A Graphical User Interface in WLAN Monitoring and Management System

(1)

A Graphical User Interface in WLAN Monitoring

and Management System

Jiantao Gu

College of Sciences, Hebei United University, Tangshan, China gujiantaolg@126.com

Jun Zheng

Finance Department, Hebei United University, Tangshan, China mycw1015@163.com

Shufen Zhang

College of Sciences, Hebei United University, Tangshan, China zhsf@heuu.edu.cn

Abstract—This paper aims at providing a graphical user interface for WLAN monitoring and management system “WLAN Inspector”, which gives network operators the software and performance management tools necessary to monitor and manage network availability, achieve real-time monitoring (7 × 24 hours) and intelligent management, report on IP networks performance, and troubleshoot issues through a single Web-based graphical user interface. The overall framework design of graphical interface, brief description of each module, and the detailed design in the basic information interface are discussed in this paper. The WLAN monitoring and management system has multiple functions: real-time network monitoring, real-time protocol analysis, information, statistics, safety testing and network performance monitoring, etc. This system can give Video Frame Capture for Mac, analyze the WLAN traffic characteristics, detect possible security vulnerabilities, and give the appropriate solution.

Index Terms—Graphical user interface, Wireless LAN, WLAN Inspector, real-time monitoring.

I. INTRODUCTION

As IEEE 802.11 Wireless LAN (WLAN) technology matures, the huge decline in the cost of WLAN devices, coupled with its mobility, flexibility, scalability, etc., wireless local area networks (Wireless LANs) have been more widely used as an extension , supplement or replace of traditional wired networks in the enterprise, campus, and many other places [1-3].

However, due to open space of radio waves, design flaws of IEEE 802.11 protocol, low prices of equipment, as well as easy installment, there are so many security problems of wireless LAN. The increasing popularity of wireless LANs brings a range of issues and challenges to network and information management. From the industry to the research community, it is widely recognized difficulties of wireless LAN monitoring and management, and a lot of research has begun. Recently, wireless monitoring is widely adopted in both wireless research

[4], and commercial WLAN management product development [5-6].

This paper aims at designing a graphical user interface in WLAN monitoring and management system “WLAN Inspector”. The system is designed to achieve real-time monitoring (7 × 24 hours) and intelligent management. It has multiple functions: real-time network monitoring, real-time protocol analysis, information, statistics, safety testing and network performance monitoring, etc. This system can give Video Frame Capture for Mac, analyze the WLAN traffic characteristics, detect possible security vulnerabilities, and give the appropriate solution. System features are as follows:

• Real-time monitoring (7 x 24 hours): The

WLAN Inspector system supports Large-scale enterprise wireless LAN real-time monitoring based on 802.11a/b/g and 802.1x standards. It enables the administrator to fully grasp a variety of behavior and performance of the WLAN.

• A variety of statistical functions: Monitoring the

overall state of the region to realize statistics. The failure of 802.11 control, data and management frames can be displayed. Node statistics function allows administrators to view data according to nodes, including the upstream and downstream data flow through the junction.

• Automatic intrusion detection: It allows the user

to pre-set security policy. Through real-time security monitoring solutions to give warning and prevention recommendations.

• Quickly find and fix the illegal equipment and AD-hoc devices: Illegal equipment is the first

WLAN security threats. By using the pre-set strategy need to run regular network auditing of each device, this measure will help with early detection of illegal activities and possible equipment failure.

• Performance Monitoring: Real-time monitoring

of overload APs, tracking bandwidth issues, to detect many security configuration problems, and

(2)

to achieve link-layer analysis to a variety of statistical information and found the source of the problem predictability.

• The complete notice on the relevant issue: Each

policy and warning has a detailed description, including its causes and solving methods.

II. INTERACTIVE ARCHITECTURE

As shown in Figure 1, the entire system is divided into two parts, the graphical interface and the underlying modules. The graphical interface is responsible for completing system configuration, achieving display and query functions of results and alarm information. The underlying module is responsible for receiving the configuration commands, achieving generate and output functions of monitoring results and alarm information.

