CRAWDAD microsoft/osdi2006

Traces of network activity at OSDI 2006.

The authors gathered a detailed trace of network activity at OSDI 2006 to enable analysis of the behavior of a wireless LAN that is (presumably) heavily used.

date/time of measurement start: 2006-11-06

date/time of measurement end: 2006-11-07

collection environment: We gathered traces of wireless traffic at several monitoring nodes distributed across the conference floor and breakout areas. In addition, we gathered traces on the wired switch to which the wireless access points connect.

network configuration: The collection map ([AP-map.png] linked in this page) shows the locations of the APs and sniffers and the channels which they were operating on. There were five APs (AP8, AP9, AP10, AP11, and AP13) and these where set to one of three channels (1, 6, and 11). We used nine sniffers (S1 - S9) to gather the wireless traffic, each equipped with either one or two 802.11 NICs (labeled A and B) that are set up for sniffing. Each sniffer and the channel(s) it was set to sniff on are shown in blue in the figure. For instance, S1:6;11 means S1 is sniffing channels 6 and 11 simultaneously. Note that we also had a wired sniffer (S10, not shown in the figure) to gather traffic between the wireless subnet and the wide-area network.

data collection methodology: Each monitor captures all of the 802.11 frames it sees, including:

1. Data frames

2. Management frames (e.g., association, authentication)

3. Control frames (e.g., RTS, CTS, ACK)

For each wireless frame captured at a monitor, we record the following information:

1. Per-frame PHY information, including:

a. Channel frequency

b. RSSI

c. Modulation rate

2. Entire MAC header, with only the source and destination MAC addresses being 

anonymized as follows:

a. In real-time, the first 3 bytes of the MAC address are copied over as is. 

The last 3 bytes are replaced with a one-way hash.

b. Offline, we replace all the 3-byte MAC prefixes that occur fewer than 10 times 

with a common prefix. This ensures k-anonymity, for k=10.

3. The entire IP and TCP/UDP header, with the source and destination IP addresses 

anonymized as follows:

a. The IP address is replaced with a one-way hash.

b. In addition, we record which of the following categories the IP address belongs to:

i. Auto conf (169.254/16).

ii. Locally allocated.

iii. Other.

4. The entire DHCP payload, with the following anonymization:

a. All IP addresses (e.g., client IP address (ciaddr), your IP address (yiaddr)) are 

anonymized as in 3.

b. All MAC addresses (e.g., client hardware address (chaddr)) are anonymized as in 2.

c. All names (e.g., server name (sname)) are replaced with a one-way hash.

d. All identifying options (e.g., client identifier) are replaced with a one-way hash.

5. The DNS request/response payload, with the following anonymization/deletion:

a. The domain name in the question section is replaced with a one-way hash.

b. The resource records are deleted.

limitation: Despite the anonymization, it may be possible for some information to leak. For example, it may be 

possible to infer which website was visited based on the size of the response received. We are unable 

to obfuscate such information without damaging the data significantly.

 

Traceset

pcap

A detailed traceset of network activity at OSDI 2006.

• files: AP-map.png, 
• description: A detailed traceset of network activity at OSDI 2006 to enable analysis of the behavior of a wireless LAN that is (presumably) heavily used.

• measurement purpose: Usage Characterization
• methodology: Each monitor captures all of the 802.11 frames it sees, including:

1. Data frames

2. Management frames (e.g., association, authentication)

3. Control frames (e.g., RTS, CTS, ACK)

For each wireless frame captured at a monitor, we record the following information:

1. Per-frame PHY information, including:

a. Channel frequency

b. RSSI

c. Modulation rate

2. Entire MAC header, with only the source and destination MAC addresses being 

anonymized as follows:

a. In real-time, the first 3 bytes of the MAC address are copied over as is. 

The last 3 bytes are replaced with a one-way hash.

b. Offline, we replace all the 3-byte MAC prefixes that occur fewer than 10 times 

with a common prefix. This ensures k-anonymity, for k=10.

3. The entire IP and TCP/UDP header, with the source and destination IP addresses 

anonymized as follows:

a. The IP address is replaced with a one-way hash.

b. In addition, we record which of the following categories the IP address belongs to:

i. Auto conf (169.254/16).

ii. Locally allocated.

iii. Other.

