March 10th, 2001
Snuffle is a measurement tool for capturing the protocol messages, internal protocol states and to measure implementation performance on networking nodes. Snuffle consists of a set of modules placed in the kernel, device driver and user space. Currently measuring probes for UDP, IP and IEEE 802.11b MAC are implemented. Thus, Snuffle is especially suited for multimedia over wireless networks. However, to support a wider range of purposes adding own tracepoints is easy.
The popular network monitoring tools (e.g. tcpdump, snoop, etherfind, Remote Network Monitoring (RMON) etc.) follow the principle of observing packets traversing the network. Thus, there is only a limited possibility to infer about the internal Internet protocol variables. The accuracy of this inference depends on the completeness of the trace, i.e. each lost sample falsifies the conclusions about the protocol variables and makes performance evaluations inaccurate. Therefore it is necessary to measure directly within the end-systems for precise investigation of Internet protocols and their internal state variables.
Especially in an error prone wireless environment it cannot be guaranteed, that an observer placed outside of the communicating end-systems records the same packets as transmitted or received by the observed nodes. It is known that in wireless networks operating around 1GHz or higher, small displacements of mobile systems may result in dramatic degradations of the physical link quality. In the worst case, the observed end-systems can still communicate, while the observing host has lost contact to them.
In this paper we present Snuffle, a tool
suitable for measurements in Internet and a case study in a wireless LAN
environment. Snuffle has been used successfully over four years,
now, the latest Snuffle version is available for Linux V2.4.17 at http://www.tkn.tu-berlin.de/research/easysnuffle/.