WiFiMon Architectural Components

Mobile User

A mobile user is any user's device connected to the WiFi network. WiFiMon can be deployed in any WiFi network, but is optimized to be used in the Eduroam environment, as through the analysis of the Eduroam logs very detailed performance assessments can be obtained.  If the Eduroