WOLLO UNIVERSITY

Kombolcha Institute of Technology

College of Informatics Computing
Department of Information Technology (IT)

Research on
Improved Secure AODV protocol for Detection and Prevention
of Wormhole Attacks in MANET-based anomaly detection
system.

Research by
Abdu Mohammed Ali

Under supervision of

Alemu Jorgi (Phd)

June 2023

Wollo, Ethiopia
 Kombolcha Institute of Technology
College of Informatics Computing
Department of Information Technology (IT)

Research by
Abdu Mohammed Ali

Under supervision of
Alemu Jorgi (Ph.D.)

Research submitted in partial fulfillment of the requirements

for the degree of master of education to the Department of
Information Technology, College of Informatics Computing,
Wollo University.

August 2023

Wollo, Ethiopia

i
 Kombolcha Institute of Technology

College of Informatics Computing

Department of Information Technology (IT)

Research by
Abdu Mohammed Ali

Under supervision of

Alemu Jorgi (Ph.D.)

Approved by: We the examiners‟ board approve that this thesis proposal has passed
through the defense and review process.

1. __________________ ______________________ __________________

Examiner Signature Date

2. __________________ ______________________ __________________
Examiner Signature Date
3. _____________________ ___________________ __________________
Advisor Signature Date
4. _____________________ ___________________ __________________
Co-Advisor Signature Date
5. __________________ ______________________ __________________
Dean, Head of Dep‟t Signature Date

ii
 Statement of original authorship

The work contained in this thesis has not been previously submitted to meet the
requirements for an award at this or any other higher education institution. To the
best of my knowledge and belief, the thesis contains no material previously
published or written by another person except where due reference is made.

Signature: _________________________

Date: August 2023

iii
 Dedication

To

My Family & Saleha Abdu

iv
 Acknowledgment
In the first place, I would like to thank Almighty Allah for all he did the best
throughout my life. He gave me the opportunity and knowledge to start and finalize
this study adequately. Nothing was done without his blessing.

I respectfully would like to thank my research advisor Alemu Jorgi (Phd) for his
unreserved support and guidance to be successful in my research. He was available
all the time to support his advisee. I never forget his friendly approach, Thank you
again.

v
 Table of Contents
Statement of original authorship ................................................................................. iii

Dedication ..................................................................................................................... iv

Acknowledgment ............................................................................................................ v

Table of Contents .......................................................................................................... vi

List of figures ................................................................................................................ ix

List of tables................................................................................................................... x

List of abbreviations ..................................................................................................... xi

Abstract .......................................................................................................................... 1

Chapter 1 Introduction .................................................................................................. 2

1.1 Background........................................................................................................... 2

1.2 Research motivation............................................................................................. 4

1.3 Statement of the problem .................................................................................... 5

1.4 Research questions ............................................................................................... 6

1.5 Research objectives .............................................................................................. 6

1.5.1 General objective ........................................................................................... 6

1.5.2 Specific objective ............................................................................................ 7

1.6 Scope (Limitation and delimitation) .................................................................... 7

1.7 Significance of the research ................................................................................. 8

1.8 Beneficial of the study .......................................................................................... 8

1.9 Organization of the research ............................................................................... 9

Chapter 2 Literature review and related work .......................................................... 10

2.1 Overview ............................................................................................................. 10

2.2 Mobile ad-hoc networks ..................................................................................... 10

vi
 2.3 Characteristics of MANET‟s .............................................................................. 12

2.4 Architecture of MANET‟s ................................................................................... 13

2.5 Application of MANET‟s .................................................................................... 14

2.6 Routing in MANET‟s .......................................................................................... 15

2.6.1 Factory that affects routing in MANET‟s ................................................... 16

2.6.2 Security threats to MANET‟s ...................................................................... 17

2.6.3 Wormhole attack .......................................................................................... 19

2.6.4 Types of wormhole attack modes ................................................................ 20

2.6.5 Approaches in securing MANET‟s .............................................................. 21

2.7 Related work....................................................................................................... 22

Chapter 3 Methodology ............................................................................................... 30

3.1 Overview ............................................................................................................. 30

3.2 Manet routing protocols ..................................................................................... 30

3.2.1 AODV (Ad-hoc On-Demand Distance Vector) ............................................ 31

3.2.2 Communication between nodes ................................................................... 35

3.2.3 Intrusion detection approaches ................................................................... 37

3.2.4 Proposed solution ......................................................................................... 38

3.2.5 Implementation ........................................................................................... 42

Chapter 4 Results and discussions ............................................................................. 57

4.1 Simulation setup ................................................................................................ 57

4.2 Results and discussions ..................................................................................... 59

4.3 Comparison of the SAODV with the existing solutions.................................... 69

Chapter 5 Conclusions and recommendations ........................................................... 71

5.1 Conclusion .......................................................................................................... 71

vii
 5.2 Recommendation ................................................................................................ 72

References .................................................................................................................... 73

Appendix ...................................................................................................................... 77

viii
 List of figures
Figure 3.1 Route request and route reply example .................................................... 32
Figure 3.2 Route request message format ................................................................. 33
Figure 3.3 Route reply message format ..................................................................... 34
Figure 3.4 Route error message format ..................................................................... 34
Figure 3.5 Flow chart of the proposed ........................................................................ 41
Figure 3.6 Nodes distribution in MANET .................................................................. 44
Figure 3.7 Nodes communication in AODV ................................................................ 45
Figure 3.9 Secure data transfer from source to destination ...................................... 54
Figure 4.1 Throughput of AODV routing protocol ..................................................... 59
Figure 4.2 Packet delivery ratio of AODV routing protocol ..................................... 60
Figure 4.3 End to end delay of AODV routing protocol ............................................ 60
Figure 4.4 AODV throughput under wormhole attack ............................................ 61
Figure 4.5 Packet delivery ratio of AODV under wormhole attack ......................... 62
Figure 4.6 End to end delay of AODV under wormhole attack ............................... 62
Figure 4.7 Secure AODV throughput ....................................................................... 63
Figure 4.8 Packet delivery ratio of AODV under defense system ........................... 64
Figure 4.9 Secure AODV end to end delay under wormhole attack ........................ 64
Figure 4.10 Comparative throughput result ............................................................ 66
Figure 4.11 Comparative packet delivery ratio ........................................................ 67
Figure 4.12 Comparative end to end delay result .................................................... 68

ix
 List of tables
Table 1.1 Network Simulation Tools ............................. Error! Bookmark not defined.
Table 2.1 Related work summary ............................................................................... 27
Table 3.1: Packet sent & received in normal AODV .................................................. 50
Table 3.2: Packet sent & under wormhole attack ...................................................... 50
Table 3.3: Secured AODV packet sent & received...................................................... 56
Table 4.1 Simulation parameters................................................................................ 58
Table 4.2 Comparative result of throughput .............................................................. 65
Table 4.3 Comparative result of packet delivery ratio ............................................... 67
Table 4.4 Comparative end to end delay result .......................................................... 68
Table 4.5 Proposed model comparison with existing solutions.................................. 70

x
 List of abbreviations
- AES: Advanced Encryption Standard
- AODV: Ad hoc On-Demand Distance Vector
- CBR: Constant Bit Rate
- CPU: Central Processing Unit
- DES: Data Encryption Standard
- DSR: Dynamic Source Routing
- DSDV: Destination-Sequenced Distance Vector
- FTP: File Transfer Protocol
- GUI: Graphical User Interface
- GPS: Global Positioning System
- SAODV: Secure Ad-Hoc On-Demand Distance Vector
- MANET: Mobile Ad Hoc Network
- MAC: Medium Access Control
- MSADOV: Modified Secure AODV Protocol
- NS2: Network Simulator 2
- OMNET: Objective Modular Network Testbed
- OLSR: Optimized Link State Routing Protocol
- OTCL: Object-Oriented Tool Command Language
- OPNET: Optimized Network Engineering Tools
- PDR: Packet Delivery Ratio
- RREP: Rout Reply
- RREQ: Route Request
- TCP: Transmission Control Protocol
- TCL: Tool Command Language
- UDP: User Datagram Protocol
- VANET: Vehicular ad hoc networks
- WAODV: Wormhole Ad-hoc On Demand Distance Vector
- WSN: Wireless Sensor Networks

xi
 Abstract
In mobile ad hoc network security is challenging issue and makes the
communication vulnerable to different attacks. The common type of attack in
MANET is the Wormhole attack. This type of attack is dangerous attack and
difficult to detect it in mobile ad-hoc networks. In wormhole attack two nodes
makes a tunnel to communicate to each other as neighbor nodes or accept the data
packet from sender node and drop it without sending to the destination node. The
attacker nodes disturb the normal communication path by changing or dropping the
packet and route path. In this thesis work an intrusion detection based on anomaly
detection technique is proposed to improve the security of mobile ad-hoc network.
The existing AODV routing protocol is modified to increase its security. Each mobile
device in ad-hoc network is responsible to protect itself from wormhole attack. The
proposed technique does not need any additional resources to configure and deploy
in ad-hoc network environment. The experiment result shows that an improvement
in the throughput as compared the proposed solution with the AODV routing
protocol under wormhole attack.

To achieve the detection and prevention of Wormhole attack in MANET, an

intrusion detection system based on anomaly detection (SAODV) technique is
designed that uses the control messages to identify attackers. The malicious nodes
have misbehavior in the network environment and degrade the network
performance. The misbehavior of the attacker node is detected and removed from
the network communication.

Keywords: Secure AODV, MANET, Wormhole Attack

1
 Chapter 1 Introduction
This chapter presents background, statement of the problem, motivation,
methodology, research objective, scope and limitation, significance of study section,
research methods and organization of the thesis sections.

1.1 Background

In today‟s world of digitalization, technology is mainly concerned on the efficient

controlling and governing power of the system. For this, suitable routing protocols
and secure communication environment are must to maintain some wireless
sensing applications like Military area, Commercial Sector, Personal use, Bluetooth
and local level [1]. Digital communication dominates current information exchange.
This means the manual system is replaced by modern technologies like computers,
laptops and mobiles. Now we are in the era of information technology. Information
is accessible whenever and wherever needed [2]. Internet changes the way that we
are living. Using these technologies information is accessible like e-mail, games and
videos for entertain via network. There are two types of networks. The first one is
wired network and the second one is wireless network. In wired network, the
communication is achieved by using a wire that connect one device to the other
device. The information flow is from central device to the client and vice versa. The
clients get information from the server. In wireless network, the communication is
achieved via wireless devices or free medium. Wireless network is categorized into
two groups which are infrastructure based and infrastructure less networks.

Infrastructure based networks: In this type of network access point is required that
connects the wireless network traffic into the wired local area network. The access
point is the central device that connects to the wireless network devices.

Infrastructure less network: The network without infrastructure is called ad-hoc

network. There is no access point to communicate the network devices.

2
There are three types of ad-hoc networks.

VANET (Vehicular network) consists of vehicles to form a network which is similar

to MANET.

WSN (Wireless sensor networks) consists small wireless sensor nodes to make a
network.

MANET is an example of wireless network in which there is no central device like a

wired network. The communication is via intermediate nodes. One node sends data
to the next nodes until it reaches to the destination node [2].

MANET can be defined in different ways. Some of the definitions and security
issues are described below.

MANET is a collection of mobile devices that communicate to each other with the
help of wireless medium. It is infrastructure less and dynamic topology network.
The nodes in the radio range can communicate to each other and the nodes out of
the radio range can communicate to each other with the help of neighbor nodes [3].

A MANET is a collection of mobile devices without infrastructure. There is no

central device to control each device. Each node is client and server which means,
each mobile device can send or receive data. The communication and routing of
packet is done in cooperation. The sender node may or may not reach to the
destination node due to the limited communication range and energy. To achieve
this, the intermediate nodes are used to reach the destination node. The
intermediate nodes can receive and forward the packet to the next hop. Each node is
responsible to find the next node if it is asked to forward route request. The
infrastructure less nature of the network makes to create dynamic topology [4]. In
mobile ad-hoc network, an attacker can attack or disturb the communication. The
attacker can record the communication of the nodes, receive packet to itself or drop
the packet without reaching to the destination node. Due to the free network
environment in MANET, different attackers can participate in routing. The

3
wormhole attack is an active attack that can receive the packet to itself or drop it.
This type of attack is dangerous attack to detect and remove in MANET [5].

Routing in MANET is more vulnerable than wired network. The reason is that each
node in MANET acts as a relay node. This means the attacker node can disturb the
communication by sending fake information to the source node [6].

Security is important issue in MANET to achieve secure communication between

mobile devices [7]. An attacker can attack the communication without knowing the
nodes. Because, in wireless ad-hoc network the environment is free, every user can
join or leave the network.

To overcome this challenge, there is need to design a secure solution to protect

wireless MANET from intruders. This thesis will implement to prevent wormhole
attack in MANET using AODV routing protocol and sequence number of the control
messages (route reply & route request messages).

1.2 Research motivation

Currently, information exchange is achieved through the use of different

technologies like computers, mobile devices and personal digital assistants. This
makes the devices simple to use. Portable devices are simpler to use in our day-to-
day activities like mobiles. Most of the portable devices use wireless communication
rather than wired networks. Wireless network has many advantages over the wired
network. Mobility, simple to build and inexpensive [8], are some advantages of
wireless networks. The disadvantage of wireless ad-hoc network is the detection
and prevention of security threats.

Infrastructure less network is affected by different security attacks like sinkhole

attack, wormhole attack and black hole attack. Wormhole attack is one of the most
common and serious attack in MANET. Wormhole attack disturbs the
communication by creating wormhole tunnel and forwards to other malicious node
or absorbs to itself and drops it by announcing shortest path to the destination

4
node. It can damage the MANET routing protocols. The solutions for wired network
cannot be suitable for MANET. Wormhole attack is difficult to identify as a
malicious node in MANET.

Therefore, it is important to implement relevant detection and prevention technique

to avoid the behavior of wormhole attack in MANET.

1.3 Statement of the problem

In mobile ad hoc network the communication is without central control. Each node
acts as host as well as router. Due to the lack of central device to control the
communication, the communication is vulnerable to different attacks [9]. There are
many types of mobile ad hoc network attacks. The most known attack in mobile ad
hoc network is the wormhole attack. Wormhole attack affects the network
performance by capturing data packet to itself and drops it or tunnels to other
attack which is located far away.

