## 4 Experimental Setup
### Experiment 3: RPL-Based Attacks  
In this subsection, we present the initial steps of the creation of multiple benign nodes and a single malicious node, which were used in our implemented RPL-based attacks. This is common practice within simulation-based studies [46; 47]. For simplicity, we disabled the communication with the host machine; this, however, can be changed to make different experiments where some interaction with the border router is needed. In our experiments, the network is isolated, and all interactions are with other modes only. The attack scenarios are explained below and are also presented in Figures 3-5.  
Figure 2: A simplified message flow diagram of all physical attacks. On the left is the adversary on PC 1, in the middle the Raspberry PI, and on the right is PC 2, which monitors the terminal output of the Raspberry Pi.  
Figure 4: A simplified message flow diagram of a DIS flooding attack in an RPL network.  
Figure 3: A simplified message flow diagram of a Rank attack in an RPL network.  
Rank attack: The malicious node reports a closer distance to the root node after the successful establishment of the RPL network. Within the network, most traffic from the tree nodes and surrounding nodes are routed through the malicious node. The aim of the attacker is to increase the power usage of devices and decrease the efficiency of the network.  
DIS flooding attack: The network is flooded with as many RPL DODAG Information Solicitation (DIS) messages as possible. The motes that within reach send RPL DODAG Information Object (DIO) messages back. This behaviour is similar to a SYN-ACK response. The aim of the attacker is to drain the battery of the devices.  
Version number attack: When forwarding DIO messages received from other motes, the version number is increased. This makes the other devices within the network rebuild bridges between the motes. This in turn triggers all repair messages within the RPL instance and causes large numbers of packets to be sent within the network.  
The aforementioned attacks were implemented as follows:  
* The network is set up with the majority of the motes being copies of a basic sensor with RPL capability;
* The motes are placed automatically, and randomly throughout the simulation with one root node and one malicious node;
* Before the attack is run, the option of creating a.pcap file is selected and the tracking of power consumption is enabled;
* The virtualisation of this network is commenced; it is run twice, once without the malicious node for a baseline, and once with the malicious node;
* When the attack is simulated successfully, it is stopped;
* The.pcap file is created and the measurements of the mote activity are collected: one before and one after the attack.  
During the attacks,.pcap files of all communications are created, power draw is monitored, and DODAG graphs are analysed. We also increase the number of sensor nodes present within the network in order to simulate networks of different sizes. This impacts the DODAG routes and increases power consumption. In particular, we implemented three stages of the attack: a simulation with 10, 13, and 16 sensor nodes.  
Figure 5: A simplified message flow diagram of a version number attack in an RPL network.