To maintain two connections in the graphical interface and the underlying modules, one is used for the extraction of monitoring and alarm information (defined as the first connection), the next one for graphical interface ordering configuration information, start and stop commands to underlying module (defined as the second connection).

Using TCP approach, the graphical interface and the underlying modules are maintained by two connections. The underlying module is in SERVER mode, the graphical interface is in CLIENT mode. The first connection is a long connection, that is, during system operation, this connection has been maintained always, and the underlying module will take the initiative to push the monitoring results to graphical interface; The second connection is a short connection that requires the graphical interface to establish a new connection with the SERVER of underlying module, and the connection will cut off after using.

FIG.1. INTERACTIVE ARCHITECTURE

III. GRAPHICAL INTERFACE SYSTEM STRUCTURE Here are names for each program within the procedures (including each module and subroutine) and hierarchical relationships between them.

A. Overall framework design of graphical interface As shown in Figure 1, the graphical interface mainly consists of five major component, they are basic information modules, channel information, modules, equipment information modules, alarm information modules and report modules. The five major parts use common data to complete the corresponding interface for data display functions.

Fig.1. Overall framework design of graphical interface The five major parts link through the main interface with the system configuration, interface and underlying database. It is an organic whole which is supported by data sources and underlying interface, and used interface dynamically displays as the theme with configuration management for the assistance.

B. Brief description of each module

(a) Interface module: It is used as a container to unite basic information together with channel information, equipment information and alarm information. It is responsible for establishing paths for data transfer of each module, at the same time, for controlling and monitoring via low-level interface.

(b) Underlying-interface module: To maintain two connections in the graphical interface and the underlying modules. Using TCP approach, the graphical interface and the underlying modules are maintained by two connections. The underlying module is in SERVER mode, the graphical interface is in CLIENT mode. The first connection is a long connection, that is, during system operation, this connection has been maintained always, and the underlying module will take the initiative to push the monitoring results to graphical interface; The second connection is a short connection that requires the graphical interface to establish a new connection with the SERVER of underlying module, and the connection will cut off after using.

(c) System configuration module: It is used to complete system operation before and during the operation of the basic configuration, which includes the following configuration:

• Device block configuration;

• Legal device configuration;

• Monitoring parameters configuration;

• Communication interface configuration;

Conf igur ation inf orm ation Monitorin

g results The first connection The second connection

Graphical interface Underlying module Database Main interface System configuration Underlying-interface Basic information interface Channel information interface Device information interface Alarm information interface Reporting Module

(3)

• Alarm configuration;

• Channel configuration..

(d) Database module: It is data-switching center of saving and reading of configuration data. It responsible for storing the data flow from the interface into the database, and data flow of system configuration, basic information, channel information, equipment information and alarm information.

(e) Main interface: As a container, it unifies together with basic information, channel information, equipment information and alarm information, and is responsible for messaging in each module, data transmission and related configuration information processing. At the same time, it is responsible for controlling and monitoring the underlying WLAN interface control.

• Basic information interface: Basic information is

responsible for presenting a summary of information which is monitored in 802.11 networks. As shown in Figure 2, the displayed information includes: signaling information, network information, network proportion information, warning message, and device information.

Fig.2. The design of basic information interface

Summary of Network Information is responsible for generating network information summary showing the number of devices.

• Channel information interface: It is responsible

for displaying the channel details in a particular type of network (802.11a, 802.11b or 802.11g). This part mainly shows the following content: signal strength, change rate of byte, channel summary and integrated channel information.

Fig.3. The design of channel information interface

• Device information interface: It is responsible

for displaying the details change information on different devices, including by AP, SSID, STA and channel. The displayed information includes:

signal intensity curve, noise intensity curve, signal noise curve, frame rate curve, bytes rate curve, etc.