Wormhole attack in MANET can send respond message without checking the route
request in the routing table. But the other nodes (normal nodes) check the route
request and node address in their routing table. If the address of the route request
sending node does not exist, the nodes will forward the route request to the next
neighbor nodes by flooding the request. Due to the infrastructure less, mobility and
cooperation of nodes to route their request, it is challenging to make MANET
secure.

Previously many studies are proposed to tackle wormhole attack in MANET. But
still, none of them provide a perfect solution. From the previous researches, most of
them are based on clock, time synchronization, node‟s location and neighbor nodes
information to detect and prevent wormhole attack. Most of these techniques need
additional resource (like GPS) to design and deploy in MANET environment. This
asks additional cost and resource. The other problem is the node‟s mobility. When
there is high attacker mobility, the malicious nodes may be difficult to identify. The

5
previous studies did not consider the mobility of the attacker node in the ad-hoc
network. If the attacker does not change its location, it can be easy to detect and
prevent it. But the problem is if it changes its position from one place to another
place.

This study proposed a new intrusion detection technique to detect and prevent the
mobile ad hoc network from wormhole attack and to achieve wormhole attack
avoidance in MANET. In this study the mobility of the attacker node and additional
resource requirements are considered. Resource efficient intrusion detection system
is required to detect and prevent wormhole attack in mobile ad-hoc network.

1.4 Research questions

1. What are the effective performance metrics used to evaluate the detection
and prevention mechanism with respect to the existing system?
2. To what extent the proposed scheme prevents and detects worm whole
attacks?
3. How to detect wormhole attack within high attacker mobility in mobile ad-
hoc network?

1.5 Research objectives

1.5.1 General objective

The general objective of this study is to propose an algorithm that can detect and
prevent of wormhole attack in MANET using improved secure AODV protocol based
on anomaly detection system.

6
 1.5.2 Specific objective

To achieve the general objective of this research, the following specific objectives are
identified.

 To analysis the existing wormhole attacks detection and prevention security

mechanisms.
 To identify appropriate parameter to be considered to improve
security mechanism of the existing anomaly detection system
approach.
 To model the wormhole attack and design detection and
prevention mechanism in AODV routing protocol.
 To design simulation scenarios to study the effect of the wormhole attack and
performance evaluation of the ad-hoc network.
 To conduct the performance analysis of the proposed system
with respect to existing work using performance metrics.
 To test the solution and evaluate its performance.

1.6 Scope (Limitation and delimitation)

Before proceeding to the study of the problem, it is important to clearly define the
boundary or scope of the study problem as follows.

This thesis proposal mainly focuses on improved secure detection and prevention of
wormhole attack in AODV routing protocol by using resource efficient intrusion
detection system-based anomaly detection system. The audit data of the nodes is
gathered and we will compare it with the predefined data. In mobile ad-hoc
network, there are a number of attacks and different types of routing protocols. This
study did not consider other Manet attacks and routing protocols in MANET.

7
1.7 Significance of the research

Like other network architectures, providing secure routing protocol in wireless ad-
hoc networks turns out to be an important network environment. Now a day,
wireless ad- hoc networks are very popular due to their infrastructure less
characteristics, dynamic topology and easy deployment nature. Secure information
exchange between different users of the devices is always susceptible to different
attacks. Malicious nodes running on the host device environment are often used to
carry out these various attacks. So, this research is very important because if the
new proposed technique is used then the wormhole attacks designed for routing
protocols in MANET will be fail to attack and with reasonable performance
improvement.

1.8 Beneficial of the study

When wormhole attack is present on the network our proposed algorithm will detect
and remove it from the Mobile ad hoc network. Then there will no dropping of
packets, no a denial-of-service attack, or can‟t get unauthorized access. Therefore,
the communication will be safe.

8
1.9 Organization of the research

In the previous introduction part, the background, statement of the problem and
objective of the study are described.

The rest of this thesis is organized as follows. Literature review and related work
are presented in chapters 2. In this chapter the detailed description of MANET like
application of MANET, characteristics of MANET, types of MANET attacks and
related work are described. In chapter 3 and 4 methodology and results and
discussions are presented respectively. Under methodology types of routing
protocols, proposed solution, implementation of AODV under wormhole attack,
defense mechanism and the tools which are used to implement the proposed
solution are described. In chapter 5 conclusion and recommendations are presented.
In this chapter the simulation setup and results are clearly described. Then the
reference materials used to study this research work is presented. Finally in the
appendix the TCL script, AWK script, sample C++ codes and sample trace files are
presented.

9
 Chapter 2 Literature review and related work

2.1 Overview

A Mobile Ad hoc Network (MANET) is a multi-hop network of wireless mobile

devices that forms a temporary network without the need for centralized
administration or support [11].

Wireless mobile users may be able to connect in regions where there is little or no
communication infrastructure, or where the present infrastructure is difficult to
use, by forming mobile ad hoc networks. Each mobile node In such a network, the
mobile node serves as both a host and a router, passing packets to other mobile
nodes in the network that may be many hops away [12].

This chapter discusses MANET challenges and ways for achieving secure
communication across MANETs.

2.2 Mobile ad-hoc networks

There are two main types of networks. These are infrastructure-based networks, in
which all nodes are connected to a fixed entity, and infrastructure-less networks, in
which all nodes interact without the use of an access point. MANET is an example
of infrastructure less network. The MANET network is created by connecting all of
the randomly distributed nodes. Because there is no central device, the nodes serve
as routers and hubs. This form of network is more resistant than infrastructure-
based networks in terms of network failure. The following Figure 2.1 and 2.2 [13],
shows that the comparison between infrastructure-based and infrastructure less
network.

10
Figure 2.1 Infrastructure-based network Figure 2.2 Infrastructure-less network

MANET is a self-configuring network of mobile devices linked by wireless

communications but without the use of an access point. Each mobile device in the
network is self-contained. Mobile devices are free to travel from one area to another
and organize themselves in whatever way they see fit. The MANET's nodes share
the wireless medium, and the network's structure changes dynamically. Because
nodes in a MANET are allowed to migrate to any location, communication links are
frequently broken. The number of nodes and the density of nodes are determined by
the applications that use MANET. MANET have given rise to many applications
like Tactical networks, Wireless Sensor Network, Data Networks, Device Networks,
etc. There are various design concerns and challenges to overcome with many
applications. The basic purpose of mobile ad hoc networking is to extend mobility
into mobile, wireless domains, where a group of nodes, which can be routers and
hosts, are used. They form the network routing infrastructure in an ad hoc
fashion[14]. MANET is similar to vehicle ad-hoc network in which the
communication is vehicle to vehicle by using ad-hoc network. Both use wireless
network to communicate to each other. The following figure shows an example of
mobile ad-hoc network. It has one source node and one destination node and in
between there a number of intermediate nodes. The communication (from source to
destination) is achieved via the intermediate nodes.

11
 Figure 2.3 MANET example

If the nodes are out of communication range, they cannot communicate to each
other. To communicate or transfer data from one node to another node, the nodes
must be in the communication range unless otherwise the intermediate nodes are
used to achieve this.

2.3 Characteristics of MANET‟s

Wireless transmitters and receivers are used by MANET nodes, which can be
omnidirectional (broadcast), highly directional (point-to-point), steerable, or a
combination of the two[15]. The nodes are free to move freely from one location to
other location in ad-hoc network environment. MANETs have different
characteristics[16]:

Distributed operation: In mobile ad-hoc network, there is no background network to

control the activity of each node. The nodes are located randomly and work in
cooperation. Each device is independent that means each node acts as router and
host. The nodes can send or receive packets. The packet reaches to destination node
via the intermediate nodes.
Multi hop routing: When a node wants to send information from one node to other
node which is out of communication range, the packet should be sent via one or

12
more intermediate nodes. The intermediate nodes act as medium for packet
transmission from source to destination.
Autonomous terminal: in mobile ad-hoc network, every device works independently.
There is no central device to control the activity of each node. The nodes can be
either sender node or receiver nodes.
Dynamic topology: In mobile ad-hoc network, nodes are free to move arbitrarily
with different speeds. Due to this the network topology can change its topology
randomly and at unpredictable time. The nodes create temporary route link and
breaks at some time. The nodes connect and leave from/to the network at any time
due to the random change of the network topology.
Light-weight terminals: Most of the time the nodes that can exist in Manet
environments are mobile devices. They have less capacity of CPU, storage and
lifetime in the network.
Shared Physical Medium: The communication in wireless ad-hoc network is
achieved via shared medium. The nodes can use or leave the medium, to transfer
information from one node to other node or use by other nodes. The medium is not
restricted which means the nodes use the medium in cooperation.

2.4 Architecture of MANET‟s

The nature of MANET is vulnerable to different malicious attacks[17]. Using

wireless communication medium can susceptible malicious attacks that ranges from
passive attack to active attacks. Wired medium is less vulnerable to attacks. In
wired network, the architecture is known and the exact location of the nodes is
specified. The information flow from one node to another node can be controlled. But
in mobile ad-hoc networks the nodes‟ communication is out of control. Therefore, the
attackers can join the network from any direction and can damage the whole
network.
The damage that can occur due to the attacks can include break confidential
information, message forward to unreliable location [18]. This means MANET does

13
not have clear defense mechanism against attacks. Each network device is
responsible to protect itself from malicious nodes. The nodes are not sure to use
their intermediate nodes to transfer information to the destination node. Mobile
nodes are autonomous in nature that is capable of roaming and working
independently. Therefore, tracking particular mobile device in ad-hoc network may
be easy task. The challenge issue is whether the node that is joined to the network
is normal node or malicious node. It is difficult to detect and prevent it. Therefore,
any node in MANET works as trust to their intermediate nodes.
Decision making in ad-hoc networks is usually decentralized and many ad-hoc
algorithms rely on the cooperative participations of all node involved in the
network. The lack of centralized management makes the network vulnerable to
different attacks[19]. The existing routing protocols of MANET do not have enough
defending mechanism.
By nature, the architecture of the MANET is random. The nodes create their own
network topology arbitrarily. Every node is free to join the network and leave from
the network. In this type of network there is no guarantee to whether the joined
nodes are trust nodes or not. To have secure communication, there is need to
designed detection and prevention mechanism to the nodes participating in the
network environment as normal nodes or malicious nodes.

2.5 Application of MANET‟s

Now a days wired based network is shifting to wireless networks. The reason is
that, due to the portability of the devices, cost efficient and low power needs. This
makes the ad-hoc wireless-based network is simple to deploy and reduces cost. In
mobile ad-hoc network, every device is mobile which means the nodes move from
one place to other place without any central device. Each node is server as well as
client. In general, the network is decentralized. Decentralization makes the
networks more flexible and more robust[14]. In general, MANETs used in different

14
areas such as disaster controlling and extremely in military operations and others
as described below[13].
Military areas: MANET can be applied in military areas to support soldiers to
communicate to each other and their headquarters.
Bluetooth: MANET can be used to communicate different devices in a short distance
to share different files.
Commercial sectors: MANET is used in disaster areas like flood, earthquake and
wind controlling.
Personal space network: MANET is used in localized network for the purpose of
sharing information. The above listed are some of the applications of MANET. In
general, MANET can be used in the areas where infrastructure-based network is
difficult to deploy.

Figure 2.4 Application of MANET example [20]

This indicates the devices are communicating to each other by using wireless ad-hoc
network. The soldier is communicating with the tank and airplane and the boat with
the tank and airplane. Therefore, due to the ad-hoc network the soldier is getting
support from other technologies.

2.6 Routing in MANET‟s

Routing can be defined as the act of flowing information from a source node to a
destination node in a given network. During this process, at least one intermediate

15
node within the internetwork is encountered[21]. The concept of routing in MANET
is different from routing in wired networks due to the dynamic and infrastructure
less structure of the network. In wired network the communication is achieved
through the wire or medium. The client send request to the server and the server
responds feedback to the client based on their request. The concept of routing in
MANET is different from routing in wired networks due to the dynamic and
infrastructure less structure of the network. In wired network the communication is
achieved through the wire or medium. The client send request to the server and the
server responds feedback to the client based on their request. In MANET, there is
no central device to cooperate the communication between the nodes. Routing is
achieved by sending and receiving route request and reply messages respectively.
Before the packet is sent, the route request message is sent to the destination
nodes. If the destination node accepts the route request, it will send the route reply
message which means the route request reaches the destination node unless
otherwise the request message will be broadcasted to the next nodes.

Routing in MANET can be affected by different factors as listed below.

2.6.1 Factory that affects routing in MANET‟s

The factors that affect routing in MANET are described below [22].

 Cooperation: if the source node and destination node are out of communication
range, the communication is achieved with the cooperation of the
intermediate nodes. The intermediate nodes can receive and send route
request to the targeted node. The cooperation of the nodes during
communication makes the network dynamic and out of control. Therefore,
each node is responsible to receive packet to itself and forward to other nodes
as required.
 Dynamism of Topology: The nodes of MANET are frequently, randomly and
unpredictably mobile within the network. The nodes are may leave or join of
the network at any point of time, so that nodes mobility and the complexity of

16
 routing is very high. Such mobility entails that the topology of the network as
well as the connectivity between the hosts is unpredictable.
 Lack of fixed infrastructure: The absence of a fixed or central infrastructure
is a key feature of MANETs. That mobile node is not stable, this eliminates
the possibility to establish a centralized authority to control the network
characteristics. Traditional techniques of network management and security
are scarcely not applicable to MANETs.
 Resource constraints: MANET is a combination of mobile devices that are
lack of power, less memory capacity and short lifetime. Due to the less need
of resources in ad-hoc network, using additional equipment degrades the
network performance.
 Security: MANET needs more security due to the dynamic network topology,
limited battery life, bandwidth and small device size of the network.
 Quality of service: Ad-hoc network is dynamically creating the network when
the node desires to communicate with other nodes. Because of nodes mobility,
to achieve quality of service is tedious task. The quality-of-service metric are
information measure, latency and packet delivery ratio. There are some
factors that affect quality of service in MANET. These are described below.
1. Interference between the nodes to achieve transmission
2. Limited resources
3. Highly dynamic
4. Sufficient admission Control

From the above listed factors, the security challenge is studied particularly to detect
and prevent wormhole attack in MANET.