4. The entire DHCP payload, with the following anonymization:

a. All IP addresses (e.g., client IP address (ciaddr), your IP address (yiaddr)) are 

anonymized as in 3.

b. All MAC addresses (e.g., client hardware address (chaddr)) are anonymized as in 2.

c. All names (e.g., server name (sname)) are replaced with a one-way hash.

d. All identifying options (e.g., client identifier) are replaced with a one-way hash.

5. The DNS request/response payload, with the following anonymization/deletion:

a. The domain name in the question section is replaced with a one-way hash.

b. The resource records are deleted.

pcap Traces

• S1: A detailed trace of network activity at OSDI 2006, captured by a monitor node.
• configuration: The tarballs of some monitors are split across multiple files. For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c; S1.tar") to get the original tarball.

The trace files collected by all the wireless and wired sniffers (S1-S10) are included in the release package. The directory name is in the format of 'release[sniffer]/out[directory creation time]'. The file name is in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file 'S1/06Nov2006-0900am/A.pcap061106170025.pcap.gz' is generated on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

• format: Each trace file is in the libpcap format with PRISM header. It can be opened with standard packet parsing tools, such as Ethereal or Tcpdump. (However, these tools might report checksum errors because of the anonymization performed on the trace.) Note that we use several fields in the PRISM header to encode wireless-specific information. For convenience, we include the C-style definition of PRISM header below.

struct wlan_ng_val_t {

uint32 did;

uint16 status;

uint16 len;

uint32 data;

};

struct wlan_ng_prism_hdr_t {

uint32 msgcode;

uint32 msglen;

char devname[16];

wlan_ng_val_t hosttime;

wlan_ng_val_t mactime;

wlan_ng_val_t channel;

wlan_ng_val_t rssi;

wlan_ng_val_t sq;

wlan_ng_val_t signal;

wlan_ng_val_t noise;

wlan_ng_val_t rate;

wlan_ng_val_t istx;

wlan_ng_val_t frmlen;

};

The following fields are used to record information:

- frmlen.data: frame length in bytes

- rate.data: rate in Mb/s

- rssi.data: RSSI in dbm

- channel.data: channel frequency in KHz

- mactime.data: the microsecond portion of the capture time

- mactime.did: the second portion of the capture time

- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

• S2: A detailed trace of network activity at OSDI 2006, captured by a monitor node.
• configuration: The tarballs of some monitors are split across multiple files. For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c > S1.tar") to get the original tarball.

The trace files collected by all the wireless and wired sniffers (S1-S10)  are included in the release package. The directory name is in the format of 'release[sniffer]/out[directory creation time]'. The file name is in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file 'S1/06Nov2006-0900am/A.pcap061106170025.pcap.gz' is generated on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

• format: Each trace file is in the libpcap format with PRISM header. It can be opened with standard packet parsing tools, such as Ethereal or Tcpdump. (However, these tools might report checksum errors because of the anonymization performed on the trace.) Note that we use several fields in the PRISM header to encode wireless-specific information. For convenience, we include the C-style definition of PRISM header below.

struct wlan_ng_val_t {

uint32 did;

uint16 status;

uint16 len;

uint32 data;

};

struct wlan_ng_prism_hdr_t {

uint32 msgcode;

uint32 msglen;

char devname[16];

wlan_ng_val_t hosttime;

wlan_ng_val_t mactime;

wlan_ng_val_t channel;

wlan_ng_val_t rssi;

wlan_ng_val_t sq;

wlan_ng_val_t signal;

wlan_ng_val_t noise;

wlan_ng_val_t rate;

wlan_ng_val_t istx;

wlan_ng_val_t frmlen;

};

The following fields are used to record information:

- frmlen.data: frame length in bytes

- rate.data: rate in Mb/s

- rssi.data: RSSI in dbm

- channel.data: channel frequency in KHz

- mactime.data: the microsecond portion of the capture time

- mactime.did: the second portion of the capture time

- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

• S3: A detailed trace of network activity at OSDI 2006, captured by a monitor node.
• configuration: The tarballs of some monitors are split across multiple files. For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c S1.tar") to get the original tarball.

