[Tool] tools/process/pcap/pcapsync (v. 2008-08-23)

top

the initial version.

@MISC{tools-process-pcap-pcapsync-2008-08-23,
  author = {Wolfgang Kiess and Björn Scheuermann and Daniel Marks},
  title = {{CRAWDAD} tool tools/process/pcap/pcapsync (v. 2008-08-23)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/tools/process/pcap/pcapsync},
  month = aug,  
  year = 2008
}
					

Pcapsync is a tool to time-synchronize tracefiles recorded in libpcap format. 
Its main application area are logfiles of real-world experiments with wireless 
multihop networks like MANETs (mobile ad-hoc networks), VANETs (vehicular ad-hoc networks) 
or mesh networks. The underlying algorithm, however, is more general and 
can be applied to any network with local broadcast characteristic.

Before using the tool, we strongly recommend to read

"On the Time Synchronization of Distributed Log Files in Networks
with Local Broadcast Media", available at
http://www.cn.uni-duesseldorf.de/publications/details/Scheuermann2008c.html
This paper explains the details of the algorithm used for the
synchronization, furthermore it contains some estimates of the
achievable accuracy. To quote pcapsync, use this paper.

For information, bug reports, feature requests, ... please refer to
pcapsync@cs.uni-duesseldorf.de

To compile pcapsync, the following packages must be installed:
        - openssl for the lcrypto library
        - libpcap for the lpcap library
        - flex
        - bison

Then type 'make'.

- Input files naming convention

The input files for pcapsync have to be named beginning with the MAC
adress of the recording interface, followed by a dot. An example for
this is "00099D9F1B3C.cap".

Usage: pcapsync [flags] [options] <list_of_input_files>

flags:
-h      Print this help text and terminate.
-s      Output one .synced file for each input file.
-g      Output a global .synced file to the output directory.
-t      Output files for use with tsc.
-l      Logs swaped packets during the synchronization.

options:
-o <outputDirectory>    Defines an output directory.
If no output directory is defined every output file is written to its input file directory.

A fundamental problem in real-world computer network experiments is that 
each system uses its own local clock to timestamp events. These clocks 
are not perfectly accurate, and thus deviate from each other. Event 
timestamps assigned by different nodes can therefore not immediately 
be compared, making the analysis of experimental results difficult.
In order to solve this issue we have proposed in a previous publication 
to record the occurring events with the deviating, local clocks and 
synchronize the resulting event log files offline after the experiment. 
The synchronization is based on so-called anchor points, that is, 
on events that have been recorded and timestamped by more than one node 
in parallel. The anchor points allow to set the clocks of the nodes 
into relation. In networks where the medium has a broadcast characteristic 
(like many wireless networks, but also Ethernet using hubs), the (almost) 
parallel reception of a packet transmission by multiple nodes can serve 
as such an anchor point.

This algorithm is implemented in pcapsync, a tool to synchronize event logs 
from experiments in IEEE 802.11 wireless networks. It reads a set of log files 
that have been recorded in libpcap format (used, e. g., by tcpdump and Wireshark), 
identifies potential anchor points in them, applies our offline time 
synchronization algorithm, maps the recorded local timestamps to a common, 
global time scale, and finally writes back a corresponding set of synchronized 
libpcap files. Its output can thus immediately be used for further analysis 
with standard tools.

[Author] Wolfgang Kiess

top

[Author] Björn Scheuermann

top

[Author] Daniel Marks

top