Merging multiple sniffers

Multiple sniffers can reduce measurement loss in two ways. First, a single sniffer may not be able to observe all of the frames sent to and from a particular AP, due to radio reception and range. By using multiple sniffers, we can aggregate each sniffer's local view to create a closer approximation of the AP's global view. Second, even if a sniffer had identical radio hardware and positioning to that of an AP, it may be useful to observe the frames that the AP itself was unable to receive.

To accurately merge data from multiple sniffers, we need to be able to distinguish unique 802.11 frames for removing duplicates. We also need to prevent reordering upon merging. Reordering may occur when different sniffers observe disjoint sets of frames. For instance, if there are four frames $f_{1-4}$ transmitted on a WLAN, and sniffer $A$ sees $f_1$ and $f_3$, but sniffer $B$ sees $f_2$ and $f_4$. Although each sniffer has observed their respective frames in relative order, it is impossible to use this relative order to merge the four frames. To prevent such duplication and reordering, we need to synchronize multiple sniffers' timestamps.

Our WM framework uses 802.11 Beacon frames, which are generated by the AP, as the frame of reference for all the sniffers. Beacon frames contain their own 64-bit absolute timestamps as measured by the AP, and we can therefore uniquely identify such common beacon frames in different sniffer traces. On the timestamps of such common frames, we took one of the sniffers as a reference point and used linear regression to fit the other sniffers' timestamps to the reference sniffer.

To prevent duplication and reordering, the time synchronization error (the difference between two timestamps of different sniffers for the same frame) needs to be less than half the minimum gap ($G_{min}$) between two valid IEEE 802.11 frames. In the IEEE 802.11b protocol, the minimum gap, $G_{min}$, can be calculated as the 192 $\mu s$ (microsecond) preamble delay plus the 10 $\mu s$ SIFS (Short Inter-Frame Space) and the 10 $\mu s$ minimum transmission time for a MAC frame (for the case of an Acknowledgement frame) to be a total of 212 $\mu s$. Therefore, the time synchronization error needs to be less than 106 $\mu s$. Applying linear regression for each Beacon interval ($\approx$ 100ms) on 24 hours of traces from our test setup, we measured synchronization errors on the Beacon frames from another AP. We observed a maximum error of 30 $\mu s$, which is well below the 106 $\mu s$ requirement. Our setup was thus suitable for measurement using multiple sniffers.