  The trace files collected by all the wireless and wired sniffers (S1-S10) are included in the release package. The directory name is in the format of 'release[sniffer]/out[directory creation time]'. The file name is in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file 'S1/06Nov2006-0900am/A.pcap061106170025.pcap.gz' is generated on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

• format: Each trace file is in the libpcap format with PRISM header. It can be opened with standard packet parsing tools, such as Ethereal or Tcpdump. (However, these tools might report checksum errors because of the anonymization performed on the trace.) Note that we use several fields in the PRISM header to encode wireless-specific information. For convenience, we include the C-style definition of PRISM header below.

struct wlan_ng_val_t {

uint32 did;

uint16 status;

uint16 len;

uint32 data;

};

struct wlan_ng_prism_hdr_t {

uint32 msgcode;

uint32 msglen;

char devname[16];

wlan_ng_val_t hosttime;

wlan_ng_val_t mactime;

wlan_ng_val_t channel;

wlan_ng_val_t rssi;

wlan_ng_val_t sq;

wlan_ng_val_t signal;

wlan_ng_val_t noise;

wlan_ng_val_t rate;

wlan_ng_val_t istx;

wlan_ng_val_t frmlen;

};

The following fields are used to record information:

- frmlen.data: frame length in bytes

- rate.data: rate in Mb/s

- rssi.data: RSSI in dbm

- channel.data: channel frequency in KHz

- mactime.data: the microsecond portion of the capture time

- mactime.did: the second portion of the capture time

- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

• S4: A detailed trace of network activity at OSDI 2006, captured by a monitor node.
• configuration: The tarballs of some monitors are split across multiple files. For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c S1.tar") to get the original tarball.

  The trace files collected by all the wireless and wired sniffers (S1-S10) are included in the release package. The directory name is in the format of 'release[sniffer]/out[directory creation time]'. The file name is in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file 'S1/06Nov2006-0900am/A.pcap061106170025.pcap.gz' is generated on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

• format: Each trace file is in the libpcap format with PRISM header. It can be opened with standard packet parsing tools, such as Ethereal or Tcpdump. (However, these tools might report checksum errors because of the anonymization performed on the trace.) Note that we use several fields in the PRISM header to encode wireless-specific information. For convenience, we include the C-style definition of PRISM header below.

struct wlan_ng_val_t {

uint32 did;

uint16 status;

uint16 len;

uint32 data;

};

struct wlan_ng_prism_hdr_t {

uint32 msgcode;

uint32 msglen;

char devname[16];

wlan_ng_val_t hosttime;

wlan_ng_val_t mactime;

wlan_ng_val_t channel;

wlan_ng_val_t rssi;

wlan_ng_val_t sq;

wlan_ng_val_t signal;

wlan_ng_val_t noise;

wlan_ng_val_t rate;

wlan_ng_val_t istx;

wlan_ng_val_t frmlen;

};

The following fields are used to record information:

- frmlen.data: frame length in bytes

- rate.data: rate in Mb/s

- rssi.data: RSSI in dbm

- channel.data: channel frequency in KHz

- mactime.data: the microsecond portion of the capture time

- mactime.did: the second portion of the capture time

- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

• S5: A detailed trace of network activity at OSDI 2006, captured by a monitor node.
• configuration: The tarballs of some monitors are split across multiple files. For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c S1.tar") to get the original tarball.

  The trace files collected by all the wireless and wired sniffers (S1-S10) are included in the release package. The directory name is in the format of 'release[sniffer]/out[directory creation time]'. The file name is in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file 'S1/06Nov2006-0900am/A.pcap061106170025.pcap.gz' is generated on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

• format: Each trace file is in the libpcap format with PRISM header. It can be opened with standard packet parsing tools, such as Ethereal or Tcpdump. (However, these tools might report checksum errors because of the anonymization performed on the trace.) Note that we use several fields in the PRISM header to encode wireless-specific information. For convenience, we include the C-style definition of PRISM header below.

struct wlan_ng_val_t {

uint32 did;

uint16 status;

uint16 len;

uint32 data;

};

struct wlan_ng_prism_hdr_t {

uint32 msgcode;

uint32 msglen;

char devname[16];

wlan_ng_val_t hosttime;

wlan_ng_val_t mactime;

wlan_ng_val_t channel;

wlan_ng_val_t rssi;

wlan_ng_val_t sq;

wlan_ng_val_t signal;

wlan_ng_val_t noise;

wlan_ng_val_t rate;

wlan_ng_val_t istx;

wlan_ng_val_t frmlen;

};

The following fields are used to record information:

- frmlen.data: frame length in bytes

- rate.data: rate in Mb/s

- rssi.data: RSSI in dbm

- channel.data: channel frequency in KHz

- mactime.data: the microsecond portion of the capture time

- mactime.did: the second portion of the capture time

- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

• S6: A detailed trace of network activity at OSDI 2006, captured by a monitor node.
• configuration: The tarballs of some monitors are split across multiple files. For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c S1.tar") to get the original tarball.