2.6.2 Security threats to MANET‟s

In MANET security is a challenging issue [23]. In MANET the network topology is

dynamic and infrastructure less network. Due to this reason the network is

17
vulnerable to different security threats. In general, there are two types of security
threats in MANET. These are active and passive threats.
Active attack: This type of attack makes change on the information and finally drops
it. Some of the active attacks are described below.
Flooding attack: Attacker uses the network resources like bandwidth,
computational and battery power to minimize network performance.
Black hole Attack: This type of attack drops the data packet sent from the source
node. It disturbs the route discovery process in the routing protocols by sending
route request reply message to the source node as it is the destination node. After
accepting the packet, it will not forward to the destination nodes.
Wormhole Attack: This is a type of active attack. In this type attack, two attacker
which are located in different location communicate to each other by creating their
channel which is called tunnel. By using the tunnel, the malicious nodes forward
reply message to the source node as they have active route to the destination node.
Wormhole attack is the most known type of attack. It is difficult to detect this type
of attack because the tunnel used by the attacker is not part of the network.
Malicious code attacks: This includes the Viruses, Worms, Spywares, and Trojan
horses which can attack both operating system and application.
Gray hole attack: gray hole attack is when an adversary drops some of the packets
that it has to forward to a destination node. Unlike black hole attack that sends a
false RREP message to a RREQ message from a sending node, grayhole attack does
not send false RREP messages. Rather, a grayhole attack sends a true RREP
message containing a genuine route to a destination node as a reply to RREQ
messages. But in grayhole attack, an adversary forwards data packets correctly for
some time and will start dropping some of the packets that are destined to a specific
destination node [24].
Man, in the middle attack: the attacker node resides between the source node and
the destination node to see the information transmitted between the two nodes. In
some cases, the attacker announces to the sender node to communicate with the
destination node and attacks it.

18
Passive attack: the attacker does not make any change on the information but
violates information confidentiality. Some examples are: -
Eavesdropping which observes the confidential information and later will be used
by the malicious node.
Snooping which is accessing others information without permission and that uses
software programs to remotely control activities.
In this thesis work only on the wormhole attack is studied. Every attack has its own
behavior. Therefore, the designed technique to detect and prevent wormhole attack
may or may not work for other attacks. These types of security threats affect the
performance of wireless ad-hoc network. Each attack has its own behavior and way
of attacking. For this study wormhole attack is selected. Because, it is the most
common attack in MANET and difficult to identify it.

2.6.3 Wormhole attack

A wormhole is a type of denial-of-service attack in MANET. In this attack one

malicious node in one location captures the packet and sends to another malicious
node by using their own secret channel which is called tunnel. If there is only one
wormhole attack in a given ad-hoc network, it captures and drops the packet. The
wormhole attack sends fake reply message to the source node with a short path to
the destination node. Then the source node selects this path and sends the packet to
it. Most of the time the attacker node has different behavior than the normal node
like small hop-count and fast response. For example, in the following figure [25]
attacker 1 (M1) and attacker 2 (M2) are wormhole attacks. M1 captures the packet
from the source node to itself and forwards to the next malicious node which is M2.
Then M2 drops the packet or tunnels to other third malicious node.

19
 Figure 2.5 Wormhole attack

2.6.4 Types of wormhole attack modes

Wormhole attack can be launched by using one of the following modes [25].
1. Packet encapsulation: In this mode the attacker node captures the packet
that is received from the source node and encapsulates it. After the packet is
encapsulated, the node sends to another malicious node. After the
encapsulated packet is received by the other node, it will be dropped or
forwarded to other third attacker node.
2. Out-of-band channel: in this mode the two malicious nodes create their own
outer link with high-speed bandwidth.
3. High power transmission: in this type of mode when the source node sends
the packet, the attacker node captures it and sends to the destination node
with high power transmission. The attacker node enforces the source node to
use the path which is selected by the attacker node.
For this study the attacker node has high speed and respond time than the other
normal nodes. And also, the attacker node has less hop-count which indicates the
shortest path to the destination node. Then the source node selects the route that is
announced by the attacker node.

20
 2.6.5 Approaches in securing MANET‟s

This section will discuss the approaches that are taken to secure MANET along
with the security issues. These are described below.
 Authentication: the purpose of the authentication is to verify the identity of
the nodes that participate in the routing activities. At the first the node is
authenticated whether the node is trusting node or not. If the node is
authenticated by the source node, the node is responsible to send or receive
packet to itself or other nodes. This leads to authorized communication
between the two nodes.
 Confidentiality: in the authentication approach the activity relates to the
nodes identity that participates in the network environment. But
confidentiality relates to the security of the information itself. During the
communication the information must be secured. It cannot be accessed by
unauthorized nodes during communication. This can be achieved by using
encryption and decryption techniques.
 Integrity: this approach assures that the packet is received by the destination
or intermediate nodes as it is sent. This means that the packet sent has no
modification, insertion or deletion. The data sent is not changes at all.
 Access control: this function limits and controls access to the resources. In
MANET it is important to control access to information by hackers or
attackers.
 Availability: this involves making the network services and resources
available to all network users. To ensure this approach the node
authentication must be done in the network environment.

The study of this research focuses on the authentication of unauthorized nodes that
participate in the communication of MANET network. In infrastructure-based
network the activity of authorizing nodes may be simple. Because, the clients can be
controlled by giving permissions in the server. But in MANET network there is no

21
central device to control and give permission to the nodes. Therefore, the possible
option is to design a technique that detects and avoids the attacker node.

2.7 Related work

Before starting this work, many research papers are studied relating to the detection
and prevention of wormhole attack in mobile ad hoc network. Different techniques
are proposed to detect and prevent wormhole attack in MANET. Each technique has
its own advantage and drawbacks from other point of view. The previously proposed
techniques are good techniques to detect the security threats (wormhole attacks)
but most of them needs additional resources [26], to deploy in ad-hoc network which
is not suitable for the MANET environment. The other problem in the previous
techniques is the mobility. When there is high nodes mobility, it is difficult to detect
and prevent wormhole attack in MANET. But the most related works are presented
below.

As stated in [27], a hybrid wormhole attack detection (HWAD) algorithm is

developed, which can detect both in-band and out-of-band wormholes by performing
round trip time (RTT) based on hop count and packet delivery ratio (PDR) in a more
optimistic manner than existing solutions. To improve the detection approach, the
suggested algorithm used the Ad-hoc On-Demand Distance Vector (AODV) routing
protocol. The performance metrics of the proposed approach HWAD outperformed
other algorithms in wormhole identification, according to the testing data.
Nevertheless, a small increase in the delay in HWAD whenever the size of the
network increases.

Authors in [28] proposed a graph-based scheme for wormhole attack detection in

MANET. This paper is based on the fact that the Wormhole tunnel reduces
significantly the length of the paths passing through it. This solution requires no
special hardware, such as GPS, and no clock synchronization. It is based only on the

22
information exchanged between different nodes also the routing table of
neighboring nodes. The problem here is that it is able to detect encapsulation type
wormholes only and it cannot detect when the wormhole path length is equal to or
less than 4 hops. The method assumes network to be homogeneous and symmetric.
The Authors in [29] proposed Absolute Deviation Covariance and Absolute
Deviation Correlation algorithms to detect Wormhole in MANET. The algorithm
detects Wormhole by calculating Correlation coefficient between packet sent and
packet received. If the correlation coefficient between packet sends and packet
received is high, the node is malicious. Further, the Absolute Deviation Correlation
Coefficient is utilized to identify the wormholes by measuring the packet drop
pattern. The proposed algorithm does not require any extra conditions for its
execution, also it is light weight and robust. The disadvantage of this method is it
increases computational complexity and it also requires additional information to be
known in prior.

Authors in [4] works to detect wormhole threats, a technique based on Quality of

Service (QoS) was proposed for the entire network. The modified secure AODV
protocol (MSADOV) has been suggested to mitigate wormhole attacks in MANETs
by utilizing the packet forward ratio and round-trip time. Furthermore, the
suggested method can detect both active and passive attacks. However, when the
number of attackers increases packet loss increase as well as packet delivery ratio
decreases.

As stated in [30], special nodes are configured to control the activity of their
neighbor nodes. It is efficient in terms of detection and prevention for wormhole
attack. But the problem is, it is expensive if it is applied in large network.

The authors in [31], proposed a hybrid model that combines neighbor node and hop
count to detect and mitigate wormhole attacks in MANETs while using less power.
The model is capable of detecting and preventing wormhole attacks, although it has
a temporal time delay.

23
In [32], In MANET, a virtual mobile aided algorithm is used to detect and mitigate
wormhole attacks by predicting the actual location of nodes in the ad-hoc network
environment. Additionally, a time-limit detector is employed. In this technique the
virtual mobile is freely moving in the network to know the location of the nodes and
collect nodes‟ information in some time interval. The drawback of this study is the
time delay of the virtual mobile node. It takes time to predict the location of the
nodes in a large network. The technique is efficient if the network size is small.

In [33], The most widely used symmetric algorithms, DES and AES, were
explained. These symmetric techniques are mostly utilized in MANET to protect the
data. The issue is that the attacker can even tunnel the encrypted message.

The author in [12], In DVHOP, a model for identifying and preventing wormhole
attacks was described. The hop-count measure, which is inherited from the routing
protocol, is used to detect wormhole tunnels. The proposed model is easy to deploy,
it does not require any especial hardware like GPS. But lack of integrity and
authentication are the limitation of the study.

In [34], different feature to detect and prevent wormhole attack are described.
According to this study, wormhole attack can be detected based on localization,
timestamp, route request, route reply and neighbor node. Wormhole attack
detection and prevention based on route request and route reply is better than the
other features due to their less overuse of resources.

In [35], A key-based approach is provided for detecting and preventing wormhole

attacks. Even the encrypted packet can be tunneled by the attacker in this
situation. Information confidentiality can be achieved using this method. However,
it is unable to secure data from being hacked.

24
In [36], time-based detection of wormhole attack and prevention is proposed. This
technique need clock to compare the arrival time route request and reply in the
source node.
In [13], the effect of wormhole attack is detected and prevented by calculating the
tunneling time of the attacker node and using digital signature to prevent it. This
approach efficiently detects and avoids wormhole attack. The problem is that, the
attacker node can tunnel the packet even it is encrypted by using digital signature.
This approach is efficient for information confidentiality. For example, in battle
field the soldiers can communicate to each other by encrypting their information
using some technologies. But it cannot prevent them from attacking.
Juhi Biswas, Ajay Gupta, Dayashankar Singh [5] introduced a new approach for detecting
the wormhole attack in MANET but it needs GPS and specialized hardware which
may increase cost.
Authors in [37] proposed wormhole detection mechanism for ad hoc wireless
network. It does not require clock synchronization and provides high power
efficiency but it has some drawbacks like reliability and message overhead.

The author in [38] proposed an intrusion detection system based on anomaly

detection in MANET for black hole attack. In this study, each node is supposed to be
independent of other nodes. The node protects itself from malicious attacks in the
ad- hoc network environment. The technique designed in this study is based on the
reply message of the AODV routing protocol. Here the sender nodes are supposed to
wait some time to accept more than one reply messages from the destination nodes
or intermediate nodes. If the source node or sender node receive only one reply
message, it assumes that there is no an attacker node in the path from the source
node to the destination node and sends the packet. If the source node accepts more
than one reply messages, it assumes that there is an attacker in the path. Then the
source node selects the reply message with minimum destination sequence number.
One of the drawbacks of this paper is that the time delay. To accept more than one
reply message the source node must wait some time. The other drawback of this

25
study is that, when the attacker node and the normal nodes have the same
destination sequence number. If the destination sequence number of the attacker
node and normal nodes is the same, the designed technique cannot isolate the
malicious node.
Those various studies proposed different solutions to detect and prevent wormhole
attack in MANET. All the solutions are implemented by protocol modification, using
special hardware or by using additional nodes to monitor network traffic. Every
solution has some limitations by keeping their respected solutions. For example,
protocol modification may have extra overhead or delay in route discovery process.
Using special hardware can be expensive and resource overuse. By using additional
nodes to monitor network traffic needs high cost to deploy in MANET environment.
The previous solutions are failed to detect and prevent wormhole attacks under
high mobility and to minimize the cost of the proposed techniques in the routing
protocols in MANET.
Mobile ad-hoc networks are affected by a smaller number of resources [13]. The
nodes need less power and have less lifetime. Any technique can be designed to
detect and prevent wormhole attack in MANET. The main thing is that, the
technique designed must be suitable to the ad-hoc network environment. The
technique must be designed by considering the need of additional resources.
Therefore, based on these studies this study focuses on implementing simple and
effective system for prevention and detection of wormhole attacks in MANET
without need of special hardware. The technique is designed by considering the
attacker mobility.
As a summary, the techniques based on localization, time, hop-count and route
request can detect and prevent wormhole attack if there is high mobility. But they
need special hardware like GPS to deploy in ad-hoc network environment.
The related works can be summarized as follows.

26
 Table 2.1 Related work summary

Detection & Year Disadvantages

of
prevention
publi
techniques
Advantages shm
ent
(G.C
)
M. I. H. A. Farrukh Efficient to detect and 2017 Needs high cost to
Aslam Khana[26]
prevent wormhole deploy in large
attack network
Shreya H Shah [13] Efficient to detect and 2016 Can be attacked even
prevent wormhole the information is
attack encrypted
Muhannad Tahboush, Detect in band and out 2021 Small increase of the
and Mary Agoyi[27] of band wormhole delay in HWAD
attacks based RTT and whenever the size of
PDR the network increase.

Mandal et al. in [33] Better to achieve 2019 Cannot

information protect packet
confidentiality from
tunneling by
attacker
Does not need any special 2018 it is able to detect
Mohammad Rmayti,
Lyes Khoukhi[28] hardware such as GPS, encapsulation type
and no clock wormholes only. The
synchronization method assumes
network to be
homogeneous and
symmetric

27
Sayan Majumdar, Prof. light weight and robust 2018 it increases
Dr. Debika computational
Bhattacharyya [29] complexity
and requires
additional
information to be
known in prior

Sankara and 2018 Needs special

Use quality of Service
Murugaboopathi
[4] (QoS) Technique To hardware i.e.,
detect wormhole high cost
threats.

