CoT object types seen in the wild

cot-types-seen.md

The breakdown below is based on a collection of random CoT traffic samples acquired from public TAK servers between March-October 2021. The purpose is to understand the distribution of object types in a diversity of realistic use cases.

type	count	no_uids	min_len	max_len
a-.-A-C	71	21	474	500
a-.-G	4	1	462	462
a-.-G-e	2	1	464	464
a-.-G-E-V-C-U	6	2	486	491
a-.-G-p	2	1	464	464
a-.-G-v	2	1	463	463
a-f-A	16887	15	280	659
a-f-A-C-F	1858	51	367	580
a-f-A-M	6627	12	494	523
a-f-A-M-F	71	7	485	653
a-f-A-M-F-K	16	1	490	491
a-f-A-M-H	4	1	480	482
a-f-A-M-H-Q	25942	3046	312	1366
a-f-G	8246	344	347	830
a-f-G-E-C-T	83	1	469	500
a-f-G-E-V-A	30608	16	545	700
a-f-G-E-V-C	171825	38	374	697
a-f-G-E-V-wasp-veh	2	1	1009	1009
a-f-G-I-B	1714	2	582	614
a-f-G-I-U-T-com-tow	2	1	462	462
a-f-G-I-U-T-r	3043	129	312	544
a-f-G-U	8791	35	533	720
a-f-G-U-C	4040338	7243	355	816
a-f-G-U-C-I	705757	2810	295	726
a-f-G-U-C-V-R-E	1	1	364	364
a-f-G-U-i-l-cct	1	1	369	369
a-f-G-U-S-T	20	1	666	666
a-f-G-wasp-extra	2	1	837	837
a-f-G-wasp-shelter	41	1	1145	1145
a-f-G-wasp-struct	47	11	1012	1627
a-f-G-wasp-vic	14	2	989	996
a-f-S	5307	1	561	636
a-h-A	6	2	695	1112
a-h-G	16176	104	360	1367
a-h-G-U-C-I-d	61	60	323	371
a-h-X-i-g-a	1	1	333	333
a-h-X-i-g-e	8295	8288	328	541
a-h-X-i-m-c	95	95	444	461
a-h-X-i-m-d	247	247	333	450
a-h-X-i-o	3570	3565	354	461
a-n-A	2	1	658	658
a-n-A-C	681540	840	445	523
a-n-A-C-F	1411	401	478	511
a-n-A-C-H	116	15	477	503
a-n-G	11617	67	362	884
a-n-G-I-B	2	1	650	650
a-n-S-X-M	118942	281	387	475
a-p-G	11	11	326	360
a-s-G-U-C-I-d	2	2	345	347
a-u-A-M-F	2	1	653	653
a-u-A-M-H-Q-r	20	1	541	542
a-u-G	7766	86	325	927
a-u-G-E-V	60	3	613	677
a-u-G-I	194	3	667	717
b-a-g	2	1	486	486
b-a-o-can	142	26	317	375
b-a-o-opn	28	15	446	535
b-a-o-pan	8	3	481	539
b-a-o-tbl	74	10	462	930
b-f-t-r	2	2	739	847
b-i-v	201	199	539	781
b-m-p-s-m	51	18	615	687
b-m-p-s-p-i	32656	2881	414	1071
b-m-p-s-p-loc	24	2	944	1051
b-m-p-s-p-op	14	2	616	618
b-m-p-w-GOTO	11839	8	562	750
b-m-r	76	65	677	3764
b-r-f-h-c	20	8	685	1149
b-r-f-O-I-V	1	1	365	365
b-r-h-O-I-V	1	1	365	365
b-t-f	511	359	616	1893
b-x-x-s-i-g-c-h-k-r-e-q	6	3	444	444
no-defined-type	5	3	288	288
shape_marker	399	1	433	433
t-x-c-m	6571	3573	655	702
t-x-c-t	5328	15	268	325
t-x-c-t-r	663752	1	254	255
t-x-d-d	26861	14237	161	397
t-x-m-c	5	5	1183	1219
t-x-X	180	2	468	511
u-d-c-c	15	6	756	913
u-d-f-m	2	1	3167	3167
u-d-r	37	17	645	811
u-r-b-bullseye	2	1	679	679
u-rb-a	2	1	623	623

WARNING this is raw data and somewhat dirty.
Some object types are the result of testing experimental software, and are disproportionally over-represented (like a-n-A-C from an experimental ADSB converter) or even invalid per CoT specifications (a-.-A-C). Others like t-x-c-t-r are TAK server artifacts, that only occur locally on the server link and may be irrelevant in some scenarios. And so on.

In simple numbers:

Approximately 6 million CoT objects have been counted (6.6 million if including t-x-c-t-r server pingpong)
In total, only 85 distinct object types have been recorded - including tests, errors and bogons.
Out of these objects, type a-f-G-U-C accounted for over two thirds (67.78%) of all objects.
In second place, type a-f-G-U-C-I with 11.84%.
All other 83 types, including bogons, totalled a little over 20%.