# Forensic Analysis of Blackhole Attack in Wireless Sensor Networks/Internet of Things
## 4 Simulation and Results
### Analysis of Simulation Outcomes
#### 4.1.1 Analysis of the Flow Monitor Trace File
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Flow ID** & **Nodes** & **Typackets** & **Rypackets** & **Lost Packets** & **PLR (\%)** \\ \hline
1 & 14 to 4 & 399 & 159 & 240 & 60.15\% \\ \hline
2 & 10 to 0 & 398 & 125 & 273 & 68.60\% \\ \hline
3 & 13 to 3 & 398 & 114 & 284 & 71.35\% \\ \hline
4 & 12 to 2 & 398 & 51 & 347 & 87.18\% \\ \hline... &... &... &... &... &... \\ \hline
23 & 18 to 8 & 397 & 194 & 203 & 51.34\% \\ \hline
24 & 18 to 8 & 396 & 108 & 288 & 72.72\% \\ \hline
25 & 18 to 8 & 396 & 112 & 284 & 71.71\% \\ \hline... &... &... &... &... &... \\ \hline
948 & 40 to 9 & 4 & 3 & 1 & 25\% \\ \hline
949 & 30 to 29 & 2 & 2 & 0 & 0.0 \% \\ \hline
950 & 25 to 32 & 3 & 3 & 0 & 0.0 \% \\ \hline
**Total** & & **10,693** & **7621** & **3072** & **28.729\%** \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Table of Flow IDs data. Figure 4: NetAnim Image of the Flow IDs. Figure 5 depicts the statistics of all 950 flow IDs concerning their number of packet transmissions. The initial bars show that the packets transmission rate is up to 400 packets per flow ID. However, it then severely declines due to the BH attack. Figure 6 contains the information about the received packets from all flow IDs. Due to the directly proportional relationship to transmission rate, the number of received packets is up to 200 for initial flow IDs, and then this number also declines. We can see that it keeps varying throughout the process but never touches the highest again. Figure 7 depicts the number of lost packets. At the start, the packet loss is high in terms of the number of packets. It almost hit 400 packets per flow at the worsening state of attack. As we have observed, the pattern of the traffic in the past two graphs, the number of packets declines in the network communication but the ratio of sent to lost packets does not decline as per the pattern, which is depicted in the next graph. Therefore, when the transmission packets number declines, the received packets and lost packets numbers also decline. Figure 5: Packets transmitted. Figure 6: Packets Received. Figure 7: Number of packets lost. Figure 8 shows the packet loss ratio (PLR) of all flow IDs from ID 1 to 950. The line graph frequently touches the maximum, when there is a 100% packet loss for a flow ID. The PLR is given as a percentage. We have many flows in which not even a single data packet is received by the destination IP. The PLR is 100% repeatedly throughout the axis. Furthermore, some of the flow IDs have PLR 0%. From the previous graphs, it is observed that the number of packet transmissions declines when the attack starts. Although the number of packets declines, but the damage scale of the BH remains the same until the end. In some flows, the number of the transmitted packets is very low, and they are all dropped by the BH nodes and lost. Therefore, the PLR hits the hundred-percent scale-point for several flow IDs. An excessive decline in the number of transmitted packets created a flood of AODV control packets in the network. We analyze the behavior of the attack on the IP layer of the network. The number of all flows is 950, but when we run the network simulation without an attack in the normal state, the flows are only 371, and the total number of the transmitted packets is 2316. The BH attack caused a massive boost in the control traffic of the network and choked the network traffic, so the number of flows increased exponentially. AODV is an on-demand and reactive protocol, and the routes are demolished after use or due to some abnormality. Therefore, the attack caused the extensive flow of AODV control packets in the network, affecting the cumulative performance and energy.