Fig.4. The design of device information interface

• Alarm information interface: It is responsible

for displaying the alarm information list.

Fig.5. The design of alarm information interface

• Reporting Module: It is responsible for exporting

and previewing of device and alarm, storing as a PDF document to reference for administrators, and to analysis network status and fault location.

Fig.6. The design of reporting module

C. Relationship between the various thread scheduling module

Fig.7. Relationship between the various thread scheduling module Configuration information Start on demand Network interface Persistent connection Main thread

start Summary Start on demand Child thread start

information Channel information Device information Alarm thread Exclusive AP device tree STA device tree SSID device tree Channel device tree Equipment Summary General Device Information Device

information interface

Integrated alarm display Alarm records display

Alarm details Blocking alarm device Alarm

Export and preview of device Export and preview of alarm

PDF report module Reporting

Module Summary of Signal Information

Summary of Network Information Display of Network proportion Summary of warning message Proportion of warning messages Summary of device information Basic

Signal strength Change rate of byte Channel Summary Integrated channel information Channel

(4)

Figure 7 illustrates the system relationship between the various thread scheduling module. The main thread is responsible for the initialization of the graphical interface and for the scheduling of other threads work.

When you need to configure the system parameters, configuration information thread will start, and independent with other threads.

When the monitoring program starts, network interface thread will start, and independent with other threads.

If and only if the monitoring program is in start state, there only one thread is active in summary information thread, channel information thread, equipment information thread, and alarm thread, to ensure efficient use of system resources.

IV. THE DETAILED DESIGN OF SIGNAL INFORMATION SUMMARY IN THE BASIC INFORMATION INTERFACE A. Summary of Signal Information is affiliated to basic

information interface. B. Description

It is responsible for giving distinction according to the network types, and real-time refreshing the display of each channel's signal strength, noise level and SNR (Signal to Noise Ratio) situation.

C. Display

• 802.11a: Signal strength for each channel;

Intensity noise for each channel; SNR for each channel.

• 802.11b: Signal strength for each channel (1-14);

Intensity noise for each channel (1-14); SNR for each channel (1-14).

• 802.11g: Signal strength for each channel (1-14);

Intensity noise for each channel (1-14); SNR for each channel (1-14).

User can choose to display as percentage or dBm format, and can switch between different displays.

When displaying a percent value, data input is x = 100 + x, dynamic map display range from -100, -10 changed to 0,100.

When displaying the raw data, data input is the data of the underlying interface, which remains unchanged. D. IPO (Input-Process-Output) Model of functional

description

Fig.8. IPO model of functional description

E. Algorithm and process logic Algorithm:

(1) Start BarPanel class;

(2) Start the trigger monitors and message digest, set the type of data needs to be read;

(3) Initialize the database connection, read the date of signal, noise and SNR.

(4) If displaying a percent value, in accordance with the way of data processing as in Section IV, or turn (5);

(5) Graphical display.

Logical flow of the algorithm is shown below.

Fig.9. Process logic F. Interface

StartLeftPanel parentPanel = null; MainWlanFrame grandfatherPanel = null; StartBardataGenerator gen;

StartBarChart signalbar, noisebar,snbar; DefaultCategoryDataset asignaldataset = new DefaultCategoryDataset();

DefaultCategoryDataset anoisedataset = new DefaultCategoryDataset();

DefaultCategoryDataset asndataset = new DefaultCategoryDataset();

DefaultCategoryDataset bsignaldataset = new DefaultCategoryDataset();

DefaultCategoryDataset bnoisedataset = new DefaultCategoryDataset();

DefaultCategoryDataset bsndataset = new DefaultCategoryDataset();

DefaultCategoryDataset gsignaldataset = new DefaultCategoryDataset();

I: Different network types of signal strength, noise level and signal to noise ratio which are real-time obtained from the database; Select results of percentage or dBm format: network type selection

P: Columnar show signal strength, noise level and signal to noise ratio, and refresh every second

O: Displaying column map

Yes

No, exit Start monitoring

Read data from the database

Whether displaying a percent value

Yes Process the data

as percentage

Call graphics interface to

display Clear or update

the original data

Start message

digest Set display types

(5)

DefaultCategoryDataset gnoisedataset = new DefaultCategoryDataset();

DefaultCategoryDataset gsndataset = new DefaultCategoryDataset();

G. Test plan

(1) The program needs to continuous, long- run in the actual network, by the logic analysis of data to test the stability, logical correctness, ease of use of the program;

(2) Using a dedicated test equipment to do stress test of the program.

