microsoft/osdi20062007052329200705232007-07-19microsoft/osdi2006Traces of network activity at OSDI 2006.The authors gathered a detailed trace of network activity at
OSDI 2006 to enable analysis of the behavior of a wireless
LAN that is (presumably) heavily used.the initial version2007-05-232006-11-062006-11-07OSDI2006-tracing-handoutREADME12331124125http://www.crawdad.org/microsoft/osdi2006http://www.crawdad.org/wiki/pmwiki.php?n=Main.Dataset.microsoft-osdi2006802.11802.11 framespacket traceRFMONsignal strengthtcpdumpUsage Characterization802.11 infrastructureWe gathered traces of wireless traffic at several monitoring nodes
distributed across the conference floor and breakout areas. In addition,
we gathered traces on the wired switch to which the wireless access points
connect.The collection map ([AP-map.png] linked in this page) shows the locations
of the APs and sniffers and the channels which they were operating on.
There were five APs (AP8, AP9, AP10, AP11, and AP13) and these where set to
one of three channels (1, 6, and 11). We used nine sniffers (S1 - S9) to gather
the wireless traffic, each equipped with either one or two 802.11 NICs
(labeled A and B) that are set up for sniffing. Each sniffer and the channel(s)
it was set to sniff on are shown in blue in the figure. For instance, S1:6&11
means S1 is sniffing channels 6 and 11 simultaneously. Note that we also had
a wired sniffer (S10, not shown in the figure) to gather traffic between the wireless
subnet and the wide-area network.We recorded network protocol information from all packets sent on the air as well as
on a wired switch that the access points connect to. The information being recorded
for each packet includes physical layer information such as the wireless signal
strength as well as the 802.11, IP, TCP, UDP, and ICMP headers, depending on the packet type.
We did not record payloads (packet bodies) except for DHCP and DNS payloads. However,
we anonymized or deleted potentially sensitive information such as MAC and IP addresses,
and DNS names.We have taken reasonable measures to secure the machines used for tracing: kept them
up-to-date on patches, turned off unnecessary services, protected access with a strong
password, etc.
We throw away the secret key used for the keyed one-way hash once the trace
collection is concluded to make difficult a dictionary attack on the one-way hash.
Packet payload is recorded for DHCP and DNS requests and responses. However, information
such as DNS names and IP addresses contained in the payload is anonymized before being stored.
Given that the traces are being anonymized, we believe that it would be extremely difficult
for anyone to identify users or learn which Internet services or hosts they have communicated
with. That said, we are not in a position to prove that no such information can be gleaned
from the anonymized traces.
The traces is anonymized on-the-fly before they are stored on disk. However, certain information,
such as the first 3 bytes of the MAC address, may turn out to violate the principle of k-anonymity
(described below). If so, we further anonymize the trace offline before anyone else sees it; this kind
of anonymization cannot be done online.
Much of the anonymization is performed on-the-fly, so no one should have access to the
non-anonymized data, given that we intend to keep the tracing system as secure as possible. However,
some of the anonymization can only be done offline, so the data authors have access to the partially
anonymized data during the time it takes to perform the offline anonymization (no more than a few
days after the trace collection is concluded).
It may be possible to identify users using a side-channel attack, for instance, by exploiting
information such packet sizes and packet timing; we do not plan to protect the data against
such attacks. Also, we would like to permit the identification of the manufacturer of a wireless
NIC (which could be useful when analyzing the traces), so the first 3 bytes of the MAC address
are left unanonymized. However, this could violate the principle of k-anonymity, i.e., that
it should not be possible to identify any user as being a member of a group with fewer than k members.
If a group size is smaller than 10, our offline anonymization replaces this MAC-address prefix
with another value so as to create a group of at least 10 nodes (i.e., we set k to 10).
So it would be possible to identify the 3-byte prefix of a node's MAC address provided that
there are at least 10 nodes that share the same prefix.Despite the anonymization, it may be possible for some information to leak. For example, it may be
possible to infer which website was visited based on the size of the response received. We are unable
to obfuscate such information without damaging the data significantly./download/microsoft/osdi2006/AP-map.png41200705232007-07-19microsoft/osdi2006/pcapA detailed traceset of network activity at OSDI 2006.A detailed traceset of network activity at OSDI 2006 to enable analysis of
the behavior of a wireless LAN that is (presumably) heavily used.the initial version2007-05-232006-11-062006-11-07Usage Characterization802.11 infrastructureEach monitor captures all of the 802.11 frames it sees, including:
1. Data frames
2. Management frames (e.g., association, authentication)
3. Control frames (e.g., RTS, CTS, ACK)
For each wireless frame captured at a monitor, we record the following information:
1. Per-frame PHY information, including:
a. Channel frequency
b. RSSI
c. Modulation rate
2. Entire MAC header, with only the source and destination MAC addresses being
anonymized as follows:
a. In real-time, the first 3 bytes of the MAC address are copied over as is.
The last 3 bytes are replaced with a one-way hash.
b. Offline, we replace all the 3-byte MAC prefixes that occur fewer than 10 times
with a common prefix. This ensures k-anonymity, for k=10.
3. The entire IP and TCP/UDP header, with the source and destination IP addresses
anonymized as follows:
a. The IP address is replaced with a one-way hash.
b. In addition, we record which of the following categories the IP address belongs to:
i. Auto conf (169.254/16).
ii. Locally allocated.
iii. Other.
4. The entire DHCP payload, with the following anonymization:
a. All IP addresses (e.g., client IP address (ciaddr), your IP address (yiaddr)) are
anonymized as in 3.
b. All MAC addresses (e.g., client hardware address (chaddr)) are anonymized as in 2.
c. All names (e.g., server name (sname)) are replaced with a one-way hash.
d. All identifying options (e.g., client identifier) are replaced with a one-way hash.
5. The DNS request/response payload, with the following anonymization/deletion:
a. The domain name in the question section is replaced with a one-way hash.
b. The resource records are deleted.microsoft/osdi200695200705232007-06-06microsoft/osdi2006/pcap/S1A detailed trace of network activity at OSDI 2006, captured by a monitor node.A detailed trace of network activity at OSDI 2006, captured by a monitor node.the initial versionfalse2007-05-232006-11-062006-11-07The tarballs of some monitors are split across multiple files.
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c.
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar")
to get the original tarball.
The trace files collected by all the wireless and wired sniffers (S1-S10)
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.Each trace file is in the libpcap format with PRISM header. It can be
opened with standard packet parsing tools, such as Ethereal or Tcpdump.
(However, these tools might report checksum errors because of the anonymization
performed on the trace.) Note that we use several fields in the PRISM header
to encode wireless-specific information. For convenience, we include the C-style
definition of PRISM header below.
struct wlan_ng_val_t {
uint32 did;
uint16 status;
uint16 len;
uint32 data;
};
struct wlan_ng_prism_hdr_t {
uint32 msgcode;
uint32 msglen;
char devname[16];
wlan_ng_val_t hosttime;
wlan_ng_val_t mactime;
wlan_ng_val_t channel;
wlan_ng_val_t rssi;
wlan_ng_val_t sq;
wlan_ng_val_t signal;
wlan_ng_val_t noise;
wlan_ng_val_t rate;
wlan_ng_val_t istx;
wlan_ng_val_t frmlen;
};
The following fields are used to record information:
- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error
The remaining fields are not used./download/microsoft/osdi2006/S1microsoft/osdi2006/pcap96200705232007-06-06microsoft/osdi2006/pcap/S2A detailed trace of network activity at OSDI 2006, captured by a monitor node.A detailed trace of network activity at OSDI 2006, captured by a monitor node.the initial versionfalse2007-05-232006-11-062006-11-07The tarballs of some monitors are split across multiple files.
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c.
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar")
to get the original tarball.
The trace files collected by all the wireless and wired sniffers (S1-S10)
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.Each trace file is in the libpcap format with PRISM header. It can be
opened with standard packet parsing tools, such as Ethereal or Tcpdump.
(However, these tools might report checksum errors because of the anonymization
performed on the trace.) Note that we use several fields in the PRISM header
to encode wireless-specific information. For convenience, we include the C-style
definition of PRISM header below.
struct wlan_ng_val_t {
uint32 did;
uint16 status;
uint16 len;
uint32 data;
};
struct wlan_ng_prism_hdr_t {
uint32 msgcode;
uint32 msglen;
char devname[16];
wlan_ng_val_t hosttime;
wlan_ng_val_t mactime;
wlan_ng_val_t channel;
wlan_ng_val_t rssi;
wlan_ng_val_t sq;
wlan_ng_val_t signal;
wlan_ng_val_t noise;
wlan_ng_val_t rate;
wlan_ng_val_t istx;
wlan_ng_val_t frmlen;
};
The following fields are used to record information:
- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error
The remaining fields are not used./download/microsoft/osdi2006/S2microsoft/osdi2006/pcap97200705232007-06-06microsoft/osdi2006/pcap/S3A detailed trace of network activity at OSDI 2006, captured by a monitor node.A detailed trace of network activity at OSDI 2006, captured by a monitor node.the initial versionfalse2007-05-232006-11-062006-11-07The tarballs of some monitors are split across multiple files.
