## 3 Results Analysis  
The performance of TTHCA was rigorously tested in a MANET simulation environment developed in NS-2 [19], with all the simulation parameters being defined in Table 1.  
It is assumed a single wormhole existed in the MANET with all nodes having identical IEEE 802.11b hardware and which, with the exception of the wormhole nodes, were randomly distributed within the network area. An example output from a NS-2 simulation run is displayed in Figure 3, where the source and destination nodes are shown in red and a 4-hop PM O-B wormhole link is located in the centre of the network.  
MHA and DelPHI were recoded and respectively used as the comparative HC and RTT-based detection techniques for TTHCA in the simulation environment. The time threshold for DelPHI was \(T=3\)\(ms\) and \(RREP_{lim}=2\) was chosen for MHA because in the case of only one wormhole, just two comparable route samples are sufficient for a wormhole route to be detected. Simulation results for WAP have not been included because this protocol assumes negligible packet processing delays on all intermediate nodes, which renders it unsuitable for this test environment which comprised nodes with realistic packet processing delays.  
\begin{table}
\begin{tabular}{|p{142.3 pt}|p{142.3 pt}|} \hline
**Parameter** & **Settings** \\ \hline Number of nodes & 300 \\ Network area (\(A\)) & 4,000,000 m\({}^{2}\) \\ Network width (\(W\)) & Random: 1,500 m\(-\)4,000 m \\ Network length (\(L\)) & \(A/W\) \\ Node wireless hardware & IEEE 802.11b \\ Maximum radio range / node (\(R\)) & 250 m \\ Packet propagation speed (\(S\)) & 300,000,000 m/s \\ Routing packet processing delay/node (_Average, Variance, Median_) & 22 ms, 3 ms, 4 ms \\ Number of samples per test case: & \\ Wormhole infected routes (\(r_{wh}\)) & 100 \\ Total number of routes (\(r_{tot}\)) & \(r_{wh}+\) all collected healthy routes \\ Output: & \\ Wormhole detection rate (\%) & Number of identified wormhole routes / \(r_{wh}\) \\ FP occurrence rate (\%) & Falsely identified wormhole routes / \(r_{tot}\) \\ \hline \end{tabular}
\end{table}
Table 1: Simulation parameter settings.  
All four wormhole types with lengths between three and six hops were analysed, and the corresponding wormhole and FP detection rates for TTHCA, MHA and DelPHI calculated, with a statistical significance test performed to assess the confidence levels of the results. Wormhole lengths shorter than three hops were not included because they are not a significant network threat as they do not attract much traffic. Similarly, wormhole links longer than six hops inevitably produce a PTT/HC value which increases the likelihood of TTHCA successfully detecting the wormhole. To evaluate the performance limits of TTHCA, an analysis of the packet processing time measurement errors and radio range tolerances is also presented along with a route discovery delay overhead comparison between TTHCA, MHA and the original AODV protocol.  
For each test case, simulation runs were repeated until 100 wormhole infected route samples were collected, so the total number of route samples was variable, (approximately in the range 300 to 1,100) and dependent both upon the network traffic attraction capability of the respective wormhole variant and the route discovery technique used by the respective wormhole detection scheme.