V. THE DETAILED DESIGN OF NETWORK INFORMATION INFORMATION SUMMARY IN THE BASIC INFORMATION

INTERFACE

A. Summary of Signal Information is affiliated to basic information interface.

B. Description

It is mainly used to display network information summary in 802.11 networks, including the number of network (SSID number and the number of Ad-hoc), the number of devices (AP number, STA number, the number of encrypted AP and STA), the number of data frame (the number of broadcast frames, multicast frames and unicast frames).

C. Display

802.11 Wireless network information:

• SSID number: SSID number in the monitoring

region;

• Ad-hoc number: Ad-hoc number in the

monitoring region;

• Devices number: Devices number found in the

monitoring region. (1) The number of AP (encrypted AP and unencrypted) found in the monitoring region; (2) The number of STA (encrypted AP and unencrypted) found in the monitoring region.

• The number of data frames: The number of data

frame found in the monitoring region. (1) The number of broadcast frame found in the monitoring region; (2) The number of multicast frame found in the monitoring region; (3) The number of unicast frame found in the monitoring region.

D. IPO (Input-Process-Output) Model of functional description

Fig.10. IPO model of functional description

E. Algorithm and process logic Algorithm:

(1) Start SummaryInfo class;

(2) Start the trigger monitors and message digest, set the type of data needs to be read;

(3) Initialize the database connection, read the date of SSID number, Ad-hoc number, AP number, encrypted AP number, unencrypted AP number, STA number, encrypted STA number, unencrypted STA number, and date frame number;

StartLeftPanel parentPanel = null; MainWlanFrame grandfatherPanel = null; SummaryInfoTree summaryInfoTree = null; G. Test plan

VI. THE DETAILED DESIGN OF NETWORK PROPORTION INFORMATION SUMMARY IN THE BASIC INFORMATION

INTERFACE

A. Summary of Signal Information is affiliated to basic information interface.

B. Description

It is mainly used to display network proportion information of corresponding devices.

C. Display

• The percentage of SSID Count according to SSID device number;

• The percentage according to the number of different types of devices;

• The percentage of AP number according to different types of networks;

I: The number of SSID, Ad-hoc, devices and date frames in an 802.11 network which are real-time obtained from the database

P: TreeList show the number of SSID, Ad-hoc, devices and date frames, and refresh every second

O: Displaying TreeList.

Yes

the original data

Start message

(6)

• The percentage of STA number according to different types of networks;

• The percentage of AP number according to different types of encryption;

• The percentage of STA number according to different types of encryption;

• The percentage of date frame number according to different types of different types of data transmission.

D. IPO (Input-Process-Output) Model of functional description

Fig.12. IPO model of functional description E. Algorithm and process logic

Algorithm:

(1) Start LeftPanel class;

(2) Start the trigger monitor and nodes in a tree list, and choose to listen;

(3) Initialize the database connection after selected node event triggered; read the different date according to different nodes;

StartLeftPanel parentPanel = null;

MainWlanFrame grandfatherPanel = null; StartPieChart startPie = null;

ChartDataGenerator gen = new ChartDataGenerator(); gen.getSSIDDataset(); gen.getADHocDataset(); gen.getDeviceDataset(); gen.getAPDataset(); gen.getSTADataset(); gen.getEncryAPDataset(); gen.getEncrySTADataset(); gen.getFrameDataset(); G. Test plan