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c.
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar")
to get the original tarball.
The trace files collected by all the wireless and wired sniffers (S1-S10)
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.Each trace file is in the libpcap format with PRISM header. It can be
opened with standard packet parsing tools, such as Ethereal or Tcpdump.
(However, these tools might report checksum errors because of the anonymization
performed on the trace.) Note that we use several fields in the PRISM header
to encode wireless-specific information. For convenience, we include the C-style
definition of PRISM header below.
struct wlan_ng_val_t {
uint32 did;
uint16 status;
uint16 len;
uint32 data;
};
struct wlan_ng_prism_hdr_t {
uint32 msgcode;
uint32 msglen;
char devname[16];
wlan_ng_val_t hosttime;
wlan_ng_val_t mactime;
wlan_ng_val_t channel;
wlan_ng_val_t rssi;
wlan_ng_val_t sq;
wlan_ng_val_t signal;
wlan_ng_val_t noise;
wlan_ng_val_t rate;
wlan_ng_val_t istx;
wlan_ng_val_t frmlen;
};
The following fields are used to record information:
- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error
The remaining fields are not used./download/microsoft/osdi2006/S3microsoft/osdi2006/pcap98200705232007-06-06microsoft/osdi2006/pcap/S4A detailed trace of network activity at OSDI 2006, captured by a monitor node.A detailed trace of network activity at OSDI 2006, captured by a monitor node.the initial versionfalse2007-05-232006-11-062006-11-07The tarballs of some monitors are split across multiple files.
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c.
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar")
to get the original tarball.
The trace files collected by all the wireless and wired sniffers (S1-S10)
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.Each trace file is in the libpcap format with PRISM header. It can be
opened with standard packet parsing tools, such as Ethereal or Tcpdump.
(However, these tools might report checksum errors because of the anonymization
performed on the trace.) Note that we use several fields in the PRISM header
to encode wireless-specific information. For convenience, we include the C-style
definition of PRISM header below.
struct wlan_ng_val_t {
uint32 did;
uint16 status;
uint16 len;
uint32 data;
};
struct wlan_ng_prism_hdr_t {
uint32 msgcode;
uint32 msglen;
char devname[16];
wlan_ng_val_t hosttime;
wlan_ng_val_t mactime;
wlan_ng_val_t channel;
wlan_ng_val_t rssi;
wlan_ng_val_t sq;
wlan_ng_val_t signal;
wlan_ng_val_t noise;
wlan_ng_val_t rate;
wlan_ng_val_t istx;
wlan_ng_val_t frmlen;
};
The following fields are used to record information:
- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error
The remaining fields are not used./download/microsoft/osdi2006/S4microsoft/osdi2006/pcap99200705232007-06-06microsoft/osdi2006/pcap/S5A detailed trace of network activity at OSDI 2006, captured by a monitor node.A detailed trace of network activity at OSDI 2006, captured by a monitor node.the initial versionfalse2007-05-232006-11-062006-11-07The tarballs of some monitors are split across multiple files.
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c.
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar")
to get the original tarball.
The trace files collected by all the wireless and wired sniffers (S1-S10)
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.Each trace file is in the libpcap format with PRISM header. It can be
opened with standard packet parsing tools, such as Ethereal or Tcpdump.
(However, these tools might report checksum errors because of the anonymization
performed on the trace.) Note that we use several fields in the PRISM header
to encode wireless-specific information. For convenience, we include the C-style
definition of PRISM header below.
struct wlan_ng_val_t {
uint32 did;
uint16 status;
uint16 len;
uint32 data;
};
struct wlan_ng_prism_hdr_t {
uint32 msgcode;
uint32 msglen;
char devname[16];
wlan_ng_val_t hosttime;
wlan_ng_val_t mactime;
wlan_ng_val_t channel;
wlan_ng_val_t rssi;
wlan_ng_val_t sq;
wlan_ng_val_t signal;
wlan_ng_val_t noise;
wlan_ng_val_t rate;
wlan_ng_val_t istx;
wlan_ng_val_t frmlen;
};
The following fields are used to record information:
- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error
The remaining fields are not used./download/microsoft/osdi2006/S5microsoft/osdi2006/pcap100200705232007-06-06microsoft/osdi2006/pcap/S6A detailed trace of network activity at OSDI 2006, captured by a monitor node.A detailed trace of network activity at OSDI 2006, captured by a monitor node.the initial versionfalse2007-05-232006-11-062006-11-07The tarballs of some monitors are split across multiple files.