A. Bhawsar, Y. Pandey,
efficient in terms of 2020 it is expensive if it is
and U. Singh,[30] detection and prevention applied in large
for wormhole attack network

B. Bostanipour and B.
a virtual mobile aided 2017 The time delay of the
Garbinato[32] algorithm is used to detect virtual mobile node.
and mitigate wormhole
attacks. and Timely
manner.

A. Kushwaha, M. Mishra, symmetric algorithms, 2019 The issue is that the

and S. C. Shrivastava[33] DES and AES, were attacker can even
utilized tunnel the encrypted
message

easy to deploy, it does not 2015 lack of integrity and

Badran M. Awad[12]
require any especial authentication are the
hardware like GPS limitation of the study

Information confidentiality 2016 it is unable to secure

P. Amish and V. B.
Vaghela[35] can be achieved data from being

28
 hacked

This approach is efficient 2016 the attacker node can

S. H. Shah and C.
Science[13] for information tunnel the packet
confidentiality even it is encrypted by
using digital
signature.

Juhi Biswas, Ajay Gupta, Introduced a new approach 2015 it needs GPS and
Dayashankar Singh[5] for detecting the wormhole specialized hardware
attack in MANET
which may increase
cost

provides high power 2016 it has some

Sandeep Kumar Arora,
Miss Ayushree[37] efficiency drawbacks like
reliability and
message overhead

intrusion detection system 2018 the time delay

Solomon Gebremeskel
based on anomaly
detection

Table 1, the advantage and disadvantage or limitation of the previously done

researches is explained. Based on this the drawback of the studies is almost related
to the mobility and the required resource to deploy in ad-hoc network environment.

29
 Chapter 3 Methodology

3.1 Overview

This part covers the proposed technique which is used to detect and prevent the
effect of wormhole attack in MANET. The implementation of the technique
employed and tools employed are described below.

3.2 Manet routing protocols

In ad-hoc network there are different routing protocols. Mainly, they are classified
into three categories[39]. They are reactive, proactive and hybrid protocols.

In reactive protocol[9] the route is established when it is needed which means on

demand. When a node wants to transmit data from one node to another node, the
route will be initiated. AODV is an example of reactive protocol. Proactive protocol is
a type of routing protocol that constantly updates it route to establish nodes
connection. Hybrid protocol is the combination of both reactive and proactive
routing protocols.

For the purpose of this work the AODV routing protocol is chosen. The reason is
that, this type routing protocol is the most known type of routing protocol in
MANET. The route is created when necessary. It does not waste time and space for
unnecessary route requests.

Different routing protocols are created that determine how different network
devices communicate with each other and how to select routes between any two
nodes on mobile ad-hoc networks and other wired networks. Generally, routing
method is one of the complicated and exciting analysis places. Many routing
protocols have been designed for MANET environment and some of them are
AODV, OLSR, and DSR.

30
In MANET, AODV is one of the well-known On-Demand Routing techniques. Some
scientists explained the routing protocol and discussed the weaknesses of the AODV
routing protocol in ad-hoc routing protocols and the attacks which can be performed.
Based on the researchers, AODV technique is the most unprotected against the
wormhole attacks.

3.2.1 AODV (Ad-hoc On-Demand Distance Vector)

Ad hoc On-demand Distance Vector Routing protocol is an enhanced version of

DSDV and DSR. AODV minimizes the number of route requests broadcast by
creating routes on-demand as opposed to DSDV that maintains the list of all the
routes in the routing table.

To find the best path to the destination node, the source nodes broadcast a route
request packet to their neighbor nodes. The neighbors in turn broadcast the packet
to their next neighbors till the route request reaches an intermediate node that has
a recent route information about the destination or till it reaches the destination
node (Figure 3.1 (a)). A node discards the route request sent by neighbor nodes that
it has already seen. Every route request packet and route reply packet use sequence
numbers that indicate the freshness of the route request and to make sure that if
the intermediate nodes reply to route requests, they reply in unicast form with the
latest information. When a node wants to forward route request packet to its
neighbors, it also records in its table any information about the route request
received. Based on the received information unicast path is created to make sure
that the route request is achieved. AODV uses only symmetric links that indicates
the route reply packet follows the reverse path as the route request packet comes.
As the route reply packet travels back to the source node as shown in Figure 3.1 (b),
the nodes along the path enter the forward route request into their routing table. If
the source node moves or changes it location then it can reinitiate route discovery to
the destination node. If one of the intermediate nodes move to any position then the
moved nodes neighbor senses a link failure and then sends a link failure

31
notification to its neighbors till it reaches to the source node upon which the source
node can reinitiate route discovery process again if it is needed[40].

Figure 3.1 Route request and route reply example

Ad-hoc on-demand distance vector [41] mainly contains some control messages that
are used to establish connection between the source node and the destination node.
These are described below.

32
 A. Route Request (RREQ) Message
This message is used by the AODV routing protocol to create path to the destination
for the first time. This message contains the unique number of the request,
sequence number, IP address of the destination node and the hop count initialized
by zero (0).

Figure 3.2 Route request message format [42]

The route request message has the destination sequence number, source sequence
number, destination and originator IP address and hop count of the route. This is
the format of the request message in the routing table.

B. Route Reply Message (RREP) Message

This is the same to the route request message which is sent from the destination or
intermediate nodes to the source node as the request message is accepted. If the
source node accepts the route reply message, which indicates a path or route is
established between the source node and the destination node. Then the packet will
be sent to the destination.

33
 Figure 3.3 Route reply message format [42]

In the request reply message, there is no source sequence number. Only the
destination sequence number is sent to the source node.

C. Route Error (RERR) Message

When a node detects link breakage, it will respond error message to the source node
that shows there is no path to the destination or the link is failed. If the source node
receives this message, it will conclude that there is a link problem to send the data
in the selected path. Then an alternative path will be recovered by broadcasting the
request message again and again.

Figure 3.4 Route error message format [32]

34
In the route error message, the unreachable information is sent to the source node
to announce that the destination node is unreachable. This message also helps to
the AODV routing protocol to select another path during route failure.

3.2.2 Communication between nodes

In MANET nodes are self-organized. The communication between the nodes is

achieved without existing base station or fixed network infrastructure. Each node is
responsible to receive and send packet from one node to other nodes. The nodes can
act as base station and at the same time as normal nodes.

In MANET there are three types of nodes [26]. These are the source node that sends
data to other nodes, the destination node that receives the packet from the source
node and the intermediate node that can be either normal node or malicious node.

Source Node: All source nodes are mobiles that can be connected dynamically at any
time. In this study the source nodes are supposed to be trust nodes. First the source
node initiates route discovery process by sending route request to its neighbor
nodes. The neighbor nodes send route reply to the source node to tell there is route
to the destination node. Until the route request reaches to the destination node, the
route request will be forwarded to the next neighbor nodes. Then the destination node
selects the route with minimal hop-count to unicast the route reply. The route
remains in the route tables of the nodes through shortest path until the route is no
longer needed. The source node starts the data transmission as soon as it receives
the first reply message, and then later updates its routing table information of
better route to the destination node. Each route table entry contains at least the
following route information.
A. Destination node
B. Next hop number of hops
C. Destination sequence number
D. Active neighbors for the route
E. Expiration timer for the route table entry

35
The route discovery process is reinitiated again to establish a new route to the
destination node if the Source Node changes its location or out of communication
range. If the link is broken and the node receives a notification, and Route Error
(RERR) control packet is being sent to all the nodes that uses this broken link for
further communication. The source node then restarts the discovery process.

Destination Node: The destination sequence number of a given node specifies the
freshness of a route to the destination node before it is accepted by the source node.
The destination sequence number of the nodes is updated if the destination
sequence number of the reply message is greater than the destination sequence
number in the routing table. The source node can receive more than one reply
messages. But the reply message with greater destination sequence number or
equal destination sequence number with less hop-count is selected.

Intermediate Node: in this study, there are two types of intermediate nodes which
are the normal nodes and malicious nodes (wormhole attack).

Normal Node: the normal intermediate node is used if the source node is out of
communication range. The intermediate normal nodes receive route request from
the source node and forward to the next node and continues till the route reply
reaches to the destination node. Simply the normal nodes act as bridge between the
source node and destination node.

Wormhole Node: MANET is infrastructure less and dynamic network. Due to this
reason, the network is vulnerable to different malicious attacks. One of the
malicious attacks is the wormhole attack. In this attack two or more attacks can
create their own communication link to absorb the packet sent from the source node
to themselves. After accepting the packet by the attacker node, the packet can be
dropped or forwarded to other malicious nodes. This malicious node activity causes
to interrupt the route from the source to the destination node and will degrades the
network performance as a whole. In AODV routing protocol, the process of
destination node route discovery is the responsibility of the intermediate nodes. The

36
intermediate nodes can be either trust nodes or malicious nodes. For this purpose, a
mechanism is needed to identify the identity of the intermediate nodes.

The malicious nodes do not do this process. The attackers cannot check the route
request in the routing table. Simply it sends the fake information to the source node
that have fresh and short path to the destination node. Then the source node sends
the packet to the malicious node and it drops it.

[Link] Sequence number

AODV differs from other on-demand routing protocols in that is uses sequence
numbers to determine an up-to-date path to a destination. Every entry in the
routing table is associated with a sequence number. The sequence number act as a
route timestamp, ensuring freshness of the route. Upon receiving a RREQ packet,
an intermediate node compares its sequence number with the sequence number in
the RREQ packet. If the sequence number already registered is greater than that in
the packet, the existing route is more up-to-date [43].

3.2.3 Intrusion detection approaches

The proliferation of Internet has changed the way people accomplish their tasks,
exchange information and communication. However, security is one of the
challenges on these emerging technologies. Therefore, securing the network devices
and communication channels have paramount importance. Although, there are a lot
of attempts made, still security and privacy are the main threat and bottleneck of
wireless communication.

Intrusion detection can be used to protect computers and information from

attackers or intruders. The detection is done by collecting audit data from the
connected devices. Attackers have different behavior than normal computer devices.
There will be predefined information to compare the attackers‟ activities.

37
Intrusion detection systems [44] are systems which are used to detect and avoid
intruders based on their audit data collected. Basically, there are two types of
intrusion detection systems. These are network-based intrusion detection systems
and host-based intrusion detection systems. In network-based intrusion detection
system, the intrusion detection system is placed in gateways or firewalls. When the
packet passes through the gateway, the nature or behavior of the packet is checked
against the predefined audit data. If the collected audit data is abnormal, it will be
detected as from intruders.

In host-based intrusion detection systems, each device is responsible to control its

activity and protect itself from attackers. The intrusion detection system is placed
in each network device.

In this study, the host-based intrusion detection system is used which is based on
anomaly detection.

[Link] Intrusion detection using anomaly detection

An intrusion detection based on anomaly detection [45] works based on audit data
that helps to identify nodes activity. The nodes in MANET can be either normal
nodes or malicious nodes. A node is said to be malicious or normal node, it is based
on the audit data gathered from the node‟s activity. During nodes communication,
the malicious node sends fake information to the sender node. After the sender node
receives the reply message, the behavior of the node is identified based on the
predefined rules. The audit data collected from the nodes is compared with the
predefined criteria which is already identified.

3.2.4 Proposed solution

To achieve the detection and prevention of Wormhole attack in MANET, an

intrusion detection system based on anomaly detection (SAODV) technique is
designed that uses the control messages to identify attackers. The technique does
not need any additional resource to deploy in mobile ad-hoc network. In mobile ad-

38
hoc network, the malicious nodes have different behavior than the normal nodes
[46]. The malicious nodes have misbehavior in the network environment and
degrade the network performance. The misbehavior of the attacker node is detected
and removed from the network communication.

During the route request from the source node, the destination node sends reply
message to the source node. After the destination node‟s reply message is
accumulated, the node‟s misbehavior is identified and detected. In this case, how to
know whether the destination node is trusted node or not? The designed technique
works as follows.

If the source node receives more than one reply message, there will be an attacker
in the path. If there is only reply message, the path that the reply message comes is
trusted and the data will be sent to the destination node. Most of the time the
malicious node has fast response time than the normal nodes and a smaller number
of hop counts. To get more reply messages the source node must wait till the all-
reply messages are accepted to check the number of reply messages. All the reply
message is stored in the routing table. Then the number of reply messages and
destination sequence number are used to detect the wormhole attack.

In this case, the above explained idea may be failed. To support this idea, the
sequence number difference of the route reply and route request and threshold
value are used. This method avoids the wormhole attack by not updating the routing
table if the attacker is detected. The model for this method is presented as follows.
In this case the source node and the destination are supposed to be trusted nodes.
The problem is in the intermediate nodes. As stated in the previous sub section, the
intermediates nodes may be normal nodes or malicious nodes. First the source node
initiates the communication by broadcasting the route request to its neighbor nodes.
The neighbor nodes accept the route request and send reply to the source node.
Every route request and route reply have sequence number that indicates
freshness of the route request or route reply.

39
Therefore, the source node records the sequence number of the route request and
route reply and calculates their difference. If the difference is greater than some
threshold value, then the node that sent the route reply is detected as malicious
node. Then the routing table will not be updated and the other nodes cannot use it
for further routing information.

The proposed modified secure AODV routing protocol is given below.

To find the route discovery, the source node sends an RREQ packet to their
surrounding node. When the RREQ message is received, the network nodes check to
see if it is a destination node. If the node is proven to be a destination node, it is
returned to the source node. In another situation, the request message is forwarded
to a network node's neighbor. This method will be repeated until the target node
receives the route request packet. Sequence number of route request and route
reply is computed for every node. If the sequence number of route request and route
reply is greater than the threshold value, then we assume that the link is a
wormhole-affected link, with two malicious nodes involved in the process. After
malicious nodes have been identified, an alarm message is issued to every node in
the network. Each node is responsible for eradicating harmful nodes. If a neighbor
node accepts the alert message, the sender will receive an RERR (Route error)
message. It will re-enable route discovery and find a new path to the receiver that is
free of malicious nodes. As a result, wormhole attacks on the network can be

40
avoided. If it is less than the threshold, we can conclude that packet loss is caused
by network traffic. If equal That is an authentic path. So, the packet is sent to the
destination node.

The proposed model is presented in the following diagram.

Start

Broadcast route request & receive route replay

NO

If Sequence number
d/ce b/n route request
& route replay<thrd
value.

