# A Reference Model for Monitoring IoT WSN-Based Applications
## 2 Wireless Sensor Networks Monitoring Tools
Minerva [27] extends this approach by connecting the debug board to a test observer which is part of an out-of-band backbone network (Ethernet). Spi-Snooper [28] integrates hardware and software in a hybrid approach. The hardware architecture brings the sensor node and the monitor together in a single unit in a transparent manner. The monitor spies on the SPI interface used to connect the sensor node to its radio module. The software architecture has two operation modes: active and passive. In passive mode the monitor--called the co-processor--mainly logs the communication through the SPI bus and checks some node data. In active mode it assumes the control of the SPI and the radio interface. However, techniques like this, based on external radio modules interconnected with the main microcontroller by means of some bus (like SPI) cannot be used in sensor nodes with built-in radio modules (as is usual nowadays) as data transmitted cannot be captured by external hardware and, additionally, the built-in radio module cannot be controlled from an external unit. In [29] an active low intrusion hybrid monitor for WSNs developed by the authors of this paper is presented. It consists of two elements: a software monitor running in observed ARM-based sensor nodes, and a monitor node attached to the latter which receives software traps issued by the former, in order to obtain relevant information about node operation. Several communication physical interfaces between monitor node and sensor node were evaluated according to intrusion, transmission time and power consumption. This preliminary implementation was a valuable experiment to validate and complete the reference model presented in this article. On the other hand, \"passive monitoring systems\" means access to network traffic without interfering with the networks. Monitors are distributed near the networks using different radio or channel routes. SNIF [30; 31] employs a sniffer over the communications channel, which snoops the data network, and another channel (Bluetooth) transmits this information to a central station. The central station analyses the received traffic and generates debug information from relationships between data. Unfortunately, this analysis relies too heavily on assumptions about the underlying data transmission protocols. A similar approach is taken by PIMOTO [32]. In this case, the monitors are sniffers that transfer the captured messages to a central server through a PC gateway using a TCP connection. Traffic received in the server is analyzed using a general purpose sniffer program (Wireshark [33]), which is extended to interpret the wireless messages contained as TCP payloads. Other examples of passive monitoring are LiveNet [34], which analyses offline traces collected by sniffers or DiMo [35], where monitors, distributed throughout the network control the periodic transmission of heartbeats from motes. Halfway between active and passive monitoring DSN can be found [36]. This monitor uses a wireless deployment support network (DSN), where each mote is directly connected to another mote in the data network. In DSN the support network uses Bluetooth and their motes build a scatternet to reach a server. The main function of the DSN motes is to record events transmitted by the application motes through a serial channel, but can also serve as an infrastructure for remote programming, transmission of commands (RFP) and dynamic configuration of the monitoring. Reference [37] discusses Z-Monitor, a passive sniffer that captures network traffic (802.15.4 standard) and redirects it to a user-friendly graphical interface. A distributed sniffing mode allows that multiple standalone versions of Z-Monitor collect local pictures of the network and send the data through wireless or wired links to a Z-Server that maintains and shows the database (with an accurate synchronization among sniffers).