## 3 Ermost
### Sniffer
#### 3.1.1 Sniffer Election  
After the deployment of the monitoring network, sniffers and a local monitor start the _Sniffer Election_ in order to elect the nodes of the target network that will have their packets captured by each sniffer. This election mechanism is executed when a sniffer captures for the first time a packet of a given node of the target network and takes into account the RSSI. As shown in the UML sequence diagram of Figure 3a, when a sniffer \(\mathbf{S_{X}}\) captures for the first time a packet of the target node \(\mathbf{A}\), it sends a message of inclusion of a new node to the local monitor reporting the address of this node \(\mathbf{A}\) and the corresponding RSSI. If no other sniffer is capturing packets from node \(\mathbf{A}\), the local monitor sends a message to \(\mathbf{S_{X}}\) to start capturing the packets sent by node **A**. Thus, sniffer **S\({}_{\textbf{X}}\)** sends an ACK message to the local monitor and starts capturing packets sent by node **A**. However, if another sniffer **S\({}_{\textbf{Y}}\)** is capturing packets from target node **A**, the local monitor analyzes which of the two sniffers is receiving packets from node **A** with the highest RSSI value, because, in general, the signal with the highest RSSI value has better quality. If **S\({}_{\textbf{Y}}\)** is receiving the signal from node **A** with the RSSI value greater than or equal to **S\({}_{\textbf{X}}\)**, the local monitor sends a message to **S\({}_{\textbf{X}}\)** stating that it should not capture packets sent by node **A**, as shown in Figure 3b. However, if **S\({}_{\textbf{Y}}\)** is receiving the signal from node **A** with the RSSI value less than **S\({}_{\textbf{X}}\)**, the local monitor sends a message to **S\({}_{\textbf{X}}\)** to start capturing packets from **A** and it sends a message to **S\({}_{\textbf{Y}}\)** to stop capturing packets from **A**, as shown in Figure 3c. In all situations presented in sequence diagrams shown in Figure 3, after sending a message to a sniffer, the local monitor waits for an ACK message from this sniffer. If the ACK is not received after a time interval (timeout), the local monitor relays the message. If the local monitor does not receive any acknowledgment message after three transmission attempts, this sniffer is considered dead. In this case, the election mechanism is rebooted for the packets of the target nodes covered by this sniffer can be captured by another sniffer. It is important to mention that RSSI captures the signal strength observed on the receiver antenna during packet reception. Two main considerations must be taken into account when analyzing RSSI. First, the RSSI calculation is solely based on correctly received packets, which implies that RSSI will not record packets that failed because of interference [24]. Second, the RSSI is not the average of the signal strengths measured through the reception of the whole packet. In fact, the RSSI value represents  
Figure 3: Sniffer election: (**a**) When no sniffer is capturing packets sent by the target node. (**b**) When \(\text{S}_{\textbf{Y}}\) is capturing packets sent by the target node and RSSI(\text{S}_{\textbf{Y}}\)\(\geq\) RSSI(\text{S}_{\textbf{X}}\)). (**c**) When \(\text{S}_{\textbf{Y}}\) is capturing packets sent by the target node and RSSI(\text{S}_{\textbf{Y}}\)\(<\) RSSI(\text{S}_{\textbf{X}}\)). the received signal strength captured only during the reception of the preamble and header of the Physical Layer Protocol [25]. Thus, in cases where the interference affects only the data portion of the frame, this effect of interference will not be captured in the RSSI measurement [26]. Despite these considerations, the RSSI is a metric frequently used for evaluating the quality of the received signal. To increase the RSSI precision, it has been suggested to use RSSI measurements together with statistical functions. For example, the RSSI value can be calculated from a fixed number of previous measurements or from the measurements in a time interval.