Logging Operation History of DLNA Devices
using ARP Spoofing
Timothy Lawrence Sitorus1 , Shunsuke Saruwatari1 , Hua Si1 , Masateru
Minami1 , Hiroyuki Morikawa1 , Johan Hjelm2 , Kenta Yasukawa2 , andToshikane Oda2
1

Research Center for Advanced Science and Technology, The University of Tokyo,
Tokyo 153-8904, Japan,{tsitora, saru, sihua, minami, mori}@mlab.t.u-tokyo.ac.jp
2Ericsson Research Japan, Koraku Mori Bldg. 1-4-14 Koraku, Bunkyo-ku, Tokyo
112-004 Japan,{firstname.lastname}@ericsson.com

Abstract. The realization of context-aware and recommendation service can be provided by acquiring and collecting the operation history ofhome appliances. In this paper, in order to collect operation informationfrom DLNA certiﬁed devices, we propose a method using ARP spooﬁng
called DLNA spooﬁng. We show that this method is eﬀective to collectall detailed information in a home network. Also, DLNA spooﬁng has thebetter way for our research than the method using DLNA event notiﬁcation function called GENA (Generic Event Notiﬁcation Architecture).
In GENA, we can collect only some simple information, neverthelesswe cannot collect detailed information. On the other hand, by using ourtechnique, we can collect all the information without changing the DLNA
standard.

1

Introduction

Many studies have investigated services made from recommender systems. The
realization of such systems can be provided by acquiring and collecting the users’
pattern history. In Amazon.com [1], the recommendation service is provided
based on user’s purchase history. In TSUTAYA [2], the similar items that others
have selected at the same time are collected and recommended to users. The key
for these technologies are user modeling. Started in the latter half of the 1980’s
from the research of information ﬁltering system [4], the history of user modelingas the ﬁeld of research in virtual space is quite long.
On the other hand, ubiquitous computing with the concept that computing
infrastructure as a tool should be available everywhere, every time, and to everybody, plays the key role to bring computer to real space. Pioneered by theconcept from Mark Weiser [5], the research of ubiquitous computing has been
widely investigated. Because of the research on sensor network and context-aware
computing, ubiquitous world is being realized gradually.

2The present study focuses on user modeling in ubiquitous computing. We canapply applications such as context-aware service and recommender service in real
space. For instance, in context-aware service, we apply an automatic download
service according to the users’ time activity such as downloading content in themorning for the users who are not at home at night. In the advertisement ﬁeld,
we can show the advertisement to particular users based on their behavior suchas advertisement of soft drink for users who are addicted to TV.
In this paper, in order to realize user modeling in ubiquitous computing,
we acquire and collect the operation history of home appliance using DLNA [7]certiﬁed devices. DLNA, which is a technology that has been standardized forsharing videos, photos, musics, any time, any where in the home network, canbe also seen as the ﬁrst step towards the realization of the ubiquitous computing
technology that has been put in a practical use.

2Acquisition of operation history in DLNA Devices

Because the aim of this research is user modeling, we need to collect the detailed information from DLNA certiﬁed devices. The accuracy of user modeling improves by the acquired detailed information. For instance, we can create
more detailed user modeling by collecting the information such as “what kindof program is being watched”. It will be better than just by collecting simple
information such as “user is watching TV”.
There is a function called GENA (Generic Event Notiﬁcation Architecture)[6], that notiﬁes the operation of home appliances. UPnP [3] uses it for notifying
events among devices. DLNA that adapted UPnP as the base protocol, uses
GENA for event notiﬁcation. For instance, one of the DLNA certiﬁed deviceclasses, the DMR (Digital Media Renderer) notiﬁes the information such as playor stop as an event to all clients connected to it. Beside the DMR, there aredevices classiﬁed as the DMP. Nevertheless, the DMP does not report events by
GENA since it includes playback control function in itselfs. The DMP and theDMR are two device classes for media consumption, but most of DLNA media
consuming devices in the current market are the DMP. Therefore, at present wecannot use GENA to acquire the information required for this research.

