## 5 Results
### Dataset Generation  
To transform raw packet data into an analyzable structure, the captured network.pcap files were processed using Zeek v6.0.0, producing.log files. The number of.log files generated will depend on the characteristics of the captured network traffic. These logs contain rich metadata describing each network session, including protocol types, session durations, endpoints (IP and port), packet sizes, request and response times, and many others. The logs also include detailed application-layer information where protocols permit this, for example, MQTT topics and payload lengths, HTTP URIs and status codes, or CoAP request methods.  
Between February and March 2025, sixteen data collection sessions were conducted, with durations ranging from 32 min to nearly 5 h. The total runtime was approximately 54 h and 15 min, with an average of 3 h and 36 min per session. This resulted in 16 PCAP files, which were preprocessed using Zeek to generate 103.log files, totaling 33 MB. In total, 164,133 packets were captured, with an average size of 189 bytes and a transmission rate of approximately 7 bytes per second.  
This process ensured a clean and high-fidelity dataset, making it a useful resource for researchers who wish to work with realistic data, rather than using datasets generated by simulations. These logs include metadata such as  
* Protocol type and ports.
* Transport- and application-layer metadata.
* Session duration, payload sizes, and message lengths, among others.
* Protocol-specific details (e.g., MQTT topics, HTTP URIs, CoAP methods).  
Table 7 provides a summary of the most relevant.log files, highlighting their purpose and the key fields they contain.  
The resulting dataset was organized into structured directories that included raw PCAP files, Zeek-generated log outputs, and supporting documentation. Each directory corresponded to a specific capture date when all experimental scenarios were run simultaneously.  
While the dataset includes detailed network-level information captured using Zeek, it currently does not include logs extracted directly from LoRaWAN gateways or backend devices, such as authentication events or other system metrics. Future iterations of the laboratory will incorporate these logs, to enrich the dataset and support AI studies and anomaly detection. In addition, the laboratory is designed to support adversarial experiments in future work, allowing the introduction of spoofing, DoS, or replay attacks in a controlled manner, to enrich the dataset for intrusion detection benchmarking.  
\begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Scenario** & **Connectivity** & **Protocol Type** & **Data Capture** & **Main Contribution** \\ \hline LoRaWAN TTN & Long-range, cloud-based & LoRaWAN + MQTT & No & Cloud integration with TTN \\ LoRaWAN ABP & Long-range, local/offline & LoRaWAN + MQTT & No & Fully autonomous LoRaWAN deployment \\ WiFi + MQTT & Short-range, local & MQTT over TCP & PCAP + Zeek & Lightweight publish/subscribe messaging \\ WiFi + HTTP & Short-range, local & HTTP over TCP & PCAP + Zeek & Standard request/response communication \\ WiFi + UDP & Short-range, local & UDP (no session) & PCAP + Zeek & Low-latency packet transmission \\ WiFi + CoAP & Short-range, local & CoAP over UDP & PCAP + Zeek & Efficient protocol for constrained devices \\ \hline \hline \end{tabular}
\end{table}
Table 6: Characteristics of experimental scenarios (connectivity, protocol type, data capture, main contribution).