YES

Send packet to the destination node

End

Figure 3.5 Flow chart of the proposed

41
The model shows that, first the source node sends route request to the next
neighbor nodes and accepts route reply. In AODV each route request and route
reply have sequence number that indicates the freshness of the route. Based on this
concept, the source node calculates the sequence number difference of the route
request and route reply. If the difference is less than the threshold value, the packet
will be forwarded to the route replied node.

3.2.5 Implementation

This section describes the implementation of the three routing protocols which are
normal AODV, AODV under wormhole attack and the proposed solution. The tools
to simulates the proposed solution is done by using NS-2 (Network Simulator 2) and
NAM (Network Animator).

[Link] Implementation of the simulation system

The simulation of MANET using network simulator follows different steps range
from TCL script to the back-end C++ program. This includes writing TCL script to
generate mobile nodes and topology, creating mobile nodes mobility how they move
from initial location to other position and generating the network information that
contains the nodes‟ detail information. The mobility of the nodes is visualized in the
NAM simulator which visualizes the mobility of the node from one location to other
location. The TCL script generates both the .tr and .nam files that contains the
nodes information.

The result of the network is analyzed by using 11, 15, 20, 25, 30 and 35 nodes and
attach CBR application that generates constant packets through the UDP
connection. The CBR packet sized chosen for this simulation is 512 bytes long. The
duration of the simulation is 100 seconds within a 800 x 800 flat space. The position
of the nodes is selected randomly in the space for the nodes to show the data flow
and also introduce a random movement to all nodes to show the changes of the data
flow in the network. The simulation of the wormhole attack is tested whether it is

42
working correctly or not in the AODV routing protocol and it is visualized using
NAM. To check the implementation of the proposed system three scenarios are
used. The first scenario is the implementation of AODV routing protocol without
wormhole attack. The second scenario is AODV routing protocol under wormhole
attack. The malicious node is integrated with AODV routing protocol and the result
is evaluated. The third scenario is AODV under defense mechanism. The AODV
routing protocol is modified to detect and protect it from wormhole attack. Finally,
the performance of the three scenarios is evaluated. The scenarios implementation is
described as follows.

[Link] Implementation of AODV in ns-2

In NS-2 the routing protocol AODV [47] is implemented. It contains different C++
files inside AODV which is located in the folder NS-2.35/aodv. These files are
[Link], aodv.h, aodv_packet.h, aodv_rtable.cc, aodv_rtable.h, aodv_rqueue.cc and
aodv_rqueue.h. These are the C++ file which play a vital role in routing in MANET.
These files are used to implement the AODV routing protocol. The .cc extension files
include the main definition of the functions of the AODV routing agents and the .h
extension files include the functions and classes declaration.

The AODV routing protocol can also contain agents and timers. The agent is
responsible to send, receive and processing the data packet.

In mobile ad-hoc network, the communication is achieved via the intermediate

nodes with cooperation of the nodes. Nodes (mobiles) that are out of communication
range cannot exchange packets.

In Figure 3.6, the nodes are randomly distributed in the ad-hoc network
environment. The nodes with green color are sender nodes and the nodes with blue
color are receiver nodes. In this scenario all the nodes are trusted nodes.

43
 Figure 3.6 Nodes distribution in MANET

When the nodes communicate to each other, the packet is sent without any attack in
the network. But sometimes packet can be dropped without any attack in ad-hoc
network due to different factors like battery condition and interference.

In the Figure 3.7, node 1 is sending data packet to node 7. Node 18 and 19 are used
as intermediate nodes to achieve the communication between node 1 and node 7.
Because, node 1 and node 7 are out of communication range. Node 4 is supposed to
send data to node 5 and node 9 to node 8.

44
 Figure 3.7 Nodes communication in AODV

[Link] Simulation of MANET topology with wormhole attack

(WAODV)

The existing AODV routing protocol does not simulate network topology with
wormhole attack behavior. It is modified to support wormhole behavior in the
network simulation. To achieve this the existing AODV routing protocol is cloned to
WAODV. Inside the NS-2.35 folder the WAODV folder is created and, in this folder,
there are a number of C++ files. The file in this folder is also cloned like [Link],
waodv.h, waodv_rtable.cc etc.

To enable the wormhole attack behavior, only the two files are used which are
[Link] and waodv.h. Based on [48], wormhole attack is implemented in both files.
The attacker is declared in waodv.h file as „bool malicious‟ and in [Link] file the
„recv ()‟ and „recvrequest ()‟ functions are modified to add attacker‟s behavior. In
WAODV routing protocol the malicious node is supposed to drop the packet if it is
malicious nodes as follows.

45
 if (malicious==true)
{
drop (p, DROP_RTR_ROUTE);
}

This drop function shows that, if the selected node is a malicious node to forward
the packet, it is supposed to drop the packet. The attacker node is configured with
the highest sequence number and minimum hop count to have fast response to the
node‟s request.

SendReply(rq->rq_src, // IP Detection
1, // Hop Count
Index, // Dest IP Address
4294967295, // Highest Dest Sequence Num
MY_ROUTE_TIMEOUT, // Lifetime
rq->rq_timestamp); // timestamp
In the TCL file the malicious nodes are configured as malicious by using the
following command.

$ns node-config -adhocRouting waodv

For {set i $val(nnaodv)} {$i <

$val(nn) {{incr i} {Set node_($i) [$ns
node]

$node_($i) random-motion 0;}

In the receive function the attacker is supposed to drop the packet when it receives
and in the receive request function of [Link] file, the attacker is configured with
the highest sequence number and minimum hop count as stated in [49] to have fast
response than the normal mobile nodes. Even the attacker node does not check the
routing table. The sequence number of the attacker node chosen is 4294967295 (this

46
is the highest sequence number of AODV routing protocol, 32 bits unsigned integer
value) and hop count is set to 1. In this case the wormhole attack has high response
time than the other node and then the source node selects this node as an
intermediate or trust node to forward its packet to the destination node.

Figure 3.8 AODV routing with single attacker node

In the above figure one node is configured as wormhole attack. The attacker node
absorbs the packet to itself and drops it. The attacker nodes respond the request
message with high speed to confuse the source node as it has trusted route to the
destination node. In this case node 19 and 8 are configured as wormhole attack.
Nodes 1, 2, 3, 4 and 9 are sender nodes and nodes 5, 6, & 7 are receiver nodes. The
other nodes act as an intermediate node used by the sender and receiver nodes.

47
 Figure 3.9 Attacker nodes absorbing & dropping packet

[Link] Analyzing trace files

After simulating different scenarios of the network two main files are created. The
first file is the NAM file with the extension. nam. The NAM file is used to visualize
the nodes animation, packet transfer from one node to other node and to see the
communicating nodes in the network. The second important file is the trace file
with the [Link]. To evaluate the effect of wormhole attack in a given network,
it is important to analyze the trace file that contains the whole network records.

The trace file records every event during the network simulation like the packet
sent and received, the sender and receiver nodes information and the time taken to
transmit the packet from source to destination. In this simulation „new-trace‟ format
of trace file is used. For analyzing the trace file records an awk script is used to
filter necessary records.

The following parameters are used as quantitative metrics to measure the

performance of the designed detection and prevention technique to wormhole attack
in MANET.

48
Number of packets sent: The number of packets sent from the source nodes.

Number of packets received: The number of packets received by the destination

nodes.

Number of packets dropped: The number of packets dropped by an attacker or other

factors like battery life and interference of the nodes.

Packet delivery ratio: Is the ratio of received packets over the sent packets in
percentage.

Throughput: This refers to the ratio of total packets reach to receiver node from the
sender to the time it takes for the receiver to receive the last packet. The
throughput can be affected by different reasons like power of the nodes, bandwidth
and continuous topology change or mobility of the nodes in MANET.

End-to-end delay: This is the time taken to reach the packet sent from source to
destination.

All these parameters are evaluated in case of no wormhole attack, with wormhole
attack and wormhole attack with prevention technique. The performance of the
network is measured by varying the number of nodes and mobility.

To compare the results, different number of mobile nodes and mobility is used. To
generate nodes movement and random CBR traffic the setdest and [Link] files
are used respectively. In this case an animation and trace file are produced to
visualize the nodes animation and data transfer from source to destination.

The Table 3.1 shows the data transfer from source to destination without wormhole
attack.

49
 Table 3.1: Packet sent & received in normal AODV
Measurements Number of nodes
Metrics 11 15 20 25 30
Number of 1282 1284 1288 1280 1297
packet sent
Number of 1278 1282 1284 1278 1296
packet received
Table 3.1 shows that the packet sent and received in normal AODV routing protocol
(without wormhole attack). As the number of nodes increase, the packet sent and
received are balanced which mean the packet sent is received by the destination
node except some packets due to environmental factors like interference and low
battery life of the nodes. For example, from the above table the packet received from
source to destination 1282 when the number of nodes is 15. When the number of
nodes increase from 15 to 25, the packet received from source to destination is 1296
and the packet sent is 1297. In this case the packet drop due to environmental
factors is only 1.

Table 3.2 shows the data transfer from source to destination under
wormhole attack.
Table 3.2: Packet sent & under wormhole attack

Measurements Number of nodes

Metrics 11 15 20 25 30

Number of 971 953 975 979 970

packet sent
Number of 142 473 490 234 421
packet received
Table 3.2 shows that the packet sent and received under wormhole attack. The
packet sent is almost dropped by the attacker node. As the number of nodes
increase, the packet dropped is almost similar. For example, when the packet sent

50
is 1280 bytes under 11 nodes, the packet received is 1. If the number of nodes is 25,
the packet sent is 1277 and packet received is 1. The attacker is totally dropping the
packet. This is due to the reason that, the attacker node confuses the source node by
sending the reply message with the highest sequence number and minimum hop-
count as a trust node. The other normal nodes are dominated by the attacker node.

[Link] Implementing SAODV (Secure AODV) to prevent wormhole

attack

In the above section the AODV routing protocol with wormhole attack is
implemented and the result is analyzed. The AODV routing protocol is injected with
wormhole attack. To inject the AODV routing protocol with wormhole attack, receive
and receive request functions of [Link] file is modified.

For the detection and prevention of AODV routing protocol the recvReply function is
modified as follows. This function is modified to count the number of reply messages
to count the number of reply messages from the intermediate nodes or destination
node. If the number of reply message is greater than one, the source node decides
that the reply message is from an attacker node unless the message will be
forwarded to the next node.

AODV:recvReply(Packet *p) {
BroadcastRREP * r = rrep_lookup(rp->rp_dst);
If(ih->daddr() == index) {
If( r == NULL) {
Count = 0;
rrep_insert(rp->rp_dst);
} else {
r->count ++;
count = r->count;
} else {

51
 Forward(p);
}
}

In the AODV routing protocol the communication is initiated by sending route

request. The route request has its own sequence number. The route request will be
accepted by the intermediate nodes or the destination node. After accepting the
route request by the intermediate node or destination node route reply will be send
to the source node. The route reply has all information about the route and nodes
like hop count, sequence number, node id etc. And then the source node will check
the sequence number difference between the route request and route reply nodes. If
the difference is high, the route reply is coming from malicious node. Therefore, the
routing table will not be updated. For the difference calculation the threshold value
is taken. For his purpose the threshold value is 100. This value can be changed to
other small values.

The main thing is, the sequence number difference between the route request and
route reply must be small (in this case it must be less than 100) unless otherwise
the route reply will be rejected by the source nodes.
To change the AODV routing protocol to secure AODV only „$ns node-config – ad
hoc Routing SAODV‟ in TCL script is changed to configure the nodes with secure
routing. In the following TCL script, the „for‟ loop is used to create the nodes which
are configured with secure routing protocol.
$ns node-config -ad hoc Routing saodv

For {set i 0} {$i < $val(nnaodv)} {incr i} {

Set node_($i) [$ns node]

$node_($i) random-motion 0;}

The nodes in the wireless network are configured with TwoRayGround radio
propagation model and Omni-directional antenna in 800x800 MANET environment

52
area. The following TCL script is to configure wireless nodes in MANET. The
simulation is done for 100 seconds.

set val(chan) Channel/WirelessChannel ; # channel type

set val(prop) Propagation/TwoRayGround ; # radio-propagation model
set val(netif) phy/WirelessPhy ; # network interface type
set val(mac) Mac/802_11 ; # MAC type
set val(ifq) Queue/DropTail/PriQueue ; # interface queue type
set val(ll) LL ; # link layer type
set val(ant) Antenna/OmniAntenna ; # antenna model
set val(ifqlen) 150 ; # max packet in ifq
set val(nn) 25 ; # number of mobile nodes
set val(nnaodv) 24 ; # number of aodv mobile nodes
set val(cstop) 400 ; # time of connection end
set val(rp) AODV ; # routing protocol
set val(x) 800 ; # x dimension of topography
set val(y) 800 ; # y dimension of topography
set val(stop) 100.0 ; # time of simulation end
set val(cp) “conp.tc1” ; # connection pattern
set val(cc) “[Link]” ; # CBR connection

The following figure (Figure 3.9) shows that the data transfer from sender to
receiver node is achieved successfully. The attacker node is rejected by the source
nodes and intermediate nodes. In this case, node 19 with the red color is the attacker
node. Nodes 6, 7 and 5 are receivers and nodes 1, 3, 2, 9, and 4 are senders. In this
secure AODV routing protocol the packet is flowing from node 1 to node 7 by using
16 and 11 intermediate nodes. Because node 1 and node 7 are out of communication
range. They cannot communicate directly.

53
 Figure 3.8 Secure data transfer from source to destination

The attacker node is changing its position to confuse the nodes. But the detection
and prevention technique are designed by considering the nodes mobility. When the
source node floods the request message the intermediate nodes or destination nodes
send reply message to the source node. The request message and reply message
have their own sequence number. In normal nodes communication, the sequence
number difference of request and reply message is small. But if there is an attacker
node, the sequence number difference between sender node and intermediate node or
destination node will be large.

In some cases, this idea may be failed. To support this idea, the number of route
reply and hop count is added. In AODV routing protocol the route request is flooded
and the route reply is unicasted from the intermediate nodes or destination node to
the source node. If the source node accepts more than one route reply, it decides there
is an attacker in the route. This helps the nodes to detect the wormhole attack. The
designed technique works not only detection but also prevents from wormhole

54
attack. For prevention as stated above the designed technique prevents the attacker
by not modifying the routing table if the sequence number of the route request and
route reply difference is greater than some threshold values.

