# Artifact: defining and analyzing smart device passive mode

Christian Badolato, Kaur Kullman, Nikolaos Papadakis, Manav Bhatt, Georgios Bouloukakis, Don Engel, Roberto Yus

► To cite this version:

Christian Badolato, Kaur Kullman, Nikolaos Papadakis, Manav Bhatt, Georgios Bouloukakis, et al.. Artifact: defining and analyzing smart device passive mode. IEEE PerCom Workshops - 23rd International Conference on Pervasive Computing and Communications (PerCom 2025), Mar 2025, Washington DC, United States. hal-05001580

HAL Id: hal-05001580

https://inria.hal.science/hal-05001580v1

Submitted on 22 Mar 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# Artifact: Defining and Analyzing Smart Device
Passive Mode

Christian Badolato†, Kaur Kullman†, Nikolaos Papadakis*, Manav Bhatt†,

Georgios Bouloukakis*, Don Engel†, Roberto Yus†

{cbad1, kak, manavb1, donengel, ryus}@umbc.edu, {nikolaos.papadakis, georgios.bouloukakis}@telecom-sudparis.eu

†Dept. of Computer Science and Electrical Engineering, University of Maryland, Baltimore County, USA

*Télécom SudParis, Institut Polytechnique de Paris, France

## I. INTRODUCTION

This artifact paper presents a guide for the Smart Home IoT Passive Mode Analysis tool and dataset [1] to perform network traffic analysis (NTA) on smart home IoT devices in passive mode [2]. The repository includes: 1) scripts and configurations for processing network traffic capture files and extracting the relevant information; 2) output data files for the experiments conducted in [2]; and 3) a link to the raw network capture dataset used in [2]. The dataset contains 12GB of passive mode traffic from 32 devices across 3 testbeds; between 71 and 196 hours of traffic is present for each device.

The scripts provided to process and extract information from traffic capture files follow the pipeline shown in Figure 1.

<figure><img src="image_2.png" /><figcaption>Fig. 1. Overview of the analysis pipeline.</figcaption></figure>

## II. ANALYZING PASSIVE MODES

We describe the steps to extract volume, protocol, and endpoint statistics from a PCAP-formatted network traffic capture file in the same manner as [2]. Example pipeline outputs and further code execution details, including templates for all required configuration files, can be found in [1].

### A. Prerequisites

The scripts have been tested on Ubuntu 22.04, and are expected to be compatible with most Linux operating systems. Python3 (version ≥ 3.11) [3] and Tshark (version ≥ 4.2.6) [4] are required for execution. The full list of Python library dependencies can be installed with the command:

> pip install -r requirements.txt

The steps below can be used to re-analyze the dataset provided in the repository or to analyze other datasets. User-created datasets should be in the form of PCAP-formatted, continuous capture files which contain only passive mode traffic as defined in [2]. Users may request their dataset and analysis files be added to the repository for public usage through the steps outlined in the repository's README file.

### B. Processing Capture Files

A master capture file can be split into an easier-to-analyze group of filtered, device-specific capture files using the `processPcap.bash` script in the repository's `bash` directory. The following command executes the script:

> ./processPcap.bash capture_file mac_file output_dir start_epoch end_epoch

Here, `capture_file` is the path to the master capture file, `mac_file` is the path to a configuration text file containing a mapping of device names to MAC addresses, and `output_dir` is the desired output directory. The optional parameters `start_epoch` and `end_epoch` can be used to process a subset of the capture file, where the desired start and end times are provided as epoch timestamps.

If a user would like more control over how a capture file is processed, they may use the various filtering and splitting scripts provided in the `bash helpers` directory. Details on the execution of these scripts is provided in the repository.

### C. Extracting Transceived Volume Information

Extracting traffic volume is performed in two steps: extracting overall statistics, and calculating the averages, coefficients of variation (CoVs), and distributions of the transceived data.

1) Overall Statistics: Statistics on the number of packets and bytes transceived by the devices (aggregated periodically at a specified interval) are extracted using the `generateStatsForIntervals.bash` script. The following command executes the script:

> ./generateStatsForIntervals.bash capture_file_or_dir mac_file interval_secs device_suffix
In this script, *mac_file* is identical to Section II-B. The *capture_file_or_dir* parameter is the path to a capture file or directory of capture files for which to generate statistics; if a directory is provided, capture files intended to be extracted for a given device's traffic must have the name of the device (as defined in the *mac_file*) within the name of the capture file. For example, to process a capture file for the device "MyCamera", the file must contain the term "MyCamera" within its name; processing a single capture file does not have this limitation. The *interval_secs* parameter specifies the periodic intervals over which to aggregate the statistics, and *device_suffix* is a string appended to the device names in the output files to allow for disambiguation between identically named devices across different executions of this script. The script generates three output files for each device MAC searched in a given PCAP file: one containing LAN statistics, one containing WAN statistics, and one containing the combined statistics.

