Jigsaw: Solving the Puzzle of Enterprise 802.

11 Analysis

Main Idea:
The main idea behind the paper is to study large 802.11 networks. To study such a large network the
authors have developed a system called Jigsaw that used multiple monitors to provide a unified view
of all physical, link, network and transport-layer activity on an 802.11 network. The authors have
deployed 150 passive radio monitors that observe the activity of 802.11b and 802.11g protocols in
the network. The reason for using such a large number of monitor radios is because a single radio
won’t be able to capture the entire network's traffic because of spatial diversity. The data from
these monitors feed the Jigsaw system that uses this data to give us a bird's eye view of physical,
link-layer, network-layer and transport-layer activities of an 802.11 wireless network.

Problem:
802.11 networks can be found everywhere. It is because this technology operates in an unlicensed
spectrum and also because of the availability of cheap equipment (i.e. access points) in the market.
There is a lot of research that is being done on 802.11 technologies but the study on the behavior of
large 802.11 networks is still quite limited. One of the reasons is because modelling of large wireless
networks can be difficult as there are a lot of factors that affect the received signal such as ambient
environment, senders transmit power, etc.

Methodology:
The authors have deployed their system in UCSD computer science and engineering building. Avaya
AP-8 access points are used to provide 802.11b and 802.11g services. The authors have also
deployed 39 wireless sensor pods comprising of 4 independent radios to monitor the wireless
network centered on 4 different frequencies that are used by 802.11b/g networks.

To create a global view of the network it becomes vital to place the frames in proper order. But the
local clocks of the monitors could vary significantly resulting in a different timestamp for each frame
in each trace by the monitor. Hence global synchronization becomes necessary i.e. to synchronize all
frames to a common reference time. The authors have achieved this through bootstrap
synchronization algorithm.

In the established wireless network multiple monitor radios may receive a particular frame that in
turn will appear in multiple traces. Thus one needs to recognize these duplicate traces. Also,
sometime the received frames may get corrupted and may not be the exact copy. Nonetheless,
these corrupted frames should be tied to the same transmission. The Authors have termed this as
Unification. After synchronization is achieved, Jigsaw with the help of a search window processes all
traces and unifies duplicates frames into a single jframe.

After achieving unification and synchronization the authors have reconstructed the link-layer and
transport-layer conversations. Since Jigsaw can achieve a bird's eye view of the network,
reconstruction of link and transport conversions in practice appears simple. This is because we have
a global timestamp for every frame. But in reality, vantage point ambiguity, as well as lost data, may
hamper the reconstruction process. To overcome this Jigsaw uses inference algorithms to
reconstruct link and transport layer conversations.

Next, the coverage of the monitoring infrastructure was observed. The authors used a wireless
laptop that was generating various network workloads (web browsing, ssh sessions and copying
large files between hosts.) at different locations. The laptop tracked all the link-layer activities that
were generated by self as well as connected access points. It was observed that the monitoring
system was able to track 95% of the laptop's link-layer events. The authors have also compared
frame exchange in the wireless and wired network and it was observed that 97% of the frames in the
wired network were also observed in the wireless trace. Additionally, the authors have presented
the percentage of frame covered for both clients and APs as a function to the number of sensor pods
deployed. It was observed that the coverage for APs did not drop significantly as the numbers of
pods were reduced. But on the other hand, there was a significant drop in the coverage of client
frames as the number of pods reduced.

Evaluation:
The authors have demonstrated how having a synchronized viewpoint can have special benefits. By
using the synchronized perspective the authors have graphically presented network activity of
clients and APs with respect to time. Additionally, the authors have also traced the network traffic
for various categories such as Data, Management, ARP and Beacon. Due to the broadcast nature of
ARP, there is a very high probability of self-interference. The author argues that all network-layer
broadcast suffers from this phenomenon of self-interference. To mitigate this, authors have
suggested that applications should employ multicast in place of broadcast. Additionally, if Aps could
perform selective filtering of non-unicast traffic as well as have the capability of adding random
jitters to transmission time for broadcast frames coming from the wired network, the problem of
interference and implicit synchronization resulting from wired broadcast can be mitigated.

By creating a bird’s eye view of the network it is possible to discern transmission from sender to
receiver. Thus one can figure out if the sent data was lost during transmission. Also, having a
synchronized view of the entire network we can detect if another node was transmitting data as the
sender. By using the concepts of conditional probability the authors have presented the probability
of transmission loss between a sender and a receiver due to interference. For the given 536 sender-
receiver pairs it was observed that about 50% of these sender-receiver pairs experienced minor
interference. Some sender-receiver pairs experienced substantial transmission loss due to
interference as well.

The use of protection mode by 802.11g tends to increase delay and also it tends to lower the
throughput for 802.11g clients. The author argues that by taking the global synchronized perspective
of the network we can devise a more practical protection policy by estimating whether any client is
in range of the AP or not. Thus, by using a more practical protection policy the throughput, as well as
the performance of the network, could be improved. Additionally, the authors argue that by creating
a global viewpoint it easy to examine communication between layers as evident from their results of
TCP loss rate.
Advantage:
The authors have created a system that will help us analyze production level 802.11 networks. Such
a system will allow us to do a detailed analysis of large wireless networks. Jigsaw can be stepping
stone and can be exploited to answer the deeper questions related to large wireless networks that
remain unanswered as of yet.

Disadvantage:
Since Jigsaw is just a stepping stone a lot of research needs to be done to do an exhaustive analysis
of large wireless networks.

My Opinion:
The authors have presented a novel system to monitor a large wireless network. Also, the need for
synchronization to create a unified perspective of the network is well explained. By using a unified
view of the system the authors were able to reconstruct link and transport-level conversations as
well as derive the effects of interference. They have also devised algorithms and inference
techniques to achieve this.