Issue No. 03 - March (2009 vol. 8)
ISSN: 1536-1233
pp: 398-412
James Kurose , University of Massachusetts, Amherst
Wei Wei , University of Connecticut, Storrs
Don Towsley , University of Massachusetts, Amherst
Sharad Jaiswal , Bell Labs Research India, Bangalore
Kyoungwon Suh , Illinois State University, Normal
Bing Wang , University of Connecticut, Storrs
Yu Gu , NEC Laboratories America, Princeton
ABSTRACT
In this paper, we propose two online algorithms to detect 802.11 traffic from packet-header data collected passively at a monitoring point. These algorithms have a number of applications in \emph{realtime} wireless LAN management, for instance, in detecting unauthorized access points and detecting/predicting performance degradations. Both algorithms use sequential hypothesis tests, and exploit fundamental properties of the 802.11 CSMA/CA MAC protocol and the half duplex nature of wireless channels. They differ in that one requires training sets, while the other does not. We have built a system for online wireless-traffic detection using these algorithms and deployed it at a university gateway router. Extensive experiments have demonstrated the effectiveness of our approach: the algorithm that requires training provides rapid detection and is extremely accurate (the detection is mostly within 10 seconds, with very low false positive and false negative ratios); the algorithm that does not require training detects $60\%$-$76\%$ of the wireless hosts without any false positives; both algorithms are light-weight, with computation and storage overhead well within the capability of commodity equipment.
INDEX TERMS
Network Operations, Network management
CITATION
James Kurose, Wei Wei, Don Towsley, Sharad Jaiswal, Kyoungwon Suh, Bing Wang, Yu Gu, "Passive Online Detection of 802.11 Traffic Using Sequential Hypothesis Testing with TCP ACK-Pairs", IEEE Transactions on Mobile Computing, vol. 8, no. , pp. 398-412, March 2009, doi:10.1109/TMC.2008.126