  The trace files collected by all the wireless and wired sniffers (S1-S10) are included in the release package. The directory name is in the format of 'release[sniffer]/out[directory creation time]'. The file name is in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file 'S1/06Nov2006-0900am/A.pcap061106170025.pcap.gz' is generated on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

• format: Each trace file is in the libpcap format with PRISM header. It can be opened with standard packet parsing tools, such as Ethereal or Tcpdump. (However, these tools might report checksum errors because of the anonymization performed on the trace.) Note that we use several fields in the PRISM header to encode wireless-specific information. For convenience, we include the C-style definition of PRISM header below.

struct wlan_ng_val_t {

uint32 did;

uint16 status;

uint16 len;

uint32 data;

};

struct wlan_ng_prism_hdr_t {

uint32 msgcode;

uint32 msglen;

char devname[16];

wlan_ng_val_t hosttime;

wlan_ng_val_t mactime;

wlan_ng_val_t channel;

wlan_ng_val_t rssi;

wlan_ng_val_t sq;

wlan_ng_val_t signal;

wlan_ng_val_t noise;

wlan_ng_val_t rate;

wlan_ng_val_t istx;

wlan_ng_val_t frmlen;

};

The following fields are used to record information:

- frmlen.data: frame length in bytes

- rate.data: rate in Mb/s

- rssi.data: RSSI in dbm

- channel.data: channel frequency in KHz

- mactime.data: the microsecond portion of the capture time

- mactime.did: the second portion of the capture time

- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

• S7: A detailed trace of network activity at OSDI 2006, captured by a monitor node.
• configuration: The tarballs of some monitors are split across multiple files. For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c S1.tar") to get the original tarball.

  The trace files collected by all the wireless and wired sniffers (S1-S10) are included in the release package. The directory name is in the format of 'release[sniffer]/out[directory creation time]'. The file name is in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file 'S1/06Nov2006-0900am/A.pcap061106170025.pcap.gz' is generated on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

• format: Each trace file is in the libpcap format with PRISM header. It can be opened with standard packet parsing tools, such as Ethereal or Tcpdump. (However, these tools might report checksum errors because of the anonymization performed on the trace.) Note that we use several fields in the PRISM header to encode wireless-specific information. For convenience, we include the C-style definition of PRISM header below.

struct wlan_ng_val_t {

uint32 did;

uint16 status;

uint16 len;

uint32 data;

};

struct wlan_ng_prism_hdr_t {

uint32 msgcode;

uint32 msglen;

char devname[16];

wlan_ng_val_t hosttime;

wlan_ng_val_t mactime;

wlan_ng_val_t channel;

wlan_ng_val_t rssi;

wlan_ng_val_t sq;

wlan_ng_val_t signal;

wlan_ng_val_t noise;

wlan_ng_val_t rate;

wlan_ng_val_t istx;

wlan_ng_val_t frmlen;

};

The following fields are used to record information:

- frmlen.data: frame length in bytes

- rate.data: rate in Mb/s

- rssi.data: RSSI in dbm

- channel.data: channel frequency in KHz

- mactime.data: the microsecond portion of the capture time

- mactime.did: the second portion of the capture time

- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

• S8: A detailed trace of network activity at OSDI 2006, captured by a monitor node.
• configuration: The tarballs of some monitors are split across multiple files. For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c S1.tar") to get the original tarball.

  The trace files collected by all the wireless and wired sniffers (S1-S10) are included in the release package. The directory name is in the format of 'release[sniffer]/out[directory creation time]'. The file name is in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file 'S1/06Nov2006-0900am/A.pcap061106170025.pcap.gz' is generated on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

• format: Each trace file is in the libpcap format with PRISM header. It can be opened with standard packet parsing tools, such as Ethereal or Tcpdump. (However, these tools might report checksum errors because of the anonymization performed on the trace.) Note that we use several fields in the PRISM header to encode wireless-specific information. For convenience, we include the C-style definition of PRISM header below.

struct wlan_ng_val_t {

uint32 did;

uint16 status;

uint16 len;

uint32 data;