VII. TECHNICAL FEATURES AND INTENDED USE According to the 802.11 frame format, parse all types of data frames captured in the WLAN, extract the network ID and network traffic information, provide friendly and simple graphical interface. Making use of specific characteristics and identity of Security vulnerabilities and specific traffic model, detect the Possible WLAN security threats and hacking, give warning message. Based on 802.11 Protocol, construct special management frames, block the illegal equipment so as to disconnect to original AP. Intended use of the WLAN monitoring and management system “WLAN Inspector” are as follows: WLAN planning and optimization (performance evaluation); Traffic analysis and content analysis; Attack monitoring and rogue access point discovery; Flow block (or attack AP node, to degrade the network performance ); Performance monitoring and fault location. In Traffic analysis, traffic metrics at application level are critical for protocol research, abnormity detection, accounting and network operation. There are great challenges to identify packets at application level since dynamic protocol ports and packet encryption are deployed popularly. There are several different methods of traffic identification being proposed in recently research for corresponding applications. It is impossible to identify traffic with any one method alone.

There are several advantages in MPI: (1) these existing traffic identification methods can be easily integrated into MPI to improve the identification accuracy; (2) the corresponding new identification method for the new application can be inserted into MPI feasibly with scripts of the identification rule; (3) efficiency of identification can be improved with the mechanism of adaptive justification for the sequence of methods and implemented on multi-CPUs platform.

MPI has been implemented a general purpose CPU platform with OC-48 POS and 10GE network interface. Experiment on an OC-48 POS backbone link shows MPI is accurate and effective for traffic identification.

We propose a scalable and efficient methodology for accurate traffic identification in the following. These existed identification methodologies can be integrated into MPI seamless to improve the accuracy of traffic classification. The identification rules are expressed in scripts. The analysis phases can be justified to optimize I: The number of SSID, Ad-hoc, devices and date frames in

an 802.11 network which are real-time obtained from the database

P: Pie charts show the proportion of SSID number, Ad-hoc number, devices number and date frames number

O: Displaying Pie charts

Yes

the original data

(7)

the performance of traffic measurement. The identification rules are expressed into a text file with XML liked script language in order to update the rules flexibly for new applications and protocols. Once the traffic measurement process starts up, the text file of rules is loaded into memory in the initial phase. Every packet and flow is identified according to the rules in the memory.

The accuracy and efficiency are two important metrics for evaluating the traffic identification methodologies. It is very difficult to evaluate the accuracy of the identification methodologies due to lack of the well approbatory benchmark traces. In a certain extent, the accuracy and the efficiency are contradictory each other. In order to identify traffic on high speed link on line, some identification methodologies with high accuracy but more time complexity cannot be applied. In this section, an optimization methodology for improving the efficiency is presented.

Some parameters are denoted as Table IV. The time during the period [t0,t1] spent in identifying flows of

application type k with the method i is presented as formula (1). 1 0( * ) t i i i t T =

∫

t v dt (1) So the total time is summation of time with all methods as formula (2). 1 0 1 1 ( * ) n n t i i i t i i T T t v dt = = =

∑

=

∑∫

(2) Notice that it is likely that a flow is identified as a kind of application type after processing by several methodologies. In the ideal situation, the most appropriate methodology can always be selected for every flow for the efficiency and accuracy. The time expense for traffic identification in this best situation is showed as formula (3). 1 0 0 1 ' ( * ) n _t i i t i T t v dt = =

∑∫

(3) Obviously, T0 ≤ T. The optimization process is

proposed to decrease the time expense of traffic identification.

Supposed the identification procedures for a flow is subset of the methods sequence <M1, M2, …, Mn>. If for

the flow belonging to application type k, the identification method of the application type k denoting as Mk', and

Mk' = Mq. (4)

The time for identifying the flow is as formula (5).

1 [ ] q i i t k t = =

∑

(5) Replace formula (5) into formula (2). It is easy to know the total time expense is presented as formula (6).

