A Private Ethereum Testbed for Network Traffic Dataset Collection

Abstract

Ethereum has emerged as one of the most widely used blockchain platforms, underpinning decentralized finance, smart contracts, and distributed applications. With its growing adoption, the Ethereum peer-to-peer network is susceptible to networklayer attacks including eclipse (node-isolation) attacks. To study the threats to Ethereum and to develop effective detection and mitigation strategies, researchers require controlled, reproducible, and labeled network datasets. However, datasets are scarce due to the complexity of capturing live blockchain traffic and the difficulty of confidently labeling malicious activity on public networks. In this paper, we present the design and deployment of a private Ethereum testbed for dataset collection. Our testbed consists of five virtual machines running Geth clients interconnected via a controlled gateway: four nodes act as benign Ethereum peers and one node acts as a malicious entity that performs eclipse attacks. The testbed emulates normal blockchain operations (block propagation, transaction exchanges, and peer discovery) and adversarial scenarios focused on node isolation. Wireshark is deployed on the gateway to capture the network traffic, enabling us to record raw packet traces for benign and attack scenarios. The resulting dataset provides a comprehensive view of Ethereum network-layer behavior, with traffic labeled according to ground truth (node role and attack phase). We describe the testbed, the attack procedure for generating eclipse conditions, the capture and labeling pipeline, and potential uses of the dataset for intrusion detection and resilience analysis.