## 3 Ermost  
As mentioned in Section 1, an energy-efficient passive monitoring system is necessary when we need to monitor a WSN in a real scenario for a long time; otherwise, the lifetime of the monitoring network can be much shorter than the lifetime of the target network, due to misuse of the energy of sniffers nodes. Thus, we propose an energy-efficient passive monitoring system for WSN, named EPMOSt, which reduces the energy consumption of the monitoring network. Furthermore, the proposed system provides monitoring information using an SNMP (Simple Network Management Protocol) agent. The SNMP agent allows the integration of the proposed system with any management tool with SNMP support, such as Nagios [16], Net-SNMP [17], SNMP MIB Browser Android Tool [18] and Manage Engine MIB Browser Free Tool [19]. Figure 1 shows the overview of the monitoring system EPMOSt, in which a monitoring network is deployed together with the target network. A monitoring network node (sniffer) captures, in a promiscuous mode, the packets sent by one or more nodes of the target network, inserts a timestamp for each captured packet, and aggregates the headers of several packets in a monitoring message. Then the sniffer sends this message, using the monitoring network, to the local monitor. The local monitor receives the monitoring messages from multiple sniffers and inserts the information of captured packets in a trace file (database) located on the server. The server analyzes the trace generated by one or more local monitors and obtains several pieces of information about the target network (_i.e._, time at which each node awakens, packet loss, reboot of nodes, number of sent and received packets by each node, _etc._). This information is available to the network administrator and it is also stored in a Management Information Base (MIB) to be accessed by an SNMP agent. Figure 2 shows the Unified Modeling Language (UML) activity diagram of the EPMOSt. In this system, in general the packets of a given node of the target network are captured by only one sniffer in order to reduce the transmission of redundant packets and hence reduce the energy consumption of the monitoring network. The EPMOSt initially runs a mechanism (_Sniffer Election_) to elect the nodes of the target network that will have their packets captured by each sniffer. This election mechanism is performed by the sniffers and by the local monitor, taking into account the Received Signal Strength Indicator (RSSI). This mechanism is explained in detail in Section 3.1.1. Figure 1: Overview of the EPMOSt. Figure 2: UML activity diagram of the EPMOSt. When capturing a packet of the target network, the sniffer inserts a timestamp in this packet. After capturing some packets, the sniffer may aggregate the headers of these packets in a monitoring message to send to the local monitor. The aggregation of headers aims to reduce the number of bytes sent through the monitoring network and, consequently, reduce the energy consumption of this network. In this case, only the information present in the headers of the packets sent by the target network is monitored. However, when there is a need to monitor the data (payload) sent by the target network, the system should not use this aggregation module. The aggregation mechanism is explained in detail in Section 3.1.2. The local monitor receives the monitoring messages sent by sniffers and inserts the information of captured packets in a trace file (database) located on the server. The local monitor communicates with the server through an IP network. In some scenarios, it is necessary to deploy local monitors in different parts of the network due to the limited radio range of sniffers. In a more restricted scenario, only one local monitor can be used. In this case, the same computer can act as local monitor and server. The main function of the server is to extract information about the target network from the trace generated by local monitors. For this purpose, initially, the server removes redundant packets that were inserted into the trace.