CRAWDAD tools/process/pcap/pcapsync

Tool to synchronize the timestamps of packets of 802.11-based experiments to a common time basis.Pcapsync is a tool to time-synchronize tracefiles recorded in libpcap format. Its main application area are logfiles of real-world experiments with wireless multihop networks like MANETs (mobile ad-hoc networks), VANETs (vehicular ad-hoc networks) or mesh networks. The underlying algorithm, however, is more general and can be applied to any network with local broadcast characteristic.Lastmodified :2009-02-12Dataname :tools/process/pcap/pcapsyncFile :pcapsync_v0.1.tar.gzReleasedate :2008-08-23Equiversion :v0.1Change :the initial version.References :scheuerman-synchronization
READMEWebsite :http://www.crawdad.org/tools/process/pcap/pcapsyncKeyword :802.11
MANET
packet trace
tcpdump
vehicular network
wireless mesh network
wireless multihop networksSupport :Before using the tool, we strongly recommend to read

"On the Time Synchronization of Distributed Log Files in Networks
with Local Broadcast Media", available at
http://www.cn.uni-duesseldorf.de/publications/details/Scheuermann2008c.html
This paper explains the details of the algorithm used for the
synchronization, furthermore it contains some estimates of the
achievable accuracy. To quote pcapsync, use this paper.

For information, bug reports, feature requests, ... please refer to
[e-mail] :To compile pcapsync, the following packages must be installed:
- openssl for the lcrypto library
- libpcap for the lpcap library
- flex
- bison

Then type 'make'.Parameters :- Input files naming convention

The input files for pcapsync have to be named beginning with the MAC
adress of the recording interface, followed by a dot. An example for
this is "00099D9F1B3C.cap".Usage :Usage: pcapsync [flags] [options] <list_of_input_files>

flags:
-h Print this help text and terminate.
-s Output one .synced file for each input file.
-g Output a global .synced file to the output directory.
-t Output files for use with tsc.
-l Logs swaped packets during the synchronization.

options:
-o <outputDirectory> Defines an output directory.
If no output directory is defined every output file is written to its input file directory.Algorithm :A fundamental problem in real-world computer network experiments is that
each system uses its own local clock to timestamp events. These clocks
are not perfectly accurate, and thus deviate from each other. Event
timestamps assigned by different nodes can therefore not immediately
be compared, making the analysis of experimental results difficult.
In order to solve this issue we have proposed in a previous publication
to record the occurring events with the deviating, local clocks and
synchronize the resulting event log files offline after the experiment.
The synchronization is based on so-called anchor points, that is,
on events that have been recorded and timestamped by more than one node
in parallel. The anchor points allow to set the clocks of the nodes
into relation. In networks where the medium has a broadcast characteristic
(like many wireless networks, but also Ethernet using hubs), the (almost)
parallel reception of a packet transmission by multiple nodes can serve
as such an anchor point.

This algorithm is implemented in pcapsync, a tool to synchronize event logs
from experiments in IEEE 802.11 wireless networks. It reads a set of log files
that have been recorded in libpcap format (used, e. g., by tcpdump and Wireshark),
identifies potential anchor points in them, applies our offline time
synchronization algorithm, maps the recorded local timestamps to a common,
global time scale, and finally writes back a corresponding set of synchronized
libpcap files. Its output can thus immediately be used for further analysis
with standard tools.