This is an old revision of the document!
I was curious to see how much I could detect with an off the shelf setup. Here are the numbers so far:
Raw size: 2,077,031,816 bytes (2.0Gb) (14,991,993 lines of tcpdump data)
2019-09-11 22:21 to 2019-09-19 06:13 (approx 7 days, 7 hours and 52 minutes)
Unique MAC addresses seen: 68,298
MAC addresses seen only once at all | 25,318 |
MAC addresses seen 2-9 times | 37,436 |
MAC addresses seen 10-99 times | 4,917 |
MAC addresses seen 100-999 times | 399 |
MAC addresses seen 1,000-9,999 times | 119 |
MAC addresses seen 10,000-99,999 times | 74 |
MAC addresses seen 100,000-999,999 times | 42 |
MAC addresses seen 1million+ times | 4 |
If a MAC address is observed at least once in any single minute long period (they could be consecutive minutes), how many times does that happen?
MAC addresses seen 1 distinct minute/time | 2,108 |
MAC addresses seen on 2 distinct minutes | 2,859 |
MAC addresses seen on 3 distinct minutes | 1,030 |
MAC addresses seen on 4 distinct minutes | 558 |
MAC addresses seen on 5 distinct minutes | 336 |
MAC addresses seen on 6 distinct minutes | 217 |
MAC addresses seen on 7 distinct minutes | 151 |
MAC addresses seen on 8 distinct minutes | 137 |