The study of worm behavior is critical to the design of effective counter measures in MANET environments. This paper studies the behavior of TCP based worms in MANETs. We develop analytical models for the spread of TCP worms in the MANET environment that account for payload-size, bandwidth-sharing, radio range, nodal density, packet discards and several other parameters specific to MANETs. We present numerical solutions for the models and verify the results using high fidelity packet-level simulations.

The results show that the analytical model developed here matches the results of the packet-level simulation in all cases except when topologies result in a high probability of disconnected clusters. Our simulation studies show that under many cases, due to the resource constrained nature of the MANET and its underlying wireless layers, the TCP-based worms rapidly become self-throttling. This may benefit the design of effective mitigation technologies in these critical networking environments.