Mobile, Wireless, and Sensor Networks: Technology, Applications, and Future Directions - Rilegato

Shorey, Rajeev; Ananda, A.; Chan, Mun Choon; Ooi, Wei Tsang

Rilegato

ISBN 10: 0471718165 ISBN 13: 9780471718161

Casa editrice: IEEE, 2006

Riassunto

This publication represents the best thinking and solutions to a myriad of contemporary issues in wireless networks. Coverage includes wireless LANs, multihop wireless networks, and sensor networks. Readers are provided with insightful guidance in tackling such issues as architecture, protocols, modeling, analysis, and solutions. The book also highlights economic issues, market trends, emerging, cutting-edge applications, and new paradigms, such as middleware for RFID, smart home design, and "on-demand business" in the context of pervasive computing.

Mobile, Wireless, and Sensor Networks is divided into three distinct parts:
* Recent Advances in Wireless LANs and Multihop Wireless Networks
* Recent Advances and Research in Sensor Networks
* Middleware, Applications, and New Paradigms

In developing this collected work, the editors have emphasized two objectives:
* Helping readers bridge the gap and understand the relationship between practice and theory
* Helping readers bridge the gap and understand the relationships and common links among different types of wireless networks

Chapters are written by an international team of researchers and practitioners who are experts and trendsetters in their fields. Contributions represent both industry and academia, including IBM, National University of Singapore, Panasonic, Intel, and Seoul National University.

Students, researchers, and practitioners who need to stay abreast of new research and take advantage of the latest techniques in wireless communications will find this publication indispensable. Mobile, Wireless, and Sensor Networks provides a clear sense of where the industry is now, what challenges it faces, and where it is heading.

Su questo libro

Informazioni sull?autore

A. ANANDA, PhD, is Associate Professor, Department of Computer Science, National University of Singapore. He has published more than eighty technical papers and is cofounder of Innvo Systems Pte Ltd.

MUN CHOON CHAN, PhD, is Assistant Professor, Department of Computer Science, National University of Singapore. He has published more than twenty technical papers and holds four patents.

WEI TSANG OOI, PhD, is Assistant Professor, Department of Computer Science, National University of Singapore. His research interests focus on multimedia and distributed applications.

Dalla quarta di copertina

This publication represents the best thinking and solutions to a myriad of contemporary issues in wireless networks. Coverage includes wireless LANs, multihop wireless networks, and sensor networks. Readers are provided with insightful guidance in tackling such issues as architecture, protocols, modeling, analysis, and solutions. The book also highlights economic issues, market trends, emerging, cutting-edge applications, and new paradigms, such as middleware for RFID, smart home design, and "on-demand business" in the context of pervasive computing.

Mobile, Wireless, and Sensor Networks is divided into three distinct parts:

• Recent Advances in Wireless LANs and Multihop Wireless Networks
• Recent Advances and Research in Sensor Networks
• Middleware, Applications, and New Paradigms

In developing this collected work, the editors have emphasized two objectives:

• Helping readers bridge the gap and understand the relationship between practice and theory
• Helping readers bridge the gap and understand the relationships and common links among different types of wireless networks

Chapters are written by an international team of researchers and practitioners who are experts and trendsetters in their fields. Contributions represent both industry and academia, including IBM, National University of Singapore, Panasonic, Intel, and Seoul National University.

Students, researchers, and practitioners who need to stay abreast of new research and take advantage of the latest techniques in wireless communications will find this publication indispensable. Mobile, Wireless, and Sensor Networks provides a clear sense of where the industry is now, what challenges it faces, and where it is heading.

Estratto. © Ristampato con autorizzazione. Tutti i diritti riservati.

Mobile, Wireless, and Sensor Networks

Technology, Applications, and Future Directions

John Wiley & Sons

Copyright © 2006 John Wiley & Sons, Inc.
All right reserved.
ISBN: 978-0-471-71816-1

Chapter One

Measuring Wireless LANs

TRISTAN HENDERSON and DAVID KOTZ Department of Computer Science, Dartmouth College, Hanover, New Hampshire

1.1 INTRODUCTION

Wireless local area networks (WLANs) have appeared in many venues, including academic and corporate campuses, residences, and wireless "hotspots." It becomes increasingly important to understand how these networks are used, as they continue to appear in more numerous and varied environments. Measuring and collecting data from production WLANs in a usage study is one way of fulfilling this need for understanding.

