On the trade-offs between collecting packet level forensic evidence and data delivery performance in wireless networks

Transmission Evidence (TE for short) refers to a historic trail of the packet transmissions in the network. TE is collected and maintained in a distributed manner by the nodes in the network and can be queried on demand by a network forensics system to trace past events. The latter can facilitate crucial applications such as identifying malicious or malfunctioning nodes. Recently, we developed an analytical framework towards computing the likelihood of TE availability in wireless networks. Our prior efforts [1] brought to light the impact of the network's operational parameters (such as transmission rate and packet length) on the availability of TE. However, provisioning for TE could impact the network performance in terms of throughput and/or delay. Our objective in this work is to capture and quantify the trade-offs between provisioning transmission evidence and achieving high performance in wireless networks. In particular, we investigate the network performance hit, under the constraint of TE availability guarantees. Our results indicate that the performance remains unaffected up to a certain TE requirement. Beyond this, the throughput could degrade and the delay could increase by as much as 30%. To the best of our knowledge, this is the first study of its kind. © 2013 IEEE