PCAPSYNC

Pcapsync is a tool to time-synchronize tracefiles recorded in libpcap format. Its main application area are logfiles of real-world experiments with wireless multihop networks like MANETs (mobile ad-hoc networks), VANETs (vehicular ad-hoc networks) or mesh networks. The underlying algorithm, however, is more general and can be applied to any network with local broadcast characteristic.

Description

A fundamental problem in real-world computer network experiments is that each system uses its own local clock to timestamp events. These clocks are not perfectly accurate, and thus deviate from each other. Event timestamps assigned by different nodes can therefore not immediately be compared, making the analysis of experimental results difficult.

In order to solve this issue we have proposed in a previous publication to record the occurring events with the deviating, local clocks and synchronize the resulting event log files offline after the experiment. The synchronization is based on so-called anchor points, that is, on events that have been recorded and timestamped by more than one node in parallel. The anchor points allow to set the clocks of the nodes into relation. In networks where the medium has a broadcast characteristic (like many wireless networks, but also Ethernet using hubs), the (almost) parallel reception of a packet transmission by multiple nodes can serve as such an anchor point.

This algorithm is implemented in pcapsync, a tool to synchronize event logs from experiments in IEEE 802.11 wireless networks. It reads a set of log files that have been recorded in libpcap format (used, e. g., by tcpdump and Wireshark), identifies potential anchor points in them, applies our offline time synchronization algorithm, maps the recorded local timestamps to a common, global time scale, and finally writes back a corresponding set of synchronized libpcap files. Its output can thus immediately be used for further analysis with standard tools.

Downloads

The latest version of pcapsync is 0.2, it has beta status.
pcapsync_v0.1.tar.gz
pcapsync_v0.2.tar.gz

People

Wolfgang Kiess
Björn Scheuermann
Daniel Marks

Contact

For information, bug reports, feature requests, ... refer to

pcapsync at cs.uni-duesseldorf.de

Publications

Wolfgang KiessBjörn ScheuermannTill ElsnerMartin MauveMethod for sharing wireless access points to a communications networkWO 2010 127806PCT EP2010 0026342010November 11

Björn Scheuermann, Wolfgang Kiess.
Who Said That? - The Send-Receive Correlation Problem in Network Log Analysis. MAMA 2009: Proceedings of the Eleventh ACM SIGMETRICS Workshop on Mathematical Performance Modeling and Analysis, Seattle, WA, USA, June 2009.

Björn Scheuermann, Wolfgang Kiess, Magnus Roos, Florian Jarre, Martin Mauve.
On the Time Synchronization of Distributed Log Files in Networks with Local Broadcast Media. IEEE/ACM Transactions on Networking 17 (2), pp. 431--444, April 2009.

Daniel Marks, Wolfgang Kiess, Björn Scheuermann, Magnus Roos, Martin Mauve, Florian Jarre.
Offline Time Synchronization for libpcap Logs. WMAN-FG 2008: 1. GI/ITG KuVS Fachgespräch WMAN (Wireless Mobile Ad-Hoc Networks), pp. 9-10, Ulm, Germany, April 2008.

Björn Scheuermann, Wolfgang Kiess, Magnus Roos, Florian Jarre, Martin Mauve.
Error Bounds and Consistency of Maximum Likelihood Time Synchronization. Technical Report TR-2008-001, Computer Science Department, Heinrich Heine University, Düsseldorf, Germany, February 2008.