In the C++ code, the following block of code is added to the receive reply function of
AODV routing protocol.

This block of code plays a vital role in avoiding the wormhole attack in the routing
process. The above block of code tells if the sequence difference between route
request and route reply is less than some threshold value (100) and if the sequence
number of the request message and reply message are not the same, the routing
table will not be updated. The reply message of the attacker node is not added to the
routing table. Therefore, the other nodes cannot find this reply message in the
routing table and do not use for routing in the routing process. The wormhole attack
has fast response time than the other normal network nodes due to the highest
sequence number of the attacker node. By default, the AODV routing protocol uses
the route with less hop-count and fast response time. This makes the routing
protocol unsecure.

Some of the parameters that were used to evaluate the performance of the proposed
model are sent and received packet. Based on these parameters the packet initially
sent was 956 using 11 nodes. The packet received is 951 which means 5 packets is
dropped due to the wormhole attack and other factors. When the number of nodes
increase from 11 to 35, the packet drops increase. This is due to the reason that, for
dense network nodes there may be more reply messages to the source node.

55
The following table shows the packet sent and received under secure system.

Table 3.3: Secured AODV packet sent & received

Measurements Number of nodes

Metrics 11 15 20 25 30

Number of packets 956 968 970 980 987

sent
Number of packets 951 953 966 930 920

Received

SAODV with defense mechanism has almost related result with normal AODV
routing protocol. The above table shows that the packet sent and received under
secure routing protocol is better than routing protocol under wormhole attack.

56
 Chapter 4 Results and discussions
This section explains the results and goes over the many scenarios and simulation
setup parameters that were used during the simulation. Simulation result analysis
is done in terms of throughput, packet delivery ration and average end-to-end delay.
These are used to measure the performance of the network under wormhole attack
and without wormhole attack. These parameters are evaluated based on the packet
received and forwarded in certain time interval.

4.1 Simulation setup

To study the detection and prevention mechanism NS-2 is used to done different
experiments and to evaluate its effectiveness on preventing wormhole attack in
AODV. The process of creating mobile nodes consists of mobile node configuration
and mobile node construction steps. Each node is assumed to be equipped with a
wireless transceiver operating on 802.11 wireless standards. The type of antenna
used is Omni- directional. The Random Waypoint Model is used as a mobility
model. A node in this model randomly chooses a destination point (waypoint) in the
area and moves with constant speed on a straight line to this point. After waiting a
certain pause time, it chooses a new destination and speed, moves with constant
speed to this destination, and so on. The destination points are uniformly randomly
distributed on the system area. The nodes position is configured by using setdest.
For generating traffic Constant Bit Rate (CBR) traffic sources are used for
generating data packets. The source- destination pairs are spread randomly over
the network. To generate the traffic file randomly the NS-2 [Link] file is used.

The following parameters are used to set up the simulation environment.

57
 Table 4.1 Simulation parameters

Parameters Values
Physical medium Wireless Channel

Propagation Model Two Ray Ground

Traffic model CBR/UDP
Simulator NS-2.35

Simulation time 100

MAC Protocol 802.11
Routing protocol AODV
Number of nodes 11,15,20,25,30,35
Simulation area 800x800
Mobility model Random waypoint

Packet size 512 bytes

The simulation area of the ad-hoc network is configured by using the above
parameters. The CBR/UDP traffic model is selected. The AODV routing protocol is
chosen to make routing. The nodes are increased like 11, 15, 20, 25, 30 and 35
during the simulation to see the result. For nodes mobility random waypoint is used
in 800x800 simulation area.

The following are the parameters used to evaluate the network's performance:

 Packet delivery ratio: The amount of data packet delivered to the

destination node from the source node.
 Packet delivery ratio = total packet received/total routing packet
 Throughput: The rate at which a network sends and receives data.
 Throughput = packet received/amount of packet forwarded
 End to end delay: The amount of time taken for a packet to be
transmitted from source node to destination.
 End to end delay = packet received time – packet sent time

58
4.2 Results and discussions

The simulation result is done in various modes mainly in normal AODV routing
protocol, AODV under wormhole attack and AODV with defense system. The result
of each scenario is measured and the performance of the three cloned which are
AODV under wormhole, normal AODV and AODV under defense system are
evaluated. First the performance of each AODV and modified AODV routing
protocols are measured and finally the comparison is done for all the three modified
routing protocols.

The following figure shows that the throughput, packet delivery ratio and end to
end delay of the normal AODV routing protocol.

Figure 4.1 Throughput of AODV routing protocol

As it can be seen from the above graph the throughput of the normal AODV routing
protocol is decreasing as the number of nodes increase in the simulation. For
example, when the number of nodes is 15, the throughput of the network is 0.643%.
When there is high nodes mobility, some packets cannot be reached suddenly due to
some environmental factors like interference.

59
The packet delivery ratio of the normal AODV routing protocol is shown in the
following figure.

Figure 4.2 Packet delivery ratio of AODV routing protocol

The packet delivery ratio of normal AODV routing protocol is increasing, if the
number of nodes increase. But in some point the result packet delivery ratio of
AODV routing protocol is the same. This shows that the number of nodes and nodes
mobility does not affect the AODV routing.

The end-to-end delay of AODV routing is presented in Figure 4.3.

Figure 4.3 End to end delay of AODV routing protocol

60
As the graph shows that the end-to-end delay is high if the number of nodes
decrease. If the number of nodes and mobility increase, the end-to-end delay is
getting low. The reason is that, the time taken to reach the packet from source to
the destination node is based on the intermediate nodes.

The following figure shows that the throughput of the AODV routing protocol under
wormhole attack.

Figure 4.4 AODV throughput under wormhole attack

The throughput of AODV routing protocol under wormhole attack is very low. As
the above figure shows, the throughput of AODV low at the beginning and in some
point the throughput is getting high. And if the number of nodes and wormhole
attack mobility increase, the throughput is getting too low. This is because when
the attacker changes its position, it captures more packet to itself.

Figure 4.5 shows that the packet delivery ratio of the AODV routing protocol under
wormhole attack.

61
 Figure 4.5 Packet delivery ratio of AODV under wormhole attack

The packet delivery ratio of the AODV routing protocol is very low. Almost the
throughput and packet delivery ratio of AODV under wormhole attack is the same
which mean all are dropped.

Figure 4.6 shows that the end-to-end delay of AODV routing protocol under
wormhole attack in MANET.

Figure 4.6 End to end delay of AODV under wormhole attack

From the above graph (Figure 4.6) the end-to-end delay is better in AODV under
wormhole attack than normal AODV routing protocol. Because the attacker node is

62
configured with the highest sequence number and minimum hop-count. Therefore,
the attacker node has fast response time than the other normal nodes.

Figure 4.7 shows that the throughput of the network under proposed defense
system.

Figure 4.7 Secure AODV throughput

As the graph shows that the throughput of the secure AODV routing protocol has
better result than AODV under wormhole attack and almost similar with normal
AODV routing protocols. The throughput of the network increases if the number of
nodes and attacker node mobility increase. That means that if the attacker node
changes its position, the communication cannot be disturbed by the attacker node.
This is one property of the proposed technique. Because the objective is to increase
the throughput of the network under wormhole attack.

63
Figure 4.8 shows that the packet delivery ratio of AODV routing protocol under
defense system.

Figure 4.8 Packet delivery ratio of AODV under defense system

The graph above shows that the packet delivery ratio AODV routing protocol under
defense system which has better result than AODV under wormhole attack. The
graph is number of nodes versus packet delivery ratio. The result is increasing if the
number of nodes and attacker node mobility increase. The following graph shows
that the end-to-end delay of AODV routing protocol under defense system.

Figure 4.9 Secure AODV end to end delay under wormhole attack

64
The graph above shows the end-to-end delay of AODV under defense system varies
which means the time delay sometimes increase and sometimes decrease. In
general, the proposed technique takes time to make decisions. The reason is that,
when the source node sends route request, it must wait some time to count the
number of route reply messages to detect wormhole attack. Due to this reason the
designed detection and prevention technique takes some time to accept the route
reply message from the intermediate nodes or from the destination nodes. The
following tables and figures show that the comparative result of normal AODV,
AODV under wormhole attack and AODV under defense system in a single table
and graphs.

Table 4.2 Comparative result of throughput

In the above table, the throughput of the routing protocols AODV, WAODV and
SAODV is compared by increasing the number of nodes from 11-25 nodes. If the
number of nodes increase in normal AODV and SAODV, the throughput of the ad-
hoc network increases. The throughput of the proposed technique has better than
AODV under wormhole attack.

65
 Figure 4.10 Comparative throughput result

The above graph shows that the throughput of the routing protocol AODV under
wormhole attack, without wormhole attack and with defense mechanism. In this
case, the throughput of the proposed technique (SAODV) is better than WAODV
(aodv routing protocol with attacker). As the number of nodes increase under
wormhole attack, the throughput of the routing protocol increases. From the above
figure the line with red color is for secure AODV, green line for normal AODV and
blue line for AODV under wormhole attack.

The following table shows that the packet delivery ratio of the normal AODV,
AODV under wormhole attack and AODV with defense mechanism. If the number
of nodes increase almost the packet delivery ratio of normal AODV and AODV with
defense mechanism is the same. But the packet delivery ratio of AODV under
wormhole attack is very low. For example, the packet delivery ratio of AODV under
11 nodes is 100% and for secure AODV 100%.

66
 Table 4.3 Comparative result of packet delivery ratio

The bellow figure shows the comparative result of the packet delivery ratio for
SAODV, AODV and WAODV cloned routing protocols. The packet delivery ratio for
AODV is almost similar with SAODV. But if the number of nodes increases, the
packet delivery ratio of SAODV is less. The packet delivery ratio of WAODV is very
low due to the attacker node.

Figure 4.11 Comparative packet delivery ratio

67
 Table 4.4 Comparative end to end delay result

The last parameter to evaluate the performance of the routing protocol in MANET
is the delay of the packet to transmit from source to destination. In Table 8, the time
delay in AODV, WAODV and SAODV is presented. From the table the time delay
for both SAODV and WAODV is similar. The delay of AODV under wormhole attack
is high. Because, the nodes select every intermediate node to send packet to the
destination node.

The graph to compare the time delay for the three routing protocols is plotted below.

Figure 4.12 Comparative end to end delay result

From the above figure, as the number of nodes increase the delay of the routing
protocol under attack varies. SAODV under wormhole attack takes time as the

68
number of nodes increase. Therefore, the proposed technique has delay as the
number of nodes increase.

4.3 Comparison of the SAODV with the existing solutions

To detect and prevent wormhole attack in mobile ad-hoc network, many researchers
proposed many solutions. Each solution has its own drawbacks and positive sides.
By keeping their good work, the comparison is done between the proposed solution
and the previously done researches regarding to wormhole attack detection and
prevention. The comparison is done by using some parameters as described below.

Hardware requirement: Is any specialized hardware like GPS and synchronized clock
required?
Delay in route discovery process? Are there any additional operations that cause
time delay to transfer data from one node to other nodes?
Handles mobility: Does the proposed solution handles the mobility of the wormhole
attack (when the wormhole attack moves from one location to other location, does
the system remember the previous record of the attacker or calculates again)?
Prevents wormhole attack: Does the proposed solution block the wormhole attack in
the network once detected?

The comparison of the proposed solution with the other techniques shown that, the
proposed system performs better as compared with the other techniques as it does
not need special hardware, cost to deploy and prevents the attacker before attacking
the network in route discovery process. The proposed system cannot be affected by
the wormhole attack mobility. The proposed solution blocks the malicious node and
so does not further harm the network.

69
 Table 4.5 Proposed model comparison with existing solutions

Solution Method Protocol Needs Delay Handles Prevents

used used Hardware mobility wormhole
attack
Temporal leashes Time Tesla Yes No Yes Yes
[53]
Azer [54] Statistics AODV No Yes No No

Jiao et al. [55] Time AODV No No No No

WODEM [56] Location AODV Yes No Yes No

Anju and Neighbor AODV No Yes Yes Yes

Sminesh [57]
WANI [58] Neighbor AODV No Yes Yes Yes
DPS [59] Statistics AODV No Yes Yes Yes
Proposed Statistics AODV No Yes Yes Yes
Model (SAODV)

70
 Chapter 5 Conclusions and recommendations

5.1 Conclusion

This thesis has presented the detection and prevention of wormhole attack in
MANET. As discussed from this study that AODV routing protocol can be exploited
by malicious nodes to perform the wormhole attack behavior. The performance of
AODV routing protocol is decreased if there is malicious node in routing process.
The effect of wormhole attack is analyzed in Mobile ad-hoc network. The AODV
routing protocol is cloned to simulate wormhole attack behavior and the solution to
detect and prevent wormhole attack in NS-2 (version NS-2.35). In this case, three
scenarios were simulated. One is for normal AODV routing protocol, second is for
AODV under wormhole attack and third one is for AODV under defense system. For
each scenario three sub scenarios which are throughput, end to end delay and packet
delivery ratio are done. This is used to compare the proposed technique with the
existing routing protocol and the routing protocol under wormhole attack.

Having simulated the wormhole attack, the packet loss is increased in the ad-hoc
network. The packet loss difference between the AODV routing protocol with and
without wormhole attack is evaluated. The AODV routing protocol gave high
throughput under defense system. The effect of the wormhole attack in MANET
environment is effectively removed. This shows that the overall network
performance is increased under wormhole attack and the proposed technique does
not need any special hardware to deploy in ad-hoc network.

The performance of the ad-hoc network under wormhole attack is evaluated by

using the parameters like throughput, average end to end delay and packet delivery
ratio. Based on the result analysis the throughput of the AODV routing protocol
under defense system has better than the existing AODV routing protocol and
AODV under wormhole attack.

71
5.2 Recommendation

As stated in this thesis, there are different attacks that degrades the ad-hoc
network performance. In this study only, the effect of wormhole attack is covered.
The effect of other routing protocols is not covered. Therefore, the author of this
work has an intention do similar work to implementation new technique to detect
and prevent other security threats.

In this work, only one wormhole attack is created to evaluate and analyze the
developed detection and prevention technique. If the number of wormhole attacks
increase, the performance of the network will decrease or the throughput of the
network can decrease. For future work, the designed technique can be extended to
detect and prevent multiple wormhole attacks in MANET.

