Mobile Ad hoc NETworks (MANETs) are networks in which the participating nodes can move freely without having to worry about maintaining a direct connection to any particular fixed access point. In a MANET, nodes collaborate with each other to form the network and as long as a node is in contact with any other member of the network, it—at least in theory—is part of the network and can communicate with all other nodes.

An important function of network management is to observe current network conditions: at the node level, this may mean keeping track of arriving and departing traffic load; at the network level, the system must monitor active routes and changes in network topology.

In this research, we present the design and implementation of a distributed network monitoring system for MANETs. Our system is completely distributed, generates no additional traffic on the network and produces a dynamic picture of the network level and node level information on a graphical user interface.

In our proposed scheme, multiple monitoring nodes collaborate to achieve a reasonably accurate snapshot of the network conditions. These monitoring nodes passively sniff network traffics and gather information from the network to construct partial network views. They then transmit their findings to a management unit where these local views are put together to produce a comprehensive picture of the network. The communication between all management nodes (a monitoring unit and a management node) takes place in an out-of-band communication link. Therefore, our monitoring solution does not depend on the MANET to perform, hence is robust to network partitioning, link breaks, node's death and node misbehavior in the monitored MANET.

Our solution provides a snapshot of the network topology that includes information about node-level behavior ratings and traffic activity.

The information provided by our monitoring system can be used for network management as well as for security assessment, including anomaly detection. Information regarding individual nodes' behavior can be used for detecting selfishness in the network. Also, an approximation of arriving and departing traffic levels at each node is important in the context of quality of service, load balancing and congestion control. Furthermore, the network topology picture can provide valuable information to network management in detecting preferred routes, discovering network partitioning and in fault detection.

We developed a proof-of-concept implementation of our system, which works with the Optimized Link State Routing (OLSR) protocol. Through experimental studies with up to 10-node MANETs, we were able to determine the feasibility and workability of our system. The scheme proved to be robust with respect to mobility, rapid changes in the network topology and node connectivity. Throughout our experiments we observed that our system replicated changes in the network on the GUI with less than two seconds delay. Also, when deployed in a high-traffic environment, with multiple TCP and UDP flows throughout the network, the system was able to report traffic load on each node accurately and consistently.

On average, CPU consumption on monitoring nodes was about 3.5% and the GUI never took up more than 4% of the processing power (general-purpose laptop computers were used throughout the experiments). Also, the overall storage capacity needed for archiving the information files was estimated as 1 Mbytes for monitoring a 10-node MANETs for 30 minutes.

Unobtrusive and distributed nature of our proposed approach helps the system to adapt to the constantly changing nature of MANETs and be able to provide valuable network management, security assessment and traffic analysis services, while requiring only modest processing and storage resources. The system is capable of quickly responding to changes in the network and is non-intrusive, generating no additional traffic on the MANET it monitors.