CRAWDAD hasselt/glimps2015

Citation Author(s):
Pieter
Robyns
Hasselt University
Bram
Bonné
Peter
Quax
Wim
Lamotte
Submitted by:
CRAWDAD Team
Last updated:
Thu, 05/11/2017 - 08:00
DOI:
10.15783/c7sd19
License:
29 Views
Categories:
Keywords:
0
0 ratings - Please login to submit your rating.

Abstract 

A pcap file containing 122,989 anonymized Probe Requests sent by mobile devices at the Glimps 2015 music festival in Ghent, Belgium.

A collection of 122,989 Probe Request frames captured by 8 monitoring stations at the Glimps music festival in Ghent, Belgium (10 - 12 December 2015). To minimize overhead, each monitoring station individually stored only the transmitter MAC address and Information Elements per unique MAC. The dataset was used to show that the high entropy in Information Elements can be used to deanonymize devices that use MAC address randomization.

date/time of measurement start: 2015-12-10

date/time of measurement end: 2015-12-12

collection environment: Captured at Glimps 2015, a music festival that took place in Ghent, Belgium.

network configuration: Eight monitoring stations spread out over the city, connected via a 4G uplink to a central server.

data collection methodology: Each monitoring station captured one Probe Request per unique MAC address. Only the source MAC address and Information Elements were extracted from this frame and forwarded to the collection server over a 4G link.

limitation: Since only one Probe Request was captured per unique MAC address, this dataset should not be used to make conclusions about the frequency or timing of the Probe Requests. The intent of this dataset is to provide a collection of different (combinations of) Information Elements.

sanitization: The 3 least significant bytes of each MAC address were uniquely and consistently mapped to a different value, with exception of "ff:ff:ff" and "00:00:00".

- The SSID IE has its SSID field replaced with the string "Hidden", with exception of the wildcard (empty) SSID.

- The Vendor Specific WPS IE was replaced with a hash of its payload given the amount of sensitive information (device serial/model number, UUID, etc.) contained within it, and the length of the IE was updated accordingly. Unfortunately, Wireshark stops parsing the remainder of Probes containing this anonymized IE, so it should be noted that further parsing beyond the WPS IE must be done manually (e.g. by using Scapy or by changing the Wireshark dissector).

hole: Due to fluctuations in 4G connectivity, the nodes sometimes could not forward the Probes in time (they were buffered and sent after connectivity was restored). Therfore, the timing of the Probes should again not be used. Gaps in timing might be present due to outages.

error: Only the source MAC and Information Elements were captured by the node. This data was wrapped in a dummy Probe Request file in order to be able to store it as a pcap file. The timestamps indicate the time at which the Probe was received at the server.

Traceset

hasselt/glimps2015/information-elements

measurement purpose: Network Security

hasselt/glimps2015/information-elements/information-elements Trace 

  • information-elements: Source MAC and Information Elements of observed devices wrapped in a dummy Probe Request.
    • file: glimps2015/glimps2015.tar.xz
    • format: pcap

The SSID IE has its SSID field replaced with the string "Hidden", with exception of the wildcard (empty) SSID.

The Vendor Specific WPS IE was replaced with a hash of its payload given the amount of sensitive information (device serial/model number, UUID, etc.) contained within it, and the length of the IE was updated accordingly. Unfortunately, Wireshark stops parsing the remainder of Probes containing this anonymized IE, so it should be noted that further parsing beyond the WPS IE must be done manually (e.g. by using Scapy or by changing the Wireshark dissector).

disruptions to data collection: Due to fluctuations in 4G connectivity, the nodes sometimes could not forward the Probes in time (they were buffered and sent after connectivity was restored). Therfore, the timing of the Probes should again not be used. Gaps in timing might be present due to outages.

error: Only the source MAC and Information Elements were captured by the node. This data was wrapped in a dummy Probe Request file in order to be able to store it as a pcap file. The timestamps indicate the time at which the Probe was received at the server.

limitation: Since only one Probe Request was captured per unique MAC address, this dataset should not be used to make conclusions about the frequency or timing of the Probe Requests. The intent of this dataset is to provide a collection of different (combinations of) Information Elements.

note: A MongoDB version of the same dataset can be found at Zenodo. https://zenodo.org/record/545970

Instructions: 

The files in this directory are a CRAWDAD dataset hosted by IEEE DataPort. 

About CRAWDAD: the Community Resource for Archiving Wireless Data At Dartmouth is a data resource for the research community interested in wireless networks and mobile computing. 

CRAWDAD was founded at Dartmouth College in 2004, led by Tristan Henderson, David Kotz, and Chris McDonald. CRAWDAD datasets are hosted by IEEE DataPort as of November 2022. 

Note: Please use the Data in an ethical and responsible way with the aim of doing no harm to any person or entity for the benefit of society at large. Please respect the privacy of any human subjects whose wireless-network activity is captured by the Data and comply with all applicable laws, including without limitation such applicable laws pertaining to the protection of personal information, security of data, and data breaches. Please do not apply, adapt or develop algorithms for the extraction of the true identity of users and other information of a personal nature, which might constitute personally identifiable information or protected health information under any such applicable laws. Do not publish or otherwise disclose to any other person or entity any information that constitutes personally identifiable information or protected health information under any such applicable laws derived from the Data through manual or automated techniques. 

Please acknowledge the source of the Data in any publications or presentations reporting use of this Data. 

Citation:

Pieter Robyns, Bram Bonné, Peter Quax, Wim Lamotte, hasselt/glimps2015, https://doi.org/10.15783/c7sd19 , Date: 20170511

 

Dataset Files

LOGIN TO ACCESS DATASET FILES
Open Access dataset files are accessible to all logged in  users. Don't have a login?  Create a free IEEE account.  IEEE Membership is not required.

Documentation

AttachmentSize
File hasselt-glimps2015-readme.txt1.6 KB

These datasets are part of Community Resource for Archiving Wireless Data (CRAWDAD). CRAWDAD began in 2004 at Dartmouth College as a place to share wireless network data with the research community. Its purpose was to enable access to data from real networks and real mobile users at a time when collecting such data was challenging and expensive. The archive has continued to grow since its inception, and starting in summer 2022 is being housed on IEEE DataPort.

Questions about CRAWDAD? See our CRAWDAD FAQ. Interested in submitting your dataset to the CRAWDAD collection? Get started, by submitting an Open Access Dataset.