72
 References
[1] S. Thapar and S. K. Sharma, “Wormhole Attack Isolation Access from Mobile Ad
hoc Network with Delay Prediction Method,” Int. J. Recent Technol. Eng., vol. 8,
no. 6, pp. 3672–3680, 2020, doi: 10.35940/ijrte.f8230.038620.
[2] C. Science, “Wormhole Attack Detection Ad-Hoc Network,” 2020.
[3] K. Spurthi and T. N. Shankar, “A research on wormhole attack in mobile ad-hoc
networks,” Int. J. Recent Technol. Eng., vol. 8, no. 1 Special Issue 4, pp. 1125–
1130, 2019.
[4] S. Sankara Narayanan and G. Murugaboopathi, “Modified secure AODV protocol
to prevent wormhole attack in MANET,” Concurr. Comput. Pract. Exp., vol. 32,
no. 4, pp. 1–12, 2020, doi: 10.1002/cpe.5017.
[5] J. Biswas, A. Gupta, and D. Singh, “WADP: A wormhole attack detection and
prevention technique in MANET using modified AODV routing protocol,” 9th Int.
Conf. Ind. Inf. Syst. ICIIS 2014, 2015, doi: 10.1109/ICIINFS.2014.7036535.
[6] J. P. Hubaux, L. Buttyán, and S. Čapkun, “The quest for security in mobile ad hoc
networks,” Proc. 2001 ACM Int. Symp. Mob. Ad Hoc Netw. Comput. MobiHoc
2001, no. July 2016, pp. 146–155, 2001, doi: 10.1145/501436.501437.
[7] N. Garg, R. P. Mahapatra, and C. S. Dept, “MANET Security Issues,” IJCSNS
Int. J. Comput. Sci. Netw. Secur., vol. 9, no. 8, pp. 241–246, 2009.
[8] Kumar, Sunil & Dutta, Kamlesh. (2016). Intrusion detection in mobile ad hoc
networks: techniques, systems, and future challenges: Intrusion detection in
mobile ad hoc networks. Security and Communication Networks. 9.
10.1002/sec.1484.
[9] D. Asmelash, “ADAMA SCIENCE AND TECHNOLOGY UNIVERSITY SCHOOL
OF ELECTRICAL ENGINEERING AND COMPUTING DEPARTMENT OF
ELECTRICAL AND COMPUTER ENGINEERING A thesis submitted to the
department of electrical and computer engineering of Adama science and
technology University,” no. June, 2018.
[10] L. E. Quispe and L. M. Galan, “Assessment of throughput performance under
NS2 in mobile ad hoc networks (MANETs),” Proc. - 5th Int. Conf. Comput. Intell.
Commun. Syst. Networks, CICSyN 2013, pp. 338–343, 2013, doi:
10.1109/CICSYN.2013.80.
[11] S. Hijazi, M. Moshref, and S. Al-Sharaeh, “Enhanced AODV Protocol for
Detection and Prevention of Blackhole Attack in Mobile Ad Hoc Network,” Int. J.
Comput. Technol., vol. 16, no. 1, pp. 7535–7547, 2017, doi:
10.24297/ijct.v16i1.5728.
[12] B. M. Awad, “Wormhole Attack Detection and Prevention Model in MANET
Based on Hop-Count and Localization,” pp. 1–68, 2015.

73
[13] S. H. Shah and C. Science, “An Efficient approach to detect the effect of
Wormhole attack in MANET,” no. 140370702529, 2016.
[14] M. Computing, “An Overview of MANET : Applications , Attacks and Challenges
Abstract :,” vol. 3, no. 1, pp. 408–417, 2014.
[15] Y. D. Gondi and V. R. Gurrala, “Improvements in aodv routing protocol using
IPV6 and 802.11e in manets,” Int. J. Recent Technol. Eng., vol. 8, no. 3, pp. 4623–
4627, 2019, doi: 10.35940/ijrte.C6835.098319.
[16] T. S. S. Aarti, “Study of MANET : Characteristics , Challenges , Application and
Security Attacks,” Int. J. Adv. Res. Comput. Sci. Softw. Eng., vol. 3, no. 5, pp.
252–257, 2013, [Online]. Available:
[Link]
[17] F. J. Ros and P. M. Ruiz, “Implementing a New Manet Unicast Routing Protocol
in NS2,” Engineering, pp. 1–35, 2004.
[18] S. K. Fatima, S. G. Fatima, S. A. Sattar, and S. M. Ali, “Performance estimation
of Adhoc routing protocols with NS2 simulator,” Int. J. Adv. Res. Eng. Technol.,
vol. 10, no. 2, pp. 215–223, 2019, doi: 10.34218/IJARET.10.2.2019.021.
[19] V. Dhote, A. Motwani, and J. Sondhi, “A Review on Black Hole Attack in Mobile
Adhoc Network,” Int. J. Comput. Appl., vol. 116, no. 11, pp. 1–5, 2015, doi:
10.5120/20377-1962.
[20] Y. Kim, I. Moon, and S. Cho, “A COMPARISON OF IMPROVED AODV
ROUTING PROTOCOL BASED ON IEEE 802 . 11 AND IEEE 802 . 15 . 4 2 .
Routing Protocols for Wireless Network,” Sci. Technol., vol. 4, no. 2, pp. 132–141,
2009.
[21] A. A. Mahamune and M. M. Chandane, “Evaluating routing protocols for mobile
Ad Hoc networks under varying network scenarios,” Proc. 3rd Int. Conf. Intell.
Commun. Technol. Virtual Mob. Networks, ICICV 2021, no. Icicv, pp. 220–225,
2021, doi: 10.1109/ICICV50876.2021.9388574.
[22] S. Aluvala, K. R. Sekhar, and D. Vodnala, “An Empirical Study of Routing
Attacks in Mobile Ad-hoc Networks,” Procedia Comput. Sci., vol. 92, pp. 554–561,
2016, doi: 10.1016/[Link].2016.07.382.
[23] P. Sivakumar and K. Duraiswamy, “A QoS routing protocol for mobile ad hoc
networks based on the load distribution,” 2010 IEEE Int. Conf. Comput. Intell.
Comput. Res. ICCIC 2010, pp. 32–37, 2010, doi: 10.1109/ICCIC.2010.5705724.
[24] P. Khanpara and B. Trivedi, “Security in mobile ad hoc networks,” Adv. Intell.
Syst. Comput., vol. 508, pp. 501–511, 2017, doi: 10.1007/978-981-10-2750-5_52.
[25] G. A. Wani and S. Jamwal, “Determining and Avoiding Wormhole Attack in
MANET,” pp. 1–6, 2016.
[26] F. A. Khan, M. Imran, H. Abbas, and M. H. Durad, “A detection and prevention
system against collaborative attacks in Mobile Ad hoc Networks,” Futur. Gener.

74
 Comput. Syst., vol. 68, pp. 416–427, 2017, doi: 10.1016/[Link].2016.07.010.
[27] M. Tahboush and M. Agoyi, “A hybrid wormhole attack detection in mobile Ad-
Hoc Network (MANET),” IEEE Access, vol. 9, pp. 11872–11883, 2021, doi:
10.1109/ACCESS.2021.3051491.
[28] M. Rmayti, Y. Begriche, R. Khatoun, L. Khoukhi, and A. Mammeri, “Graph-based
wormhole attack detection in mobile ad hoc networks (MANETs),” 2018 4th Int.
Conf. Mob. Secur. Serv. MOBISECSERV 2018, vol. 2018-Febru, pp. 1–6, 2018,
doi: 10.1109/MOBISECSERV.2018.8311439.
[29] S. Majumder and D. Bhattacharyya, “Mitigating wormhole attack in MANET
using absolute deviation statistical approach,” 2018 IEEE 8th Annu. Comput.
Commun. Work. Conf. CCWC 2018, vol. 2018-Janua, pp. 317–320, 2018, doi:
10.1109/CCWC.2018.8301780.
[30] A. Bhawsar, Y. Pandey, and U. Singh, “Detection and Prevention of Wormhole
Attack using the Trust-based Routing System,” Proc. Int. Conf. Electron. Sustain.
Commun. Syst. ICESC 2020, no. Icesc, pp. 809–814, 2020, doi:
10.1109/ICESC48915.2020.9156009.
[31] P. Singh, “A Novel Approach to Detect & Prevent Wormhole Attack Over MANET
& Sensor n/w towards Lower Battery Power Consumption,” IOSR J. Comput.
Eng., vol. 15, no. 1, pp. 51–58, 2013, doi: 10.9790/0661-1515158.
[32] B. Bostanipour and B. Garbinato, “A neighbor detection algorithm based on
multiple virtual mobile nodes for mobile ad hoc networks,” Comput. Networks,
vol. 112, pp. 294–313, 2017, doi: 10.1016/[Link].2016.11.004.
[33] A. Kushwaha, M. Mishra, and S. C. Shrivastava, “Performance analysis of a
selective encryption algorithm for securing text data over mobile ad hoc
networks,” Int. J. Innov. Technol. Explor. Eng., vol. 8, no. 10, pp. 454–460, 2019,
doi: 10.35940/ijitee.I8496.0881019.
[34] M. Imran, F. A. Khan, T. Jamal, and M. H. Durad, “Analysis of detection features
for Wormhole attacks in MANETs,” Procedia Comput. Sci., vol. 56, no. 1, pp. 384–
390, 2015, doi: 10.1016/[Link].2015.07.224.
[35] P. Amish and V. B. Vaghela, “Detection and Prevention of Wormhole Attack in
Wireless Sensor Network using AOMDV Protocol,” Procedia Comput. Sci., vol. 79,
pp. 700–707, 2016, doi: 10.1016/[Link].2016.03.092.
[36] F. Shi, D. Jin, W. Liu, and J. Song, “Time-based detection and location of
wormhole attacks in wireless ad hoc networks,” Proc. 10th IEEE Int. Conf. Trust.
Secur. Priv. Comput. Commun. Trust. 2011, 8th IEEE Int. Conf. Embed. Softw.
Syst. ICESS 2011, 6th Int. Conf. FCST 2011, pp. 1721–1726, 2011, doi:
10.1109/TrustCom.2011.240.
[37] S. K. Arora and ayushrees@gmail com Ayushree, “Detection and performance
analysis of wormhole attack in MANET using DELPHI technique,” Int. J. Secur.
its Appl., vol. 10, no. 10, pp. 321–330, 2016, doi: 10.14257/ijsia.2016.10.10.28.

75
[38] A. D. D. Is, A. Un, and I. V Ersity, “No Title.”
[39] M. Computing and D. K. Punia, “Detecting and Avoiding Wormhole Attack in
Wireless Adhoc Network using Improved DELPHI,” vol. 9, no. 5, pp. 175–180,
2020.
[40] “Saved Link.” .
[41] C. Engineering et al., “DETECTION MECHANISM OF WORMHOLE ATTACK
USING ON DEMAND ROUTING SCHEME IN WIRELESS Upendra Kumar
Purohit *, Umesh Barahdiya ** & Manoj Jakhenia ***,” vol. 2, no. 1, pp. 48–52,
2017.
[42] H. SIMAREMARE, “a Development of Secure and Optimized Aodv Routing
Protocol Using Ant Algorithm,” vol. 4, no. 5, p. 31, 2013.
[43] A. Pandey and B. Mallick, “Introducing Efficient AODV Routing Protocol for
MANET,” Int. J. Comput. Appl., vol. 124, no. 3, pp. 12–15, 2015, doi:
10.5120/ijca2015904247.
[44] M. Ashikur, S. M., and S. Maruful, “Intrusion Detection System for Wireless
ADHOC Network using Time Series Techniques,” Int. J. Comput. Appl., vol. 162,
no. 1, pp. 38–42, 2017, doi: 10.5120/ijca2017913408.
[45] T. S. Et. al., “A Review of the cluster based Mobile Adhoc Network Intrusion
Detection System,” Turkish J. Comput. Math. Educ., vol. 12, no. 2, pp. 2070–
2076, 2021, doi: 10.17762/turcomat.v12i2.1811.
[46] N. Chugh, G. S. Tomar, R. S. Bhadoria, and A. N. Saxena, “A novel anomaly
behavior detection scheme for mobile ad hoc networks,” Electron., vol. 10, no. 14,
pp. 1–18, 2021, doi: 10.3390/electronics10141635.
[47] A. K. Nayak, S. C. Rai, and R. Mall, Introduction to NS2. 2016.
[48] M. O. D. R. S. Kushwah, “Impact and Performance Analysis of WORMHOLE
Attack on AODV in MANET using NS2,” Int. J. Sci. Res., vol. 3, no. 6, pp. 1823–
1826, 2014, [Online]. Available:
[Link]
[49] P. G. Arfaat and A. Mir, “The Impact of Wormhole Attack on the Performance of
Wireless Ad-Hoc Networks,” Int. J. Comput. Sci. Technol., vol. 2, no. 4, pp. 421–
425, 2011.

