val_t channel;
	wlan_ng_val_t rssi;
	wlan_ng_val_t sq;
	wlan_ng_val_t signal;
	wlan_ng_val_t noise;
	wlan_ng_val_t rate;
	wlan_ng_val_t istx;
	wlan_ng_val_t frmlen;
};

The following fields are used to record information:

- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

[Trace] microsoft/osdi2006/pcap/S5 (v. 2007-05-23)

top

the initial version

@MISC{microsoft-osdi2006-pcap-S5-2007-05-23,
  author = {Ranveer Chandra and Ratul Mahajan and Venkat Padmanabhan and Ming Zhang},
  title = {{CRAWDAD} trace microsoft/osdi2006/pcap/S5 (v. 2007-05-23)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/microsoft/osdi2006/pcap/S5},
  month = may,  
  year = 2007
}
					

A detailed trace of network activity at OSDI 2006, captured by a monitor node

The tarballs of some monitors are split across multiple files. 
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. 
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar") 
to get the original tarball.

The trace files collected by all the wireless and wired sniffers (S1-S10) 
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is 
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated 
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

Each trace file is in the libpcap format with PRISM header. It can be 
opened with standard packet parsing tools, such as Ethereal or Tcpdump. 
(However, these tools might report checksum errors because of the anonymization 
performed on the trace.) Note that we use several fields in the PRISM header 
to encode wireless-specific information. For convenience, we include the C-style 
definition of PRISM header below.

struct wlan_ng_val_t {
	uint32 did;
	uint16 status;
	uint16 len;
	uint32 data;
};

struct wlan_ng_prism_hdr_t {
	uint32 msgcode;
	uint32 msglen;
	char devname[16];
	wlan_ng_val_t hosttime;
	wlan_ng_val_t mactime;
	wlan_ng_val_t channel;
	wlan_ng_val_t rssi;
	wlan_ng_val_t sq;
	wlan_ng_val_t signal;
	wlan_ng_val_t noise;
	wlan_ng_val_t rate;
	wlan_ng_val_t istx;
	wlan_ng_val_t frmlen;
};

The following fields are used to record information:

- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

[Trace] microsoft/osdi2006/pcap/S6 (v. 2007-05-23)

top

the initial version

@MISC{microsoft-osdi2006-pcap-S6-2007-05-23,
  author = {Ranveer Chandra and Ratul Mahajan and Venkat Padmanabhan and Ming Zhang},
  title = {{CRAWDAD} trace microsoft/osdi2006/pcap/S6 (v. 2007-05-23)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/microsoft/osdi2006/pcap/S6},
  month = may,  
  year = 2007
}
					

A detailed trace of network activity at OSDI 2006, captured by a monitor node

The tarballs of some monitors are split across multiple files. 
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. 
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar") 
to get the original tarball.

The trace files collected by all the wireless and wired sniffers (S1-S10) 
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is 
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated 
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

Each trace file is in the libpcap format with PRISM header. It can be 
opened with standard packet parsing tools, such as Ethereal or Tcpdump. 
(However, these tools might report checksum errors because of the anonymization 
performed on the trace.) Note that we use several fields in the PRISM header 
to encode wireless-specific information. For convenience, we include the C-style 
definition of PRISM header below.

struct wlan_ng_val_t {
	uint32 did;
	uint16 status;
	uint16 len;
	uint32 data;
};

struct wlan_ng_prism_hdr_t {
	uint32 msgcode;
	uint32 msglen;
	char devname[16];
	wlan_ng_val_t hosttime;
	wlan_ng_val_t mactime;
	wlan_ng_val_t channel;
	wlan_ng_val_t rssi;
	wlan_ng_val_t sq;
	wlan_ng_val_t signal;
	wlan_ng_val_t noise;
	wlan_ng_val_t rate;
	wlan_ng_val_t istx;
	wlan_ng_val_t frmlen;
};

The following fields are used to record information:

- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

[Trace] microsoft/osdi2006/pcap/S7 (v. 2007-05-23)

top

the initial version

@MISC{microsoft-osdi2006-pcap-S7-2007-05-23,
  author = {Ranveer Chandra and Ratul Mahajan and Venkat Padmanabhan and Ming Zhang},
  title = {{CRAWDAD} trace microsoft/osdi2006/pcap/S7 (v. 2007-05-23)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/microsoft/osdi2006/pcap/S7},
  month = may,  
  year = 2007
}
					

A detailed trace of network activity at OSDI 2006, captured by a monitor node

The tarballs of some monitors are split across multiple files. 
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. 
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar") 
to get the original tarball.

The trace files collected by all the wireless and wired sniffers (S1-S10) 
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is 
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated 
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

Each trace file is in the libpcap format with PRISM header. It can be 
opened with standard packet parsing tools, such as Ethereal or Tcpdump. 
(However, these tools might report checksum errors because of the anonymization 
performed on the trace.) Note that we use several fields in the PRISM header 
to encode wireless-specific information. For convenience, we include the C-style 
definition of PRISM header below.

struct wlan_ng_val_t {
	uint32 did;
	uint16 status;
	uint16 len;
	uint32 data;
};

struct wlan_ng_prism_hdr_t {
	uint32 msgcode;
	uint32 msglen;
	char devname[16];
	wlan_ng_val_t hosttime;
	wlan_ng_val_t mactime;
	wlan_ng_val_t channel;
	wlan_ng_val_t rssi;
	wlan_ng_val_t sq;
	wlan_ng_val_t signal;
	wlan_ng_val_t noise;
	wlan_ng_val_t rate;
	wlan_ng_val_t istx;
	wlan_ng_val_t frmlen;
};

The following fields are used to record information:

- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

[Trace] microsoft/osdi2006/pcap/S8 (v. 2007-05-23)

top

the initial version

@MISC{microsoft-osdi2006-pcap-S8-2007-05-23,
  author = {Ranveer Chandra and Ratul Mahajan and Venkat Padmanabhan and Ming Zhang},
  title = {{CRAWDAD} trace microsoft/osdi2006/pcap/S8 (v. 2007-05-23)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/microsoft/osdi2006/pcap/S8},
  month = may,  
  year = 2007
}
					

A detailed trace of network activity at OSDI 2006, captured by a monitor node

The tarballs of some monitors are split across multiple files. 
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. 
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar") 
to get the original tarball.

