Abstract: The edge of the Internet is increasingly wireless. To understand the Internet, one must understand the edge, and yet the measurement of wireless networks poses many new challenges. IEEE 802.11 networks support multiple wireless channels and any monitoring technique involves capturing traffic on each of these channels to gather a representative sample of frames from the network. We call this procedure channel sampling, in which each sniffer visits each channel periodically, resulting in a sample of the traffic on each of the channels.
This sampling approach may be sufficient, for example, for a system administrator or anomaly detection module to observe some unusual behavior in the network. Once an anomaly is detected, however, the administrator may require a more extensive traffic sample, or need to identify the location of an offending device.
We propose a method to allow measurement applications to dynamically modify the sampling strategy, refocusing the monitoring system to pay more attention to certain types of traffic than others. In this paper we show that refocusing is a necessary and promising new technique for wireless measurement.
Keywords: wireless, network, security, intrusion detection
PDF (403K)(Dartmouth only)
Copyright © 2008 by Springer-Verlag.The copy made available here is the authors' version; for a definitive copy see the publisher's version described above.