If enabled, cFosSpeed may collect some metadata of your connections.  This
happens very rarely (less than once a year on average).  Since Internet hosts
and services change all the time, this data is collected to allow cFosSpeed's
traffic classification to be improved and updated to new or changed conditions.

"Metadata" is this sense means not user content of your connections but certain
characteristics of the connection.  The following is a complete list of data
that is collected:

   - Remote IP address & TCP/UDP port number
   - Local TCP/UDP port number
   - Size of both, data portion of each packet and header
   - Time stamp (relative to program start) in micro-seconds
   - Program name without path
   - L7-protocol
   - HTTP: "Host" header field
   - HTTP: "Content-Type" header field
   - HTTPS/SSL: TLS server name
   - DNS: domain names of connections
   - QUIC: server name identification (SNI)
   - Your connection's max tx and rx speeds, RTT, total data sent/received,
     total cFosSpeed usage time
   - Your machine's GEOID (from GetUserGeoID() function)
   - Your Windows version

Other data is not collected.  cFosSpeed specifically obfuscates your local IP
addresses, see below.


Following is a description of the format of the collected data.  Everything is
written to a text file called _meta_dump.txt in %ProgramData%\cFos\cFosSpeed
directory.  Prior to sending, the file is renamed to meta_dump.txt.  After
sending, it is deleted.


There are different types of lines in the dump file:

-- System info (once per file):
   :=S <cFosSpeed version and build number> <maxtxraw speed in bytes/s> <maxtxacked speed in bytes/s> <maxrx speed in bytes/s> <min RTT in usec> <GEOID> <total rx megabytes> <total txraw megabytes> <total hours used> <windows version and build number> <space method>

   Example:
   :=S 11.11.2503 4534235 4534191 13471299 17118 244 25147599 2608937 27434 10.0.19042 5

   "space method" is one of:
      1 = pppoe
      2 = pppoa_vc_mux
      3 = isdn
      4 = pptp
      5 = raw_ip
      6 = pppoa_llc
      7 = ip_over_aal5
      8 = adaptive
      9 = bridged_over_aal5
      10 = frame_count
      11 = cable_mixed
      12 = vdsl

-- Connection start or data changed (a few times per connection):
   :=<connection ID> <connection name> <time stamp> <TCP rx MSS> <TCP tx MSS> <ECN flags> <program name> <L7-protocol> <L7-protocal specific data>

   Example TCP IPv6:
   :=T1= tcp_[fc00::0:1]:61217_[2a01:4f8:191:6353::2]:443 5339734002 1440 1432 0 firefox.exe SSL_C -

   Example UDP IPv4:
   :=U2= udp_10.0.0.1:56015_192.168.178.1:53 4550328 0 0 0 unknown DNS_C -

   If any of these items change (L7-protocol or program name need some time to
   become available), a full new line is written with updated information.

-- Data packets (for every packet sent/received):
   :=<direction> <connection ID> <header size> <user data size> <time stamp>

   Example TCP send IPv6:
   :=tx T1= 72 0 4462502 0

   Example TCP receive IPv6:
   :=rx T1= 72 0 4470802 0

   Example UDP send IPv4:
   :=tx U2= 28 35 4651059 0

   Example UDP receive IPv4:
   :=rx U2= 28 171 4659085 0

-- Connection end (once per connection):
   :=<connection ID> X <time stamp>

   Example:
   :=T1= X 4551328


To protect your anonymity, all local IP addresses are mapped to some range of
private IP addresses.  For IPv4, the address is mapped to the 10.0.0.0/8
range.  For IPv6, the address is mapped to [fc00::]/96 range.


You can change the setting to allow cFosSpeed to collect this data at any time
in the context-menu under Options/Settings.