CRAWDAD hasselt/glimps2015

A pcap file containing 122,989 anonymized Probe Requests sent by mobile devices at the Glimps 2015 music festival in Ghent, Belgium.

A collection of 122,989 Probe Request frames captured by 8 monitoring stations at the Glimps music festival in Ghent, Belgium (10 - 12 December 2015). To minimize overhead, each monitoring station individually stored only the transmitter MAC address and Information Elements per unique MAC. The dataset was used to show that the high entropy in Information Elements can be used to deanonymize devices that use MAC address randomization.

date/time of measurement start: 2015-12-10

date/time of measurement end: 2015-12-12

collection environment: Captured at Glimps 2015, a music festival that took place in Ghent, Belgium.

network configuration: Eight monitoring stations spread out over the city, connected via a 4G uplink to a central server.

data collection methodology: Each monitoring station captured one Probe Request per unique MAC address. Only the source MAC address and Information Elements were extracted from this frame and forwarded to the collection server over a 4G link.

limitation: Since only one Probe Request was captured per unique MAC address, this dataset should not be used to make conclusions about the frequency or timing of the Probe Requests. The intent of this dataset is to provide a collection of different (combinations of) Information Elements.

sanitization: The 3 least significant bytes of each MAC address were uniquely and consistently mapped to a different value, with exception of "ff:ff:ff" and "00:00:00".

- The SSID IE has its SSID field replaced with the string "Hidden", with exception of the wildcard (empty) SSID.

- The Vendor Specific WPS IE was replaced with a hash of its payload given the amount of sensitive information (device serial/model number, UUID, etc.) contained within it, and the length of the IE was updated accordingly. Unfortunately, Wireshark stops parsing the remainder of Probes containing this anonymized IE, so it should be noted that further parsing beyond the WPS IE must be done manually (e.g. by using Scapy or by changing the Wireshark dissector).

hole: Due to fluctuations in 4G connectivity, the nodes sometimes could not forward the Probes in time (they were buffered and sent after connectivity was restored). Therfore, the timing of the Probes should again not be used. Gaps in timing might be present due to outages.

error: Only the source MAC and Information Elements were captured by the node. This data was wrapped in a dummy Probe Request file in order to be able to store it as a pcap file. The timestamps indicate the time at which the Probe was received at the server.

Traceset

hasselt/glimps2015/information-elements

measurement purpose: Network Security

hasselt/glimps2015/information-elements/information-elements Trace 

• information-elements: Source MAC and Information Elements of observed devices wrapped in a dummy Probe Request.
• file: glimps2015/glimps2015.tar.xz
• format: pcap

The SSID IE has its SSID field replaced with the string "Hidden", with exception of the wildcard (empty) SSID.

The Vendor Specific WPS IE was replaced with a hash of its payload given the amount of sensitive information (device serial/model number, UUID, etc.) contained within it, and the length of the IE was updated accordingly. Unfortunately, Wireshark stops parsing the remainder of Probes containing this anonymized IE, so it should be noted that further parsing beyond the WPS IE must be done manually (e.g. by using Scapy or by changing the Wireshark dissector).

disruptions to data collection: Due to fluctuations in 4G connectivity, the nodes sometimes could not forward the Probes in time (they were buffered and sent after connectivity was restored). Therfore, the timing of the Probes should again not be used. Gaps in timing might be present due to outages.

error: Only the source MAC and Information Elements were captured by the node. This data was wrapped in a dummy Probe Request file in order to be able to store it as a pcap file. The timestamps indicate the time at which the Probe was received at the server.

limitation: Since only one Probe Request was captured per unique MAC address, this dataset should not be used to make conclusions about the frequency or timing of the Probe Requests. The intent of this dataset is to provide a collection of different (combinations of) Information Elements.

note: A MongoDB version of the same dataset can be found at Zenodo. https://zenodo.org/record/545970