Application Layer Capture Accuracy

Table 1: Comparison between APP-measurement with NetDyn, WM, WDM, and SNMP, in terms of capture percentage.

	NetDyn	WM	WDM	MIB-I	MIB-II
From	To-AP Wireless Traffic
$G$	100	98.6	100	N/A	N/A
$B$	100	100.1	100	N/A	N/A
Total	100	99.3	100	100.2	100.2
To	From-AP Wireless Traffic
$G$	100	99.4	103.4	N/A	N/A
$B$	100	102.6	103.5	N/A	N/A
Total	100	100.9	103.5	102.0	99.9

Table 1 compares the three traffic measurement techniques. Using the number of NetDyn packets (that were not lost in the paths) as the baseline (100%), we represent the traffic captured by each technique. To-AP traffic represents traffic from the clients to the AP, while From-AP traffic represents traffic from the AP to clients. Note that for SNMP statistics, we based our analysis on MIB-I counters as in 1 (1) as well as the MIB-II counters (RFC 1213, RFC 2665). MIB-II provides many variables for calculating inbound/outbound error statistics more accurately than MIB-I 11 (11).

From Table 1, we can make the following observations:

• WM has comparable performance to the other techniques for the common information that can be captured by other techniques, such as traffic on the wired side of the AP.
• The MIB-I and MIB-II SNMP statistics cannot reveal per-client information. The 802.11 MIBs and AP-specific MIBs may provide per-client information; we do not consider these here.
• Wired monitoring can provide accurate To-AP information about the wireless medium through the proportion of successfully-transmitted frames, as the probability of the loss on the wired medium is much lower than the probability of loss on the wireless medium. If, however, frames are fragmented on the wireless medium, we cannot obtain correct statistics on the wireless frames from the wired side.
• For the From-AP traffic, although wired monitoring can provide per-client information for the wired segment, it overestimates the actual traffic compared to WM. This is due to the noisy characteristics of the wireless channel, which lead to the loss of many packets on the wireless side that wired monitoring cannot capture.
• It is interesting to notice that even the SNMP statistics may differ from the true view of the wireless client. For example, in Table 1 the MIB-II total number of successfully transmitted packets is less than the number of packets received by the NetDyn Sink. This can be explained by noting that there may be packets that were successfully received by the Sink after three retransmissions, and the corresponding MAC-level ACK was sent back. This ACK, however, was not received by the AP, and so the AP did not count it as a successful transmission.
• Due to client $B$'s bad location, the number of successful NetDyn transmissions at client $B$ was smaller than at client $G$. Using the number of successfully-received NetDyn frames as the 100% benchmark, we observe that for client $B$, the sniffers captured more than 100% of the NetDyn frames, e.g., 102.6% for traffic from AP to $B$ in Table 1. In other words, for clients with bad signal strength conditions, WM can capture more frames than are successfully transmitted to/from the clients at application layer.

Finally, we note that the WM technique statistics are within 1% of the actual application layer statistics.