“Where did he get this info?” My question exactly.
What was the physical capture point for the pcaps? Where was the tap (physical or logical) installed? Was this done from a node router?
This level of data is not impossible to collect, but it does leave questions as to how it was done.
BTW we do know the origin of the data (the spreadsheet shown in later clips). It comes from Mary Fanning at American reporter. A version of it is seen in the first Lindell video. And She got it from Dennis Montgomery. This version removed the MAC addresses, probably because someone pointed out they were fake and generated by a random generator. I linked to his site earlier where you can find an early version of this data.