Wireless usage studies and usage data are valuable for many aspects of wireless network research. Understanding how and where clients use the network, what applications clients are using, and how applications are using the network can help with network provisioning and deciding where to expand or augment coverage in an existing WLAN. Models of wireless application workloads can aid the design of future network protocols. Measurements of client mobility in a WLAN can help with the design of location-aware applications, or for developing and improving mobile handoff algorithms.

Collecting data on a WLAN can be difficult, however. There are many technical and nontechnical logistical hurdles involved in collecting high-quality wireless measurements. We have been continuously monitoring a campus WLAN for over 3 years in the course of conducting two of the largest wireless measurement studies to date, and we have encountered many of these hurdles. In this chapter we describe some of the tools that the research community has used for measuring WLANs, and provide hints for their effective use obtained from our real-world experiences. We also discuss some of the usage studies that have been conducted using these tools, both on our own campus and elsewhere. In particular we concentrate Mobile, Wireless, and Sensor Networks: Technology, Applications, and Future Directions on the most common type of wireless LAN, the IEEE 802.11 infrastructure network, as this has seen the highest number of deployments, and thus most usage studies have considered infrastructure networks.

This chapter is laid out as follows. In Section 1.2 we examine some of the tools that are available for measuring a WLAN. Section 1.3 surveys various wireless measurement studies, considering both the tools that were used and the insights that were learned. Section 1.4 concludes the chapter with a checklist of items that a potential wireless usage researcher should consider.

1.2 MEASUREMENT TOOLS

The purpose of a wireless usage study is to collect data about the operations of a WLAN. There are several tools available to the researcher for this purpose. The most commonly used tools include syslog, SNMP, network sniffing, authentication logs, and developing client-side applications. Figure 1.1 shows how some of these tools might be deployed in an example WLAN. In this section, we summarize the pros and cons of using each of these tools, and offer some advice from our own experiences.

1.2.1 Syslog

Syslog is a somewhat loosely specified standard for sending and receiving logging messages. Messages can be stored locally or transmitted across a network to another host.

Many 802.11 access points (APs) can be configured to send syslog messages. By choosing appropriate events to be logged, syslog messages can be used to understand the state of clients on the network. For instance, an AP can send a time-stamped syslog message whenever a client authenticates, deauthenticates, associates, disassociates, or roams to that AP. By collecting these syslog messages from all of the APs in a network, it is possible to determine the state of the clients on the network.

Once an AP has been configured to send syslog messages to a particular host, no further information is required from the receiving host. This makes syslog a simple tool to set up. The receiving host, however, must take care to ensure that messages are being received correctly, as network problems, firmware upgrades, or malfunctioning APs, may lead APs failing to send syslog messages.

There is no standard format for a syslog message, and there is also no standard format for an 802.11 syslog message. The messages that APs send can vary in format, and in the amount of information that is contained. Figures 1.2 and 1.3 show two sets of syslog messages. These messages are both taken from the same Cisco Aironet 350 802.11b AP. Figure 1.2 shows messages from the AP when it was running the VxWorks operating system, whereas Figure 1.3 is a set of messages from the AP after it had been upgraded to the Cisco Internetworking Operating System (IOS). Both sets of messages contain the same basic information: client 802.11 events. They differ, however, in the way that this information is presented; in Figure 1.3 there are multiple timestamps (from the syslog daemon and the AP itself), and the client MAC addresses are formatted differently. Parsing syslog messages can therefore be a tedious process, as the format can change between different AP firmware versions. A long-term measurement study should monitor syslog messages for format changes, and also monitor changes in firmware, either through close communication with network administrators, or by using SNMP (see Section 1.2.2).

A further consideration when parsing AP syslog messages is that not all messages may accurately correspond to 802.11 events. Figure 1.4 shows a set of syslog messages from a "wireless switch." This switch is representative of the newest type of 802.11 infrastructure network, where "dumb" APs are deployed across the area to be covered, and a centralized switch handles authentication, association, and access control. In this setup is the switch that sends syslog messages, not the APs. Rather than sending an individual message for each authenticate, associate, roam, disassociate, and deauthenticate event, the switch sends only two types of message: "station up" and "station down." The types of message available from the APs in the WLAN to be measured may impact the suitability of syslog as a measuring tool, depending on the type of data required for the study.