};

struct wlan_ng_prism_hdr_t {

uint32 msgcode;

uint32 msglen;

char devname[16];

wlan_ng_val_t hosttime;

wlan_ng_val_t mactime;

wlan_ng_val_t channel;

wlan_ng_val_t rssi;

wlan_ng_val_t sq;

wlan_ng_val_t signal;

wlan_ng_val_t noise;

wlan_ng_val_t rate;

wlan_ng_val_t istx;

wlan_ng_val_t frmlen;

};

The following fields are used to record information:

- frmlen.data: frame length in bytes

- rate.data: rate in Mb/s

- rssi.data: RSSI in dbm

- channel.data: channel frequency in KHz

- mactime.data: the microsecond portion of the capture time

- mactime.did: the second portion of the capture time

- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

• S9: A detailed trace of network activity at OSDI 2006, captured by a monitor node.
• configuration: The tarballs of some monitors are split across multiple files. For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c S1.tar") to get the original tarball.

  The trace files collected by all the wireless and wired sniffers (S1-S10) are included in the release package. The directory name is in the format of 'release[sniffer]/out[directory creation time]'. The file name is in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file 'S1/06Nov2006-0900am/A.pcap061106170025.pcap.gz' is generated on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

• format: Each trace file is in the libpcap format with PRISM header. It can be opened with standard packet parsing tools, such as Ethereal or Tcpdump. (However, these tools might report checksum errors because of the anonymization performed on the trace.) Note that we use several fields in the PRISM header to encode wireless-specific information. For convenience, we include the C-style definition of PRISM header below.

struct wlan_ng_val_t {

uint32 did;

uint16 status;

uint16 len;

uint32 data;

};

struct wlan_ng_prism_hdr_t {

uint32 msgcode;

uint32 msglen;

char devname[16];

wlan_ng_val_t hosttime;

wlan_ng_val_t mactime;

wlan_ng_val_t channel;

wlan_ng_val_t rssi;

wlan_ng_val_t sq;

wlan_ng_val_t signal;

wlan_ng_val_t noise;

wlan_ng_val_t rate;

wlan_ng_val_t istx;

wlan_ng_val_t frmlen;

};

The following fields are used to record information:

- frmlen.data: frame length in bytes

- rate.data: rate in Mb/s

- rssi.data: RSSI in dbm

- channel.data: channel frequency in KHz

- mactime.data: the microsecond portion of the capture time

- mactime.did: the second portion of the capture time

- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.

• S10: A detailed trace of network activity at OSDI 2006, captured by a monitor node.
• configuration: The tarballs of some monitors are split across multiple files. For instance, S1.tar is split across S1.tar-a, S1.tar-b and S1.tar-c. Combine these (e.g., using "cat S1.tar-a S1.tar-b S1.tar-c S1.tar") to get the original tarball.

  The trace files collected by all the wireless and wired sniffers (S1-S10) are included in the release package. The directory name is in the format of 'release[sniffer]/out[directory creation time]'. The file name is in the format of '[NIC].pcap[YYMMDDHHMMSS].pcap.gz. For instance, the file 'S1/06Nov2006-0900am/A.pcap061106170025.pcap.gz' is generated on Nov 6, 2006 at 17:00:25 UTC (09:00:25 PST) by NIC A on S1.

• format: Each trace file is in the libpcap format with PRISM header. It can be opened with standard packet parsing tools, such as Ethereal or Tcpdump. (However, these tools might report checksum errors because of the anonymization performed on the trace.) Note that we use several fields in the PRISM header to encode wireless-specific information. For convenience, we include the C-style definition of PRISM header below.

struct wlan_ng_val_t {

uint32 did;

uint16 status;

uint16 len;

uint32 data;

};

struct wlan_ng_prism_hdr_t {

uint32 msgcode;

uint32 msglen;

char devname[16];

wlan_ng_val_t hosttime;

wlan_ng_val_t mactime;

wlan_ng_val_t channel;

wlan_ng_val_t rssi;

wlan_ng_val_t sq;

wlan_ng_val_t signal;

wlan_ng_val_t noise;

wlan_ng_val_t rate;

wlan_ng_val_t istx;

wlan_ng_val_t frmlen;

};

The following fields are used to record information:

- frmlen.data: frame length in bytes

- rate.data: rate in Mb/s

- rssi.data: RSSI in dbm

- channel.data: channel frequency in KHz

- mactime.data: the microsecond portion of the capture time

- mactime.did: the second portion of the capture time

- hosttime.status: capture status where 0 is normal and 1 is error

The remaining fields are not used.