Subject: [manet] [MANET]How to detect attacks

From: "Leiyuan Li" <[email-masked]>
Date: Sat, 27 Sep 2003 14:22:43 -0400

Hi,
I'm a graduate student doing research on MANET security.  After reviewing some papers, I have a question: what is the basic criteria for people to pick up certain behavior in MANET runtime as potential attacking behavior?  Some attack behaviors described in different papers seems pretty much the same in their basic behavior pattern, so I think they should be categorized as one type of attacks, ie. using certain pattern of activity to achieve certain illegal benefits.  I wonder if there is any existing categorization of the definitions of different kinds of attack?  
Thanks.
Leiyuan Li

---

From: "Grzegorz Jablonski" <[email-masked]>
Date: Sun, 28 Sep 2003 02:19:21 +0100

Hi,

I'm doing research in formal verification of MANETs. I'm building a
communication model, which I want to be consistent with 802.11 adhoc mode.

Say we have several 802.11 adhoc nodes with TCP/IP stack. No routing is
enabled. All nodes concurrently keep sending out broadcast datagram packets
to the network, at the same time listening for broadcast packets and
receiving all possible. Obviously, some messages get lost, so after the
experiment ends, different nodes will have received different sequences of
packets.

So the question is, for any two nodes, are all 'common' messages - received
by both nodes - received in the same order by each node?

I made an experiment which would suggest the answer is yes, and it's what I
assume. But if only routing was involved, the answer should be no. After
reading 802.11 spec, I'm still not sure if my assumption is right.

Greg

_______________________________________________
manet mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/manet

---

From: Justin Lipman <[email-masked]>
Date: Sun, 28 Sep 2003 14:51:32 +1000

Hi,

> reading 802.11 spec, I'm still not sure if my assumption is right.

If I understand your question correctly then my answer regarding a multihop 
scenario would be possibly  "no".

> experiment ends, different nodes will have received different sequences of

If IEEE 802.11 is used and all nodes within the ad hoc network are "flooding" 
packets. I assume you are referring to "flooding" (broadcast datagrams). Then 
I think the arrival sequence of flooded packets would be subject to various 
non-deterministic delays due to the use of CSMA (random backoff) when 
broadcasting during flooding. No RTS/CTS/NAV is used. Hence different packets 
would experience different delays which may be dependent on node density 
(topology) and effects of random backoff. One other point is that inorder to 
implement flooding effectively, one needs to introduce some amount of jitter 
prior to rebroadcasting. So this may also have a delaying effect. 

I think if an optimised flooding algorithm is used then packets may travel 
different paths and thus introduce different delays too.

Kind regards,
Justin

-- 
PhD Candidate
Telecommunications & Information Technology Research Institute
School of Computer, Electrical & Telecommunications Engineering
University of Wollongong, Australia 
http://www.titr.uow.edu.au/~justin