1 0 1 1 [ ] ( [ ]* ) m m _t k t k k T T k t k f dt = = =

∑

=

∑∫

(6) To simplify the calculation process, suppose the t[k] is independent with the traffic rate under measurement. That is to say t[k] is independent with the time of day. So, formula (6) can be transformed as formula (7).

(

)

(

)

1 0 1 1 1 [ ] [ ]* [ ]* m k m _t k t k m k k T T k t k f dt t k a = = = = = =

∑

∫

∑

(7) In formula (7), 1 0 t k _t k

a =

∫

f dt is the total number of flows of application type k. So, it is easy to know that the total number of flows in the period is 1

0 1 m _t k t k f dt =

∑∫

. The

goal of optimization is to find a scheme, which is a methods sequence in the specific order, with the minimal value of T, viz. ∃ <M1',M2',...,Mn' >, ∀<M1, M2, …,

Mn>, T'≤T . To remove the effect of absolute size of

flow rate, T in formula (7) is divided with the number of flows as formula (8). If only if

T

₀'

≤

T

₀ ,

T

'

≤

T

.

(

1

)

₍

₎

0 1 0 1 1 0 1 1 [ ] [ ]* [ ]* m m _t k m t k k k m _t k k t k T k t k f dt T t k r F f dt = = = = =

∑

=

∑

∫

=

∑

∑∫

(8 ) where rk is the proportion of the flows of application type

k in all applications.

In a backbone network, the rk is comparatively stable

lasting a long time. We can measure the rk and ti for every

application type for a link under measurement and find a method sequence with the minimal value of time expense as the best scheme. There are m! method sequences in total and for every method sequence it is easy to calculate its T₀ , then we can select the method sequence with the minimal value.

VIII. RELATED WORK

There are lots of works on the WLAN Monitoring and Management System recent years since there are more and more applications using dynamic protocol ports bringing great challenge to it [7-9].

Motorola AirDefense Mobile[10] can be installed on laptops running Windows XP or 2000 with an Atherosbased 802.11 a/b/g network card, such as Netgear (WAG511) or Cisco (CB21AG). The tool allows monitoring of traffic on the WLAN and terminal connections as well as diagnostics for troubleshooting. Focusing heavily on information security, the product has more than 175 various types of alarms, including alarms for rogue access points and misconfigured devices.

Unlike AirDefense, Motorola SiteScanner [11], is based specifically on the monitoring of network performance and coverage. SiteScanner can be used to measure factors such as data rates, signal strength and noise level at selected sites. Traffic generated by terminals can also be used to measure delay, jitter and

(8)

retransmissions, if a receiving server has been specified and connected to the network. The product requires the Windows XP operating system.

AirMagnet WiFi Analyzer [12], is another laptop-based software allowing thorough examination of the air interface. The software includes features for the monitoring of both the radio interface and the fixed infrastructure, such as data rate and the rate of performance of DHCP and ping commands. Monitoring of signal strength and noise level is also possible, along with the control of network information security by identifying misconfigured devices and devices sending unencrypted data. Locating is also possible. WiFi Analyzer runs on both Windows and Mac operating systems but is only compatible with certain network cards. The product is said to be extremely easy to use, offering an intuitive user interface and tools for the rapid troubleshooting of common network problems without the need to check individual packets [13].

Another popular WLAN analyser is the WildPackets OmniPeek [14], which enables the thorough analysis of packets sent over the air interface. The product is designed for the on-site troubleshooting of problems on the radio interface. Therefore, it naturally displays the access points and terminals as well as statistical data on traffic, including utilisation rate and number of retransmissions. According to [13] it is the best tool for troubleshooting problems on the air interface with its versatile functions and particularly extensive filtering properties.