The trace files collected by all the wireless and wired sniffers (S1-S10) 
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is 
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated 
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

Each trace file is in the libpcap format with PRISM header. It can be 
opened with standard packet parsing tools, such as Ethereal or Tcpdump. 
(However, these tools might report checksum errors because of the anonymization 
performed on the trace.) Note that we use several fields in the PRISM header 
to encode wireless-specific information. For convenience, we include the C-style 
definition of PRISM header below.

struct wlan_ng_val_t {
	uint32 did;
	uint16 status;
	uint16 len;
	uint32 data;
};

struct wlan_ng_prism_hdr_t {
	uint32 msgcode;
	uint32 msglen;
	char devname[16];
	wlan_ng_val_t hosttime;
	wlan_ng_val_t mactime;
	wlan_ng_val_t channel;
	wlan_ng_val_t rssi;
	wlan_ng_val_t sq;
	wlan_ng_val_t signal;
	wlan_ng_val_t noise;
	wlan_ng_val_t rate;
	wlan_ng_val_t istx;
	wlan_ng_val_t frmlen;
};

The following fields are used to record information:

- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

[Trace] microsoft/osdi2006/pcap/S9 (v. 2007-05-23)

top

the initial version

@MISC{microsoft-osdi2006-pcap-S9-2007-05-23,
  author = {Ranveer Chandra and Ratul Mahajan and Venkat Padmanabhan and Ming Zhang},
  title = {{CRAWDAD} trace microsoft/osdi2006/pcap/S9 (v. 2007-05-23)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/microsoft/osdi2006/pcap/S9},
  month = may,  
  year = 2007
}
					

A detailed trace of network activity at OSDI 2006, captured by a monitor node

The tarballs of some monitors are split across multiple files. 
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. 
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar") 
to get the original tarball.

The trace files collected by all the wireless and wired sniffers (S1-S10) 
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is 
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated 
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

Each trace file is in the libpcap format with PRISM header. It can be 
opened with standard packet parsing tools, such as Ethereal or Tcpdump. 
(However, these tools might report checksum errors because of the anonymization 
performed on the trace.) Note that we use several fields in the PRISM header 
to encode wireless-specific information. For convenience, we include the C-style 
definition of PRISM header below.

struct wlan_ng_val_t {
	uint32 did;
	uint16 status;
	uint16 len;
	uint32 data;
};

struct wlan_ng_prism_hdr_t {
	uint32 msgcode;
	uint32 msglen;
	char devname[16];
	wlan_ng_val_t hosttime;
	wlan_ng_val_t mactime;
	wlan_ng_val_t channel;
	wlan_ng_val_t rssi;
	wlan_ng_val_t sq;
	wlan_ng_val_t signal;
	wlan_ng_val_t noise;
	wlan_ng_val_t rate;
	wlan_ng_val_t istx;
	wlan_ng_val_t frmlen;
};

The following fields are used to record information:

- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

[Trace] microsoft/osdi2006/pcap/S10 (v. 2007-05-23)

top

the initial version

@MISC{microsoft-osdi2006-pcap-S10-2007-05-23,
  author = {Ranveer Chandra and Ratul Mahajan and Venkat Padmanabhan and Ming Zhang},
  title = {{CRAWDAD} trace microsoft/osdi2006/pcap/S10 (v. 2007-05-23)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/microsoft/osdi2006/pcap/S10},
  month = may,  
  year = 2007
}
					

A detailed trace of network activity at OSDI 2006, captured by a monitor node

The tarballs of some monitors are split across multiple files. 
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. 
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar") 
to get the original tarball.

The trace files collected by all the wireless and wired sniffers (S1-S10) 
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is 
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated 
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

Each trace file is in the libpcap format with PRISM header. It can be 
opened with standard packet parsing tools, such as Ethereal or Tcpdump. 
(However, these tools might report checksum errors because of the anonymization 
performed on the trace.) Note that we use several fields in the PRISM header 
to encode wireless-specific information. For convenience, we include the C-style 
definition of PRISM header below.

struct wlan_ng_val_t {
	uint32 did;
	uint16 status;
	uint16 len;
	uint32 data;
};

struct wlan_ng_prism_hdr_t {
	uint32 msgcode;
	uint32 msglen;
	char devname[16];
	wlan_ng_val_t hosttime;
	wlan_ng_val_t mactime;
	wlan_ng_val_t channel;
	wlan_ng_val_t rssi;
	wlan_ng_val_t sq;
	wlan_ng_val_t signal;
	wlan_ng_val_t noise;
	wlan_ng_val_t rate;
	wlan_ng_val_t istx;
	wlan_ng_val_t frmlen;
};

The following fields are used to record information:

- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

[Author] Ranveer Chandra

top

[Author] Ratul Mahajan

top

[Author] Venkat Padmanabhan

top

[Author] Ming Zhang

top