3DLNA Spoofing

Based on the discussion in Section 2, we propose a method called DLNA spooﬁng,
a method to acquire operation history in DLNA devices based on ARP spooﬁng.
By using DLNA spooﬁng, we can acquire the communication between all DLNA
certiﬁed devices and collect the operation history without interfere the DLNA
standard. The acquired information is not only simple information such as “whenit is being played” or “when it is being stopped”, but also detailed informationsuch as “what kind of content that is being watched”.
DLNA spooﬁng can be described as follows. For an example, we take threedevices that are connected to a home network, which are a TV that is certiﬁed3as DMP (Digital Media Player), a video recorder that is certiﬁed as DMS (Digital Media Server) and a DLNA snooper which is a home gateway that has afunction to collect the information of operation history. IP and MAC addressesof the three devices are, 192.168.0.1 and 00:00:00:00:00:11 for the DLNA
snooper, 192.168.0.2 and 00:00:00:00:00:22 for the DMP, 192.168.0.3 and00:00:00:00:00:33 for the DMS. First, the DLNA snooper discovers the DMP
and the DMS using one of DLNA function, SSDP (Simple Service DiscoveryProtocol). At the same time, the DLNA snooper can obtain the IP and MACaddresses of the clients. Then, using those IP and MAC addresses, we can send
the ARP request periodically to the DMR and the DMS to change the ARPtable. For instance, we send the ARP request to the DMP with IP source ofthe DMP 192.168.0.3, MAC source of the home gateway 00:00:00:00:00:11
and IP destination of the DMP 192.168.0.2, MAC destination of the DMP
00:00:00:00:00:22. By doing this, all the data sent from the DMP to theDMS will transit the DLNA snooper. So, this method can change the routes of
the communication between the DLNA devices and make all the data transited
to the DLNA snooper.

4Preliminary Evaluation

Table 1 shows the impact on the throughput between the DLNA devices when
DLNA spooﬁng is used. It shows the throughput according to diﬀerent numbersof ﬂow in the same home network. Concretely, we used 6 devices and measured
the throughput using netperf through a switch with the capacity of 100Mbps.
Without using the DLNA spooﬁng, there is no impact on the throughput evenwhen the ﬂow increases. By using the DLNA spooﬁng, the network performancedecreases gradually according to the number of ﬂow. Considering that the traﬃcon service in DLNA such as video and picture is below 10 Mbps, the reductionof throughput according to number of ﬂow is acceptable. However, it will be a
problem if more than 6 devices are played at the same time in the same homenetwork.
Table 1. The throughput between the DLNA devices
1 ﬂow 2 ﬂow 3 ﬂow
without DLNA spooﬁng (Mbps) 94.14 94.14 94.14
with DLNA spooﬁng (Mbps) 87.3 37.43 27.81

Then, we use ping command 1000 times between two terminals to calculate
RTT (Round Trip Time). Without using the DLNA spooﬁng, the average of
RTT is 0.559 ms and the standard deviation is 0.157 ms. By using the DLNA
spooﬁng, the average of RTT is 0.669 ms and the standard deviation is 0.528
ms. Also, the calculation of the delay for 100 times out of 1000 times is shown inFig.1. We can see that the delay increases when the DLNA spooﬁng is applied.4However, we can say that the impact of the DLNA spooﬁng is small because wecan assume that in DLNA, when considering the delay factor, the most sensitiveis voice communication and the maximum of acceptable delay is about 10 ms.

6w/ DLNA spoofing
w/o DLNA spoofing

delay (ms)

543

2

100

20

40

60

80

100iterationFig. 1. RTT for 100 times out of 1000 times trial

5SummaryIn this paper, we proposed the DLNA spooﬁng as the method for logging operation history of the DLNA devices. The DLNA spooﬁng acquires all the information without changing the DLNA standard. In this paper, we showed thepreliminary evaluation of the traﬃc between the devices when DLNA spooﬁng isused. At present, we are analyzing the method on user modeling using operation
history based on DLNA spooﬁng.

6

Acknowledgment

This work is supported by Ministry of Internal Aﬀairs and Communications,Japan (Ubiquitous Service Platform).

References
1. http://amazon.com
2. http://www.tsutaya.co.jp
3. http://www.upnp.org
4. Thomas W. Malone, Kenneth R. Grant, Kum-yew Lai, Ramana Rao, and David
Rosenblitt: Semi-structured are Surprisingly Useful for Computer-Supported Coodination, Proc. of CSCW 86, pp. 102-114(1986)
5. M. Weiser: The Computer for the Twenty-First Century, Scientiﬁc American, pp.
94-101, 1991
6. J. Cohen, and S. Aggarwal: General Event Notiﬁcation Architecture Base. Internet
Draft(1999)
7. Digital Living Network Alliance, http://www.dlna.org/