# Forensic Analysis of Blackhole Attack in Wireless Sensor Networks/Internet of Things
## 4 Simulation and Results
### Analysis of Simulation Outcomes
#### 4.1.1 Analysis of the Flow Monitor Trace File  
The Flow Monitor operates on the IP layer and measures several parameters. It is designed using a modular approach. The network probes for Flow Monitor are of four types. * Packet sent by the source node (SendOutgoing IPv4 and IPv6 traces)
* The packet is forwarded by a node (UnicastForward IPv4 and IPv6 traces)
* Packet received (LocalDeliver IPv4 and IPv6 traces)
* Packet dropped (Drop IPv4 and IPv6 traces)  
The data composed for every flow are given in Figure 4. The flow IDs are 6 and 7. Now, we discuss flow ID 7. It is generated from the IP address 10.1.1.12 (node 13) to the IP address 10.1.1.2 (node 3), and the UDP port used is 49,153. There are 397 packets transmitted to node 3 from node 13 and 232 packets out of 397 get dropped by the BH nodes. Only 257 packets are received by the destination node. It is observed that the summation of lost and received packets is greater than the total transmitted packets. This occurs because Flow Monitor intercepts packets at IP level, and packets queued at a lower level than IP at the end of the simulation are considered lost. Packets in this flow are forwarded 1074 times. 160 packets are dropped due to the fragment timeout, and 10 packets are dropped due to the absence of a route. Other data parameters are transmission and receive bit-rate, mean delay, packets loss ratio, the number of packets transmitted, received, and lost, time for the first and the last packet transmitted and received, etc. Two types of network devices are installed on each node: the Wifi NetDevice and the loopback NetDevice. The loopback device has the IP address 127.0.0.1 on each node and is used for testing purposes. \begin{table}
\begin{tabular}{c c} \hline \hline  & **Simulation Setup** \\ \hline
**Parameters** & **Values** \\ \hline Nodes & 50 \& variable \\ Sink nodes & 10 \& variable \\ Mobility Model & Random WayPoint \& Constant Position \\ Position Allocator & Random Rectangular Position Allocator \\ Protocol & AODV \\ Time & 200 (s) \\ Loss Model & Frits \\ MAC Protocol & IEEE 802.11b \\ Bits/s & 20 \\ Mode & ad hoc Mobile \& ad hoc Static \& Traditional WSN \\ Propagation & Constant Speed Propagation Delay \\ Power & 7.5 dBm \\ Wifi Rate & 2 Mb/s \\ Area & 300 \(\times\) 1500 m \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Setting Simulation Environment. A large number of flows are observed in the flowMon file. The total number of flows is 950. The details of each flow cannot be discussed due to the restriction of space, so the data of each flow is fetched one by one to compose a table and CSV files to plot that data. The graphs show the variations of traffic patterns regarding their Flow IDs. Table 3 contains some of the flows selected upon the basis of the variations in the loss ratio and colored with respect to the PLR variations. The dark red flows depict a loss ratio greater than 70%, blue flows depict loss ratio less than 70% and greater than 40%, and green flows depict loss ratio less than 40%. The cumulative packets loss ratio is 28.789% for all flows. Some flows have 100% packets loss, some have 0% packets loss, and some have a packets loss in between these numbers. The total number of packets transmitted was 10,693, the total number of received packets was 7621, and the total number of lost packets was 3072. We calculate the cumulative loss of the flows and compose CSV files of the data to plot the graph. Python is used to plot graphs of the data.