## 1 Introduction
The principal manager of energy in the network is the routing protocol, which is in charge of ideally directing the network's packets. Most of the early routing protocols developed for wireless sensor networks are based on data communication via network flooding or direct broadcast. This implies that all nodes that receive a packet must repeat the sending to their neighbors over the wireless medium [11]. A possible problem of wasted resources is when the nodes are very close to each other, in which case their coverage areas overlap, and the information they capture is redundant. Another critical problem is that flooding has the potential to collapse when many replicas of the same packets are received by nodes, which in turn will create new replicas [12]. If there is no logical mechanism to recognize this state and avoid forwarding, the destination's consequence is a saturation of redundant packets and an increase in overhead. The above implies that the nodes' lifetime rapidly deteriorates when operating under flooding since there is an indiscriminate energy consumption when receiving and re-transmitting the same packets. In this work, we are based on networks with hierarchical routing and a collector or sink node. The main goal of hierarchical routing is to keep an efficient power consumption of the nodes involved in multi-hop communications. For this purpose, techniques such as clustering and data aggregation can reduce the number of messages to be transmitted to the terminal. Clustering consists of dividing the network into groups of nodes called clusters [13]. For the formation of these groups or clusters, the conservation of energy and the proximity of the nodes to the cluster's head are fundamentally taken into account. This work's main objective is to propose a predictive model of a jammer node attacking a network under a reactive jamming scheme. The proposed model is based on the most relevant network performance metrics that can be used to distinguish nodes' abnormal behavior. These metrics are the number of retransmissions, the energy consumption per node, the resilience seen as the time that the network needs to return to a stable state, and the routing tables' changes in the nodes. Our proposal's novelty lies in the exhaustive study of the main performance metrics of a routing protocol that have the most significant impact on energy. Metrics with relevant variations when the network is under jamming are chosen. This algorithm based on specific monitoring metrics is characterized by its simplicity and low consumption in detecting jamming. We evaluated it with cluster-based routing protocols and analyze its accuracy in identifying a possible area affected by abnormal conditions. This work deepens and continues the analysis of a previous proposal cited in [14]. One of the notable advantages of the proposed jamming detection algorithm is its low power consumption for the routing protocol. It is also a detection proposal from the network layer (where the routing protocol acts), which allows greater control at the nodes' level of performance metrics regarding detection from the data link layer [15]. In the next section, we list some works related to this topic.