For example, the following command would generate three output files containing per-hour statistics of a Google Nest, assuming *nest.txt* contains a mapping of "GoogleNest" to a MAC address, and *GoogleNest.pcap* contains passive mode traffic associated with that MAC address:

> ./generateStatsForIntervals.bash GoogleNest.pcap
nest.txt 3600 "(Run 1)"

2) *Interval-Based Statistics and Volume Distributions:* The script *calculate_overall_stats.py* uses the statistics files to calculate the per-device averages and CoVs over the specified time intervals. It also calculates the distribution of transmitted versus received traffic for WAN, LAN, and combined communications. The script takes one parameter, *input_dir*, which is the path to the directory containing the volume statistics files. The following executes the script:

> python3 calculate_overall_stats.py input_dir

Two output files are generated by this script. One provides the distribution of transceived bytes and packets across total, WAN, and LAN traffic for each device, the other contains average transmission volumes and CoVs for the devices.

### D. Extracting Protocol Information

Extracting protocol information is performed in two steps: extracting overall protocol statistics, and calculating the distribution of protocol types (*management*, *discovery*, *encrypted application-specific*, and *unencrypted application-specific*).

1) *Overall Statistics:* The *parse_protocols.py* script can be used to extract the breakdown of detected protocols split by endpoint. The script is executed using the command:

> python3 parse_protocols.py input_csv

Each line of the *input_csv* must contain a path to a PCAP file and a MAC address to analyze. If a single file should be analyzed for multiple MAC addresses, it should appear on multiple lines with different MAC addresses.

The script generates three output files for each line in the *input_csv*: one containing LAN statistics, one containing WAN statistics, and one containing the combined statistics.

### E. Protocol Types and Distributions

The protocol statistics files can be fed into the *calculate_protocol_stats.py* script to identify the complete list of protocols used by all devices, extract the protocols used by particular devices, and calculate the distribution of protocol types. The script takes one parameter, *input_dir*, which is the path to the directory containing the protocol statistic files. The full command is as follows:

> python3 calculate_protocol_stats.py input_dir

Three output files are generated by this script. One containing the distribution of protocol types for each device, one enumerating each protocol used by each device, and one enumerating all protocols found across all devices. The last file is a template file intended for recording the purpose of each protocol.

### F. Extracting Endpoint Information

Endpoint information is extracted in two steps: extracting overall statistics, and calculating the protocol type distribution for each endpoint class (*first*, *support*, *third*, and *local*).

1) *Overall Statistics:* A breakdown of the endpoints contacted by a device, including identified hostnames, ASN and WHOIS information, certificate information, and packet statistics can be generated with *parse_endpoints.py* using:

> python3 parse_endpoints.py input_csv

where *input_csv* contains one PCAP file to analyze per line. The output of this script is a single CSV file per device which contains all discovered information for each endpoint contacted by that device. As these scripts cannot automatically assign a class to each endpoint. The user must manually record the type of each endpoint in this file before continuing.

2) *Endpoint Type and Endpoint-to-Protocol Distributions:* Once the protocol and endpoint statistic files have been generated and the endpoints have been classified, *calculate_endpoint_stats.py* is used to calculate the distribution of transceived traffic and protocol types used to contact each endpoint class. The script is executed using:

> python3 calculate_endpoint_stats.py input_csv

Here each line of *input_csv* contains the name of a device to analyze, one or more paths to endpoint statistic files for the device (semicolon delimited), and one or more paths to protocol statistic files for the device (semicolon delimited). Supporting multiple protocol and endpoint files allows both IP and IPv6 information to be processed in a single pass.

Three output files are generated. One containing the distribution of traffic transceived with each endpoint, one containing the distribution of protocol types used for each endpoint class, and one providing LAN-specific communication data.

## REFERENCES

[1] "Smart Home IoT Passive Mode Analysis." https://github.com/DAMSlabUMBC/Passive-Mode-Study

[2] C. Badolato, K. Kullman, N. Papadakis, M. Bhatt, G. Bouloukakis, D. Engel, and R. Yus, "Your smart home exchanged 3m messages: Defining and analyzing smart device passive mode," in *IEEE Int. Conference on Pervasive Computing and Communications (PerCom)*. IEEE, 2025.

[3] Python Software Foundation, "Python," 2025. https://www.python.org/

[4] Wireshark Foundation, "Tshark," 2019. https://tshark.dev/