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c.
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar")
to get the original tarball.
The trace files collected by all the wireless and wired sniffers (S1-S10)
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.Each trace file is in the libpcap format with PRISM header. It can be
opened with standard packet parsing tools, such as Ethereal or Tcpdump.
(However, these tools might report checksum errors because of the anonymization
performed on the trace.) Note that we use several fields in the PRISM header
to encode wireless-specific information. For convenience, we include the C-style
definition of PRISM header below.
struct wlan_ng_val_t {
uint32 did;
uint16 status;
uint16 len;
uint32 data;
};
struct wlan_ng_prism_hdr_t {
uint32 msgcode;
uint32 msglen;
char devname[16];
wlan_ng_val_t hosttime;
wlan_ng_val_t mactime;
wlan_ng_val_t channel;
wlan_ng_val_t rssi;
wlan_ng_val_t sq;
wlan_ng_val_t signal;
wlan_ng_val_t noise;
wlan_ng_val_t rate;
wlan_ng_val_t istx;
wlan_ng_val_t frmlen;
};
The following fields are used to record information:
- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error
The remaining fields are not used./download/microsoft/osdi2006/S6microsoft/osdi2006/pcap101200705232007-06-06microsoft/osdi2006/pcap/S7A detailed trace of network activity at OSDI 2006, captured by a monitor node.A detailed trace of network activity at OSDI 2006, captured by a monitor node.the initial versionfalse2007-05-232006-11-062006-11-07The tarballs of some monitors are split across multiple files.
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c.
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar")
to get the original tarball.
The trace files collected by all the wireless and wired sniffers (S1-S10)
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.Each trace file is in the libpcap format with PRISM header. It can be
opened with standard packet parsing tools, such as Ethereal or Tcpdump.
(However, these tools might report checksum errors because of the anonymization
performed on the trace.) Note that we use several fields in the PRISM header
to encode wireless-specific information. For convenience, we include the C-style
definition of PRISM header below.
struct wlan_ng_val_t {
uint32 did;
uint16 status;
uint16 len;
uint32 data;
};
struct wlan_ng_prism_hdr_t {
uint32 msgcode;
uint32 msglen;
char devname[16];
wlan_ng_val_t hosttime;
wlan_ng_val_t mactime;
wlan_ng_val_t channel;
wlan_ng_val_t rssi;
wlan_ng_val_t sq;
wlan_ng_val_t signal;
wlan_ng_val_t noise;
wlan_ng_val_t rate;
wlan_ng_val_t istx;
wlan_ng_val_t frmlen;
};
The following fields are used to record information:
- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error
The remaining fields are not used./download/microsoft/osdi2006/S7microsoft/osdi2006/pcap102200705232007-06-06microsoft/osdi2006/pcap/S8A detailed trace of network activity at OSDI 2006, captured by a monitor node.A detailed trace of network activity at OSDI 2006, captured by a monitor node.the initial versionfalse2007-05-232006-11-062006-11-07The tarballs of some monitors are split across multiple files.
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c.
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar")
to get the original tarball.
The trace files collected by all the wireless and wired sniffers (S1-S10)
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.Each trace file is in the libpcap format with PRISM header. It can be
opened with standard packet parsing tools, such as Ethereal or Tcpdump.
(However, these tools might report checksum errors because of the anonymization
performed on the trace.) Note that we use several fields in the PRISM header
to encode wireless-specific information. For convenience, we include the C-style
definition of PRISM header below.
struct wlan_ng_val_t {
uint32 did;
uint16 status;
uint16 len;
uint32 data;
};
struct wlan_ng_prism_hdr_t {
uint32 msgcode;
uint32 msglen;
char devname[16];
wlan_ng_val_t hosttime;
wlan_ng_val_t mactime;
wlan_ng_val_t channel;
wlan_ng_val_t rssi;
wlan_ng_val_t sq;
wlan_ng_val_t signal;
wlan_ng_val_t noise;
wlan_ng_val_t rate;
wlan_ng_val_t istx;
wlan_ng_val_t frmlen;
};
The following fields are used to record information:
- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error
The remaining fields are not used./download/microsoft/osdi2006/S8microsoft/osdi2006/pcap103200705232007-06-06microsoft/osdi2006/pcap/S9A detailed trace of network activity at OSDI 2006, captured by a monitor node.A detailed trace of network activity at OSDI 2006, captured by a monitor node.the initial versionfalse2007-05-232006-11-062006-11-07The tarballs of some monitors are split across multiple files.