In a mixed AP environment such as ours, with multiple types of AP and thus multiple types of syslog messages, we have found it useful to translate syslog messages into an intermediate format prior to data analysis. Figure 1.5 shows this intermediate format. The time, client MAC address, event, and AP hostname are extracted from the syslog messages. The year is added to the time, as syslog messages do not contain a year, and the time is replaced with a Unix timestamp. Some syslog messages contain only the MAC address of an AP and not the hostname, as in Figure 1.4 (e.g., bssid 00:11:22:33:44:55). For these APs, we keep a separate mapping of AP names to AP MAC addresses, and refer to this when translating syslog messages.

Once the syslog messages have been collected and translated into a parsable format, it is possible to create a state machine that can calculate a session for each MAC address observed in the syslog trace. Figure 1.6 shows the session state machine that we have used in our campus wireless traces. A session consists of an association, followed by zero or more roam events, and ends with a disassociate or deauthenticate event.

This session structure assumes that a MAC address corresponds to a unique user. This may not be the case in some network environments, for instance, where 802.11 network interface cards (NICs) are shared among several users, or where users tend to alter their MAC addresses. If this is likely to be the case, and the purpose of the study is to track individual's usage, combining syslog data with other data such as authentication logs (Section 1.2.3) may be required.

Our final hint for dealing with syslog messages is to be conscious of holes in the data. As most syslog daemons use a UDP transport, some messages may be lost or misordered in the network. Additional messages may be lost as a result of changes in network configuration or malfunctions. These holes can lead to errors in the estimation of a session length. For instance, if a disassociate message is lost, a simple parser may assume that a client has never disassociated from their last observed AP, and so overestimate the session length. In our studies, we have attempted to alleviate this problem by looking for sessions that are still active at the end of our trace. We assume that these sessions are missing a disassociate message, and we manually terminate the sessions 30 min after the last syslog message recorded for this MAC address. We chose a 30-min window since this is the usual period that an AP uses to time out inactive clients. Advantages and disadvantages of syslog are as follows:

Pros - somewhat passive (no additional traffic sent to APs); one-second granularity

Cons - no common data format; UDP transport means that messages can be lost; may need to manually configure every AP to send syslog messages

1.2.2 SNMP

As its name implies, the Simple Network Management Protocol (SNMP) is a means for managing network devices, or more generally, network objects. A network administrator runs a tool known as a manager, which communicates with SNMP agents. Agents run on network devices, and provide an interface between the device and the manager. A network device can contain several managed objects, such as statistics or configuration items, arranged in a database known as a Management Information Base (MIB).

For the purposes of measuring a wireless LAN, SNMP provides a mechanism for extracting more detailed information out of an access point than syslog provides. The level of data depends on the extent of the particular AP's SNMP support. The IEEE 802.11 standard includes a MIB, but this is sparse, and concentrates on client-side variables. In keeping with the intent of RFC 1812, which requires "the ability to do anything on the router through SNMP that can be done through a console," many AP vendors have written their own vendor-specific MIBs. These MIBs contain many variables that are useful for measuring a wireless LAN. These may be client-specific variables, such as the MAC address, signal strength, or power saving mode of each client associated with the AP. Or they may be AP-specific variables, such as the number of clients currently associated with the AP, or the number of clients that have recently roamed away from the AP.

Even if an AP lacks a vendor-specific wireless MIB, there remain many useful data that can be obtained from general MIBs. Most APs support the standard network interface MIBs. By querying these MIBs, it is possible to determine some interface-specific variables, for instance, the number of inbound and outbound bytes and packets that have passed the AP's wired interface. This can be used as an indicator of the amount of wireless traffic, although it may not include traffic between two wireless hosts on the same AP, whose traffic may not traverse the wired interface.

As with syslog, SNMP data collection can be impacted by different WLAN setups. If a centralized wireless switch is deployed, it may be necessary to query this switch in addition to, or instead of, individual APs. Some networks may prevent SNMP for security reasons, or allow SNMP queries only from particular subnets.

