MAC Layer Capture Accuracy

In this section, we examine WM's accuracy in measuring the MAC layer traffic. To count the measurement loss with only MAC frames, we exploited the IEEE 802.11 MAC sequence number. A wireless device increments the MAC sequence number whenever it sends a new Data/Management frame. We focus our analysis in this paper on the Data and Management frame types, as Control frames do not contain a sequence number. If a device retransmits a frame, then it uses the same sequence number as the original frame. Since the maximum MAC sequence number is 4095, a wireless device reuses the same sequence number every 4096 unique frames. We denote the difference in sequence numbers of two consecutive captured frames as the gap size. For example, if consecutive frames have sequence numbers, 4094 and 1, then there is a gap of size three ( $mod_{4096}{(1-4094)}$) between the frames, and there are two missing frames between them.

Table 2: Capture percentage by sequence number analysis: Merging data from sniffers T, U and V significantly increases the number of captured frames.

From	T	U	V	T+U+V	Adjusted
AP	97.85	96.88	96.14	98.53	98.53
$G$	97.48	93.65	92.92	97.72	97.72
$B$	61.09	88.51	88.67	88.96	93.31
Total	88.92	93.91	93.40	95.74	96.97

Table 2 analyzes the sequence numbers for the same controlled experiments as represented in Table 1. As MAC sequence numbers are generated per device, we examined the MAC sequence numbers of the AP, client $G$ and client $B$ separately. Table 2 shows that as data from sniffers $T$, $U$, and $V$ are merged, the capture performance for AP, $G$ and $B$ increases to 98.5%, 97.7%, and 89% respectively (with a further increase to 93% in the discussion below). The numbers in the table reflect the gap between different frames captured by the sniffers.

Figure 3: Distribution of sequence number gaps in From-AP, From-Good, and From-Bad MAC traffic.

Figure 3 shows histograms of the gap size between two consecutive frames for the case of using the three sniffers. Note that a gap of zero means that a frame has been retransmitted, while a gap of 1 means that there are no missing frames between these two frames. To calculate the number of missing frames, we count the gaps of greater than 1. Let $freq_i$ denote the number of occurrences of gap size $i$ in Figure 3. Then, we can calculate the number of missing frames ($N_{miss}$) by $\sum_{i=2}^{i=\infty} (i-1) \times freq_i$. The column labeled `T+U+V' in Table 2 can be obtained by $\frac{N_{cap} \times 100}{N_{cap} + N_{miss}}$, where $N_{cap}$ denotes the number of distinct captured frames.

Figure 4: Sequence number gap in From-Bad MAC traffic.

Figure 4 takes a closer look at the Bad client case. The x-axis represents the received frame sequence number and the y-axis represents the gap before this frame. There was a periodic gap of 8, i.e., a measurement loss of 7 frames. By looking into the traces we found that these periodic behavior was due to the Bad client performing periodic active scanning searching for better APs. Since this process involves sending probe request frames on different channels 13 (13), the sequence numbers were not captured by our sniffers, which sniffed the traffic on only one channel. If these missed probe request frames are added to the loss statistics in Table 2, the capture accuracy for the Bad client increases to 93.31% and the overall capture performance increases to 96.97% (as shown in the Adjusted column in Table 2). This means that the WM statistics differ by at most 3.03% from the actual statistics.