76
 Appendix
Appendix 1: Sample trace files

s -t 99.792623908 -Hs 4 -Hd -2 -Ni 4 -Nx 616.82 -Ny 410.97 -Nz 0.00 -Ne -1.000000
-Nl AGT -Nw--- -Ma 0 -Md 0 -Ms 0 -Mt 0 -Is 4.0 -Id 5.0 -It cbr -Il 512 -If 0 -Ii 1275 -

Iv 32 -Pn cbr -Pi 220 -Pf 0 -Po 0v

r -t 99.792623908 -Hs 4 -Hd -2 -Ni 4 -Nx 616.82 -Ny 410.97 -Nz 0.00 -Ne -1.000000
-Nl RTR -Nw --- -Ma 0 -Md 0 -Ms 0 -Mt 0 -Is 4.0 -Id 5.0 -It cbr -Il 512 -If 0 -Ii 1275 -
Iv 32 -Pn cbr -Pi 220 -Pf 0 -Po 0

s -t 99.792623908 -Hs 4 -Hd 5 -Ni 4 -Nx 616.82 -Ny 410.97 -Nz 0.00 -Ne -1.000000 -
Nl RTR -Nw --- -Ma 0 -Md 0 -Ms 0 -Mt 0 -Is 4.0 -Id 5.0 -It cbr -Il 532 -If 0 -Ii 1275 -
Iv 30 -Pn cbr -Pi 220 -Pf 0 -Po 0

s -t 99.793038908 -Hs 4 -Hd -2 -Ni 4 -Nx 616.82 -Ny 410.97 -Nz 0.00 -Ne -1.000000
-Nl MAC -Nw --- -Ma 14ee -Md 5 -Ms 4 -Mt 0

r -t 99.793391711 -Hs 5 -Hd -2 -Ni 5 -Nx 482.79 -Ny 210.78 -Nz 0.00 -Ne -1.000000
-Nl MAC -Nw --- -Ma 14ee -Md 5 -Ms 4 -Mt 0

s -t 99.793401711 -Hs 5 -Hd -2 -Ni 5 -Nx 482.79 -Ny 210.78 -Nz 0.00 -Ne -1.000000
-Nl MAC -Nw --- -Ma 13b4 -Md 4 -Ms 0 -Mt 0

r -t 99.793706514 -Hs 4 -Hd -2 -Ni 4 -Nx 616.82 -Ny 410.97 -Nz 0.00 -Ne -1.000000
-Nl MAC -Nw --- -Ma 13b4 -Md 4 -Ms 0 -Mt 0

s -t 99.793716514 -Hs 4 -Hd 5 -Ni 4 -Nx 616.82 -Ny 410.97 -Nz 0.00 -Ne -1.000000 -
Nl MAC -Nw Ma 13a -Md 5 -Ms 4 -Mt 800 -Is 4.0 -Id 5.0 -It cbr -Il 590 -If 0 -
Ii
1275 -Iv 30 -Pn cbr -Pi 220 -Pf 0 -Po 0

r -t 99.798437317 -Hs 5 -Hd 5 -Ni 5 -Nx 482.79 -Ny 210.78 -Nz 0.00 -Ne -1.000000 -
Nl MAC -Nw Ma 13a -Md 5 -Ms 4 -Mt 800 -Is 4.0 -Id 5.0 -It cbr -Il 532 -If 0 -
Ii
1275 -Iv 30 -Pn cbr -Pi 220 -Pf 1 -Po 0

77
s -t 99.798447317 -Hs 5 -Hd -2 -Ni 5 -Nx 482.79 -Ny 210.78 -Nz 0.00 -Ne -1.000000

-Nl MAC -Nw --- -Ma 0 -Md 4 -Ms 0 -Mt 0

Appendix 2: Sample TCL scripts

#===================================
#Simulation parameters setup
#===================================
set val(chan) Channel/WirelessChannel ;# channel type
set val(prop) Propagation/TwoRayGround ;# radio-propagation model
set val(netif) Phy/WirelessPhy ;# network interface type
set val(mac) Mac/802_11 ;# MAC type
set val(ifq) Queue/DropTail/PriQueue ; # interface queue type
set val(ll) LL ; # link layer type
set val(ant) Antenna/OmniAntenna ; # antenna model
set val(ifqlen) 150 ; # max packet in ifq
set val(nn) 20 ; # number of mobilenodes
set val(nnaodv) 19 ; #number of aodv mobile nodes
set val(cstop) 451 ; #time of connection end
set val(rp) AODV ; # routing protocol
set val(x) 750 ; # X dimension of topography
set val(y) 750 ; # Y dimension of topography
set val(stop) 10.0 ; # time of simulation end
set val(cp) "[Link]" ; #connection pattern
set val(cc) "[Link]" ; #CBR connection

#===================================

78
# Initialization

#===================================

#Create a ns simulator

set ns_ [new Simulator]

$ns_ use-newtrace

set tracefd [open [Link] w]

$ns_ trace-all $tracefd

set namtrace [open [Link] w]

$ns_ namtrace-all-wireless $namtrace $val(x) $val(y)

#Setup topography object

set topo [new Topography]

$topo load_flatgrid $val(x) $val(y)

create-god $val(nn)

set chan_1_ [new $val(chan)]

set chan_2_ [new $val(chan)]

# configure node, please note the change below.

$ns_ node-config -adhocRouting $val(rp) \

-llType $val(ll) \

-macType $val(mac) \

-ifqType $val(ifq) \

-ifqLen $val(ifqlen) \

79
-antType $val(ant) \

-propType $val(prop) \

-phyType $val(netif) \

-topoInstance $topo \

-agentTrace ON \

-routerTrace ON \

-macTrace ON \

-movementTrace ON \

-channel $chan_1_

# creating mobile AODV nodes for simulation

puts "Creating nodes..."

for {set i 0} {$i < $val(nnaodv)} {incr i} {

set node_($i) [$ns_ node]

$node_($i) random-motion 0 ;#disable random motion

}
# Creating worm Hole nodes for simulation
$ns_ node-config -adhocRouting WAODV
for {set i $val(nnaodv)} {$i < $val(nn)} {incr i} {
set node_($i) [$ns_ node]
$node_($i) random-motion 0 ;#disable random motion
$ns_ at 0.10 "[$node_($i) set ragent_] wormhole"
$ns_ at 0.01 "$node_($i) label \"Wormhole\"" }
puts "Loading random connection pattern..."
set god_ [God instance]

80
source $val(cp)
source $val(cc)
for {set i 0} {$i < $val(nn) } {incr i} {
$ns_ initial_node_pos $node_($i) 30 }

for {set i 0} {$i < 4 } {incr i} {

$ns_ at $val(cstop) "$cbr_($i) stop" }
for {set i 0} {$i < $val(nn) } {incr i} {
$ns_ at $val(stop).000000001 "$node_($i) reset"; }
$ns_ at $val(stop) "finish"
$ns_ at $val(stop).0 "$ns_ trace-annotate \"Simulation has ended\""
$ns_ at $val(stop).00000001 "puts \"NS EXITING...\" ; $ns_ halt"
proc finish {} {
global ns_ tracefd namtrace
$ns_ flush-trace
close $tracefd
close $namtrace
exec nam [Link] &
exit 0
}
puts "Starting Simulation..."
$ns_ run

Appendix 3: Trace file field types

Field 0: event type
s: send
r: receive

81
d: drop
f: forward
Filed 1: General tag
-t: time
Field 2: Next hop info
-Hs: id for this node

-Hd: id for next hop towards the destination

Field 3: Node property type tag
-Ni: node id
-Nx –Ny -Nz: node‟s x/y/z coordinate
-Ne: node energy level
-Nl: trace level, such as AGT, RTR, MAC
-Nw: reason for the event
Field 4: packet info at MAC level
-Ma: duration
-Md: dest‟s ethernet address
-Ms: src‟s ethernet address
-Mt: ethernet type
Field 5: Packet information at IP level
-Is: source address. Source port number
-Id: dest [Link] port number
-It: packet type
-Il: packet size
-If: flow id
-Ii: unique id
-Iv: ttl value

82
Field 6: Packet info at “Application level” for AODV
-Pt: Control message type,
-Ph: Hop-count,
-Pb: Broadcast-id,
-Pd: Destination,
-Pds: Dest Seqno,
-Ps: Source,
-Pss: Source Seqno
-Pl: Lifetime.
-Pc: Pkt Type, REPLY/ERROR for CBR
-Pn: This denotes the application of “CBR”
-Pi: sequence number
-Pf: how many times this pkt was forwarded
-Po: optimal number of forwards

Appendix 4: AWK script to filter necessary data from trace file. the trace file cannot
be analysed directly. The necessary data must be filtered to analyse the performance
of the ad-hoc network. For this awk script is used.

BEGIN {

print("\n\n******** Network Statistics ********\n");

# Change array size from 20 to any number of nodes for which u are doing
simulation.

# i.e. change values of arrays packet_sent, packet_drop, packet_recvd,

packet_forwarded, energy_left,

packet_sent[20] = 0;

packet_drop[20] = 0;

83
packet_recvd[20] = 0;

packet_forwarded[20] = 0;

# Change energy assigned to initial node (as per your simulation tcl file)

# Initial Energy assigned to each node in Joules

total_pkt_sent=0;

total_pkt_recvd=0;

total_pkt_drop=0;

pkt_delivery_ratio = 0;

start = 0.000000000;

end = 0.000000000;

packet_duration = 0.0000000000;

recvnum = 0;

delay = 0.000000000;

sum = 0.000000000;

i=0;

state = $1;

time = $3;

# For energy consumption statistics see trace file

node_num = $5;

node_id = $9;

84
level = $19;

pkt_type = $35;

packet_id = $41;

# In for loop change values from 20 to number of nodes that u specify for your
simulation

if((pkt_type == "cbr") && (state == "s") && (level=="AGT")) {

for(i=0;i<20;i++) {

if(i == node_id) {

packet_sent[i] = packet_sent[i] + 1; } }

}else if((pkt_type == "cbr") && (state == "r") && (level=="AGT")) {

for(i=0;i<20;i++) {

if(i == node_id) {

packet_recvd[i] = packet_recvd[i] + 1; } }

}else if((pkt_type == "cbr") && (state == "d")) {

for(i=0;i<20;i++) {

if(i == node_id) {

packet_drop[i] = packet_drop[i] + 1; }

}}

# Calculating Average End to End Delay

#if ( start_time[packet_id] == 0 ) { start_time[packet_id] = time; }

if (( state == "s") && ( pkt_type == "cbr" ) && ( level == "AGT" )){

start_time[packet_id] = time; }

85
if (( state == "r") && ( pkt_type == "cbr" ) && ( level == "AGT" )) {

end_time[packet_id] = time; }

else { end_time[packet_id] = -1; }

# In this for loop also change

END {

for(i=0;i<20;i++) {

printf("%d %d \n",i, packet_sent[i]) > "[Link]";

printf("%d %d \n",i, packet_recvd[i]) > "[Link]";

printf("%d %d \n",i, packet_drop[i]) > "[Link]";

total_pkt_sent = total_pkt_sent + packet_sent[i];

total_pkt_recvd = total_pkt_recvd + packet_recvd[i];

total_pkt_drop = total_pkt_drop + packet_drop[i];

printf("Total Packets Sent : %d\n",total_pkt_sent);

printf("Total Packets Received : %d\n",total_pkt_recvd);
printf("Total Packets Dropped : %d\n",total_pkt_drop);
pkt_delivery_ratio = (total_pkt_recvd/total_pkt_sent)*100;
printf("Packet Delivery Ratio : %.2f%\n",pkt_delivery_ratio);
printf("Througphut of the network(KBps) : %.4f\n",
((total_pkt_recvd/1000)*512)/1024);
# For End to End Delay
for ( i in end_time ) {

86
start = start_time[i];
end = end_time[i];
packet_duration = end - start;
if ( packet_duration > 0 ) { sum += packet_duration; recvnum++; }
}
if(recvnum != 0) {
delay=sum/recvnum;
}
else {
delay = 0;
}
printf("Average End to End Delay :%.9f ms\n", delay);
# Below change 20 to number of nodes that u want
if(((total_pkt_recvd + total_pkt_drop)/total_pkt_sent)==1) {
}}

Appendix 5: C++ part of the model

Void
SAODV::recvReply(Packet *p) {
//struct hdr_cmn *ch = HDR_CMN(p);
struct hdr_ip *ih = HDR_IP(p);
struct hdr_aodv_reply *rp = HDR_AODV_REPLY(p);
saodv_rt_entry *rt;
char suppress_reply = 0;
double delay = 0.0;
int count;
SAODVBroadcastRREP *r = rrep_lookup(rp->rp_dst);
#ifdef DEBUG

87
fprintf(stderr, "%d - %s: received a REPLY\n", index, FUNCTION );
#endif // DEBUG
//if 0
if (ih->daddr() == index) { // optional
if (r == NULL) {
rrep_insert(rp->rp_dst);
Packet::free(p);
return;
} else
rrep_remove(rp->rp_dst);
}
//#endif
if (r == NULL) {
count = 0;
rrep_insert(rp->rp_dst);
} else {
r->count++;
count = r->count;
}
rt = rtable.rt_lookup(rp->rp_dst);
if(rt == 0) {
rt = rtable.rt_add(rp->rp_dst);
}
if ( count > 1 ||
((rp->rp_dst_seqno - rt->rt_seqno < 100) && (rp->rp_dst_seqno != rt->rt_seqno))
|| // newer route
((rt->rt_seqno == rp->rp_dst_seqno) && (rp->rp_dst_seqno < 100) && (rp-
>rp_dst_seqno - rt->rt_seqno < 100)) ||
((rp->rp_dst_seqno - rt->rt_seqno < 100) && (rt->rt_hops > rp->rp_hop_count)))
{ // shorter or better route

88
// Update the rt entry
rt_update(rt, rp->rp_dst_seqno, rp->rp_hop_count,
rp->rp_src, CURRENT_TIME + rp->rp_lifetime);
// reset the soft state
rt->rt_req_cnt = 0;
rt->rt_req_timeout = 0.0;
rt->rt_req_last_ttl = rp->rp_hop_count;
if (ih->daddr() == index) { // If I am the original source
// Update the route discovery latency statistics
// rp->rp_timestamp is the time of request origination
rt->rt_disc_latency[(unsigned char)rt->hist_indx] =
(CURRENT_TIME - rp->rp_timestamp)
/ (double) rp->rp_hop_count;
// increment indx for next time
rt->hist_indx = (rt->hist_indx + 1) % MAX_HISTORY;
}
Packet *buf_pkt;
while((buf_pkt = [Link](rt->rt_dst))) {
if(rt->rt_hops != INFINITY2) {
assert (rt->rt_flags == RTF_UP);
// Delay them a little to help ARP. Otherwise ARP
// may drop packets. -SRD 5/23/99
forward(rt, buf_pkt, delay);
delay += ARP_DELAY;
}}} else {
suppress_reply = 1; }
if(ih->daddr() == index || suppress_reply) {

89
Packet::free(p);
return; }
saodv_rt_entry *rt0 = rtable.rt_lookup(ih->daddr());

// If the rt is up, forward

if(rt0 && (rt0->rt_hops != INFINITY2)) {

assert (rt0->rt_flags == RTF_UP);

rp->rp_hop_count += 1;

rp->rp_src = index;

forward(rt0, p, NO_DELAY);

// Insert the nexthop towards the RREQ source to

// the precursor list of the RREQ destination
rt->pc_insert(rt0->rt_nexthop); // nexthop to RREQ source

} else {

// I don't know how to forward .. drop the reply.

#ifdef DEBUG

fprintf(stderr, "%s: dropping Route Reply\n", FUNCTION );

#endif // DEBUG

drop(p, DROP_RTR_NO_ROUTE); } }

90