Once the variables to be queried have been determined, a script is required to query these variables on a periodic basis. If querying a large number of APs, a tool that can perform simultaneous asynchronous queries, without having to wait for previous queries to complete, is highly recommended. In our studies, we have had success using the open-source net-snmp suite of SNMP tools and the related Perl modules.

By collecting the MAC addresses of the associated clients at each AP over time, SNMP can also be used for the identification of client sessions. The accuracy of these sessions, however, will depend on the chosen poll interval, that is, the period between queries. If the poll interval is too high, then the SNMP queries may fail to observe those clients who associate and disassociate with an AP between two polls. On the other hand, if polls are too frequent, the resulting additional traffic to and from the APs may impact the performance of the network by overloading the APs or links. Previous studies (see Section 1.3) have used poll intervals ranging from 1 to 15 min. In our studies, where SNMP was used to query over 500 APs, we found that a 5-min poll interval was required to prevent overloading the network with SNMP traffic. Advantages and disadvantages of SNMP are as follows:

Pros - detailed information easily retrievable from many APs; data can include link, network, and transport layers

Cons - coarse temporal granularity (a poll interval below 5 min may saturate a LAN); vendor-specific MIBs means additional effort required to measure different types of AP

1.2.3 Authentication Logs

Wireless LANs are popular because of the ease with which a client can connect. This presents new security vulnerabilities, however, and as such, many deployed WLANs require some form of authentication before a client is permitted to access the network. Analysis of the logs from an authentication server is another mechanism for determining user behavior; user sessions can be calculated by recording login and logout times. Since an individual user will always use the same login name, irrespective of the host being used to access the network, these sessions may be more accurate for studies where individual usage patterns are of interest. On the other hand, these sessions may not necessarily correspond to actual WLAN behavior; they may lack details of the APs that a user visits, or the timestamps may differ from actual 802.11 authentication and deauthentication times. Nonetheless, in a network that uses authentication, authentication logs are a source of data that are easy to collect, as they will typically be stored in a single central authentication server. Advantages and disadvantages of authentication are as follows:

Pros - accurate session-level information for each individual user; easy to collect from a single source

Cons - not all networks use authentication; authentication sessions may not necessarily correspond to wireless sessions

1.2.4 Network Sniffing

Network or packet "sniffing" refers to the act of capturing network traffic. By placing a network interface into promiscuous mode, the interface will ignore its assigned address and accept all frames. It is then possible to observe any packets that pass this interface. A program such as tcpdump can capture these packets to disk, and a protocol analyzer such as ethereal can dissect these packets to determine such useful data as the source and destination, the protocol, and in many cases the application being used.

By placing a network sniffer near a router or switch that connects a WLAN's APs to the wired network, it is possible to record the traffic that is traversing the wireless portion of the network. If MAC addresses are being used to represent individual users, then care must be taken to place the sniffer before the first router, so that the original wireless client MAC addresses are preserved. Some switches offer a "port mirroring" mode, which can bounce the traffic seen on some ports to another port. This can be useful for sniffing, as a sniffer could be connected to a mirrored port and thus monitor any number of ports on that switch. This requires a sniffer with two Ethernet interfaces: one interface connected to the mirrored port, and another to the wired LAN for remote access. Tcpdump can then be run on the interface that is connected to the mirrored port. If port mirroring is not used, and a sniffer with only one interface is used, then it is necessary to remove any traffic to and from the sniffer (e.g., remote logins) from the packet traces. Furthermore, we have found that a sniffer intended to monitor a wireless subnet may sometimes end up seeing traffic from wired hosts on that subnet because the switches have been misconfigured or are malfunctioning. It is useful to correlate sniffer data with data from other sources, and we use a list of the MAC addresses observed through syslog to remove any nonwireless data.

(Continues...)

Excerpted from Mobile, Wireless, and Sensor Networks Copyright © 2006 by John Wiley & Sons, Inc.. Excerpted by permission.
All rights reserved. No part of this excerpt may be reproduced or reprinted without permission in writing from the publisher.
Excerpts are provided by Dial-A-Book Inc. solely for the personal use of visitors to this web site.

Dettagli dell?edizione

• Editore: IEEE
• Data di pubblicazione: 2006
• ISBN 10: 0471718165
• ISBN 13: 9780471718161
• Rilegatura: Copertina rigida
• Lingua: Inglese
• Numero di pagine: 430
• Contatto del produttore: non disponibile