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c.
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar")
to get the original tarball.
The trace files collected by all the wireless and wired sniffers (S1-S10)
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.Each trace file is in the libpcap format with PRISM header. It can be
opened with standard packet parsing tools, such as Ethereal or Tcpdump.
(However, these tools might report checksum errors because of the anonymization
performed on the trace.) Note that we use several fields in the PRISM header
to encode wireless-specific information. For convenience, we include the C-style
definition of PRISM header below.
struct wlan_ng_val_t {
uint32 did;
uint16 status;
uint16 len;
uint32 data;
};
struct wlan_ng_prism_hdr_t {
uint32 msgcode;
uint32 msglen;
char devname[16];
wlan_ng_val_t hosttime;
wlan_ng_val_t mactime;
wlan_ng_val_t channel;
wlan_ng_val_t rssi;
wlan_ng_val_t sq;
wlan_ng_val_t signal;
wlan_ng_val_t noise;
wlan_ng_val_t rate;
wlan_ng_val_t istx;
wlan_ng_val_t frmlen;
};
The following fields are used to record information:
- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error
The remaining fields are not used./download/microsoft/osdi2006/S9microsoft/osdi2006/pcap104200705232007-06-06microsoft/osdi2006/pcap/S10A detailed trace of network activity at OSDI 2006, captured by a monitor node.A detailed trace of network activity at OSDI 2006, captured by a monitor node.the initial versionfalse2007-05-232006-11-062006-11-07The tarballs of some monitors are split across multiple files.
For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c.
Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar")
to get the original tarball.
The trace files collected by all the wireless and wired sniffers (S1-S10)
are included in the release package. The directory name is in the format of
'release\[sniffer]\out\[directory creation time]'. The file name is
in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file
'release\1\out\06Nov2006-0900am\A.pcap061106170025.pcap.gz' is generated
on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.Each trace file is in the libpcap format with PRISM header. It can be
opened with standard packet parsing tools, such as Ethereal or Tcpdump.
(However, these tools might report checksum errors because of the anonymization
performed on the trace.) Note that we use several fields in the PRISM header
to encode wireless-specific information. For convenience, we include the C-style
definition of PRISM header below.
struct wlan_ng_val_t {
uint32 did;
uint16 status;
uint16 len;
uint32 data;
};
struct wlan_ng_prism_hdr_t {
uint32 msgcode;
uint32 msglen;
char devname[16];
wlan_ng_val_t hosttime;
wlan_ng_val_t mactime;
wlan_ng_val_t channel;
wlan_ng_val_t rssi;
wlan_ng_val_t sq;
wlan_ng_val_t signal;
wlan_ng_val_t noise;
wlan_ng_val_t rate;
wlan_ng_val_t istx;
wlan_ng_val_t frmlen;
};
The following fields are used to record information:
- frmlen.data: frame length in bytes
- rate.data: rate in Mb/s
- rssi.data: RSSI in dbm
- channel.data: channel frequency in KHz
- mactime.data: the microsecond portion of the capture time
- mactime.did: the second portion of the capture time
- hosttime.status: capture status where 0 is normal and 1 is error
The remaining fields are not used./download/microsoft/osdi2006/S10microsoft/osdi2006/pcap123microsoft/osdi2006Ranveer Chandraranveer@microsoft.comMicrosoft ResearchNetworking Research GroupResearcherhttp://research.microsoft.com/~ranveer/31umass/dieselmicrosoft/vanlanmicrosoft/osdi2006uw/sigcomm2004tools/analyze/802.11/WitRatul Mahajanratul@microsoft.comMicrosoft Researchhttp://research.microsoft.com/~ratul/124microsoft/osdi2006Venkat Padmanabhanpadmanab@microsoft.comMicrosoft Research IndiaMobility, Networks, and Systems groupResearcherMicrosoft Research India "Scientia" 196/36 2nd Main, Sadashivnagar Bangalore 560 080 Indiahttp://research.microsoft.com/~ranveer/125microsoft/osdi2006Ming Zhangmzh@microsoft.comMicrosoft ResearchNetworking Research GroupResearcherOne Microsoft Way, Redmond, WA 98052, USAhttp://research.microsoft.com/~mzh/