## 2 Passive Monitoring in WSNs  
This section discusses the main passive monitoring systems proposed specifically for wireless sensor networks. In Sensor Network Troubleshooting Suite (SNTS) [6], nodes of the monitoring network (sniffers) listen passively on the communication channel and capture packets sent by the nodes of the target network. When capturing a packet, a sniffer includes a record in its non-volatile memory (e.g., flash memory) with the contents of the packet and a timestamp. After the period of data capture, sniffers are manually collected and records of the captured packets are transferred to a computer, where they are analyzed. The information obtained from the captured packets is displayed in a tool developed by the authors. The aim of SNTS is to help the developer of applications for WSN to find and fix faults during development time. However, it is not feasible to use the SNTS to monitor WSN deployed in real scenarios where it is impractical to collect the sniffers, for example in military applications or environmental monitoring applications. In Sensor Network Inspection Framework (SNIF) [7], each sniffer has two radio interfaces, one of which is used to capture packets sent by the nodes of the target network and the other to send the captured packets to the sink node (e.g., a computer) through the monitoring network. The packets captured by sniffers are tagged with a timestamp and sent to the sink node, where duplicate packets are removed. Thus, the packets are analyzed and the information obtained from the monitoring is displayed in a tool developed by the authors. In Pimoto [8], the target network is subdivided into monitoring islands. A sniffer is deployed in each monitoring island. The sniffer is responsible for capturing in promiscuous mode the packets sent by the nodes of the target network that are within its island and sending theses packets to a gateway (computer) using a Bluetooth radio. A gateway can receive the packets captured by several sniffers. The gateway includes the timestamp and the sniffer address in each captured packet and then it sends the packets to a server. The server analyzes and displays the captured packets with the well-known traffic analysis tool Wireshark [9] using a plugin developed by the authors. In Pimoto, captured packets can be viewed in Wireshark, but the analysis of packets must be performed by the network administrator. Furthermore, the use of Pimoto may be impractical to monitor a WSN that has too many nodes distributed in a wide geographic area because it requires an infrastructure composed of multiple gateways interconnected to the server. In LiveNet [10], packets captured by sniffers can be stored in a flash memory or sent to a computer via a serial port for future analysis. On the computer, the captured packets are analyzed to obtain information about the behavior of the target network. Like SNTS, it is not feasible to use LiveNet to monitor WSN deployed in scenarios where it is impractical to collect the data stored in the flash memory of sniffers or to send the data collected by sniffers using a wired network, for example in military applications or environmental monitoring applications. In Passive Monitoring System in Wireless (PMSW) sensor networks [11], each sniffer captures data packets and acknowledgment packets (ACKs) sent by the nodes of the target network that are within its coverage area, and sends the captured packets to its gateway (computer). A sniffer connects to only one gateway via a radio channel with frequency different from the frequency of operation of the target network. When the gateway receives the packets captured by its sniffers, it creates a local trace. Each record of the local trace contains the information of a packet and a timestamp based on the gateway's clock. Hence, each gateway sends the local trace to a server through a TCP/IP network. The server receives the traces sent by all gateways, and generates a global trace with duplicated records removed.