# Preventing Black Hole Attacks in AODV Using RREQ Packets
## 7 Future Research  
In the proposed method, a black hole node can be detected only by neighboring nodes that receive a forged RREP packet from the black hole node. One possible countermeasure is to share this information with the surrounding normal nodes to neutralize to the black hole nodes in the network. There are two timing types to consider for issuing dummy RREQ packets: during initial route discovery, and in response to link breakage. In the latter case, a dummy RREQ packet is sent each time a node is unable to correct a break by itself. This can cause frequent flooding of dummy RREQ packets in an environment with frequent link disconnections, which can increase the network load. Moreover, as the dummy RREQ packet has no destination, it will propagate throughout the network if the time-to-live (TTL) is long enough. This can lead to bandwidth overload, particularly if there are frequent link disconnections. However, adjusting the TTL of dummy RREQ packets to make them smaller means that black hole nodes can only be detected around the source node. Hence,in order to prevent network congestion, the TTL of dummy RREQ packets should be equal to or greater than that of correct RREQ packets. In networks with frequent link changes, reducing the number of dummy RREQ transmissions may become necessary in order to optimize performance.  
One common problem observed in related studies, as well as in the proposed method, is that when using dummy RREQ packets to identify black hole nodes, nodes with plain AODV that are not modified (denoted as NA, for Not Available) may exist between the dummy RREQ packet and the black hole node(s) (i.e., S and BH). In such cases, a node that is NA can be misjudged as a black hole node, as shown in Figure 7.  
Therefore, to improve the practicality of the dummy RREQ packet-based decision mechanism, nodes must update the hop count of forged RREQ packets at each reception in order to detect only neighboring black hole nodes. The behavior of black hole nodes should be mentioned as well. As a precondition, a black hole node can be detected by the proposed method because it has the characteristic of returning RREQ packets for every RREP packet it receives. However, consider the case where a black hole node behaves as a normal node at certain times and behaves in a malicious manner at others. In this case, the proposed detection approach may not work; accordingly, data cannot be transmitted after the route is established. Although detection can exclude the black hole node from the network when it behaves maliciously during route establishment, this process inevitably decreases network throughput. Extending the above example, consider the case in which a malicious attack occurs outside of the routing phase. For instance, a black hole node may be specified to behave as a normal node during the route establishment phase and to discard data when routing packets for subsequent data communication. After the route is established, the source node repeats routing for route establishment, because it cannot transmit data; however, when routing to establish a route, if this black hole node exists on the route again, it ends up not being able to send data to the destination node. To avoid such loops, a technique is needed to identify nodes that can establish a route but cannot communicate data and to prevent such nodes from being candidates for routes during the routing stage. This technique may additionally be an effective countermeasure against wormhole attacks in MANETs; in such attacks, a wormhole node with a high-speed private channel is installed near the source and destination nodes, and discards data after assigning itself priority as a node on the communication path. As a future work research direction, we plan to evaluate recent related studies and proposed methods in terms of their power consumption, communication volume, and resistance to black hole attacks.