Wireshark [15], is an open source software for Windows and Linux computers for the analysis of network protocols. Wireshark allows the straightforward analysis of traffic on the computer in question, but is not so well suited to the comprehensive analysis of WLANs. Analysis of control and beacon frames requires use of the monitoring mode, which is not supported by all operating systems, adapters and drivers. Furthermore, physical variables are not available, including the channel used, signal strength and used data rate, which is critical in performance analysis. It is claimed that the capture of retransmissions requires multi-stage configuration [3]. Wireshark’s user-friendliness can be considerably improved by combining it with AirPcap USB adapter[16], which is a commercial solution. This will also enable the analysis of physical-level data, such as the signal strength of individual frames and used data rate.

MetaGeek offers the Wi-Spy product suite, with DBx as its most advanced component [17]. DBx is a spectrum analyser operating in the 2.4 and 5 GHz frequency ranges, allowing the selection of the optimal channel for autonomous access points and the identification of the noise level caused by nearby access points. The benefits of the product in controller-based environments are perhaps unclear.

Differing from the other monitoring software, WLAN Inspector, offers quality of service monitoring from the end-user perspective. Network performance is monitored automatically round the clock. The product is the first end-to-end quality monitoring software combining the

monitoring of wireless and fixed network infrastructure. It is true at least in the respect that other monitoring software often lacks a monitoring perspective, focusing only on selected parts, such as individual network elements in the case of SNMP software and the current interface in the case of wireless site survey tools. WLAN Inspector main interface is the primary interface you use, this interface provides you with all the control options. Through a simple, easy and friendly interface, you can easily use the WLAN Inspector software.

ACKNOWLEDGMENT

This work was supported by Projects of Hebei Province Education Department (Z2010261) and Research Project of Hebei United University (z200716).

REFERENCES

[1] Jihwang Yeo, Moustafa Youssef, Ashok Agrawala. A framework for wireless LAN monitoring and its applications. In Proceedings of the Third ACM Workshop on Wireless Security (WiSe\'04), October 2004. http://www.cs.umd.edu/~moustafa/papers/wise04.pdf [2] Kitasuka, T. Nakanishi, T. Fukuda. A Wireless lan based

indoor positioning system wips and its simulation. Communications, Computers and signal Processing, Aug. 2003, vol.1pp. 272-275.

[3] Ahmavaara, K. Haverinen, H. Pichna, R. Interworking architecture between 3GPP and WLAN systems. Communications Magazine, IEEE, Nov. 2003, Volume 41, Issue 11, pp.74-81.

[4] M. Shin, A. Mishra, and W. Arbaugh. Improving the Latency of 802.11 Hand-offs using Neighbor Graphs. In Proc. INFOCOM 2004, Hong Kong, China, March 2004. [5] Enterprise Wireless LAN Security and WLAN Monitoring.

http://www.airdefense.net/

[6] Wireless Security Auditor (WSA). http://www.research.ibm.com/gsal/wsa/

[7] Moore, A., Papagiannaki, K.: Toward the Accurate Identification of Network Applications. In: Proceedings of PAM (2005)

[8] Karagiannis, T., Broido, A., Brownlee, N., Claffy, Kc., Faloutsos, M.: Is P2P Dying or Just Hiding. In: Proceeding of IEEE Globecom, Dallas (2004)

[9] G Zhang, G Xie, J Yang, Y Min, et al. Accurate Online Traffic Classification with Multi-phases Identification Methodology. Consumer Communications and Networking Conference, Jan 2008, pp. 141-146. [10]http://www.airdefense.net/products/admobile/ [11]http://www.motorola.com/Business/USEN/Business+Prod uct+and+Services/Software+and+Applications/Network+D esign+Software/SiteScanner+Software_US-EN [12]http://www.airmagnet.com/products/vofi_analyzer

[13]B. Miller. Choosing the Right Analyzer for Your WLAN. Expert Reference Series of White Papers, Global Knowledge, July 2009. [14]http://www.wildpackets.com/products/distributed_network _analysis/omnipeek_network_analyzer [15]http://www.wireshark.org [16]http://www.cacetech.com/products/airpcap.html [17]http://www.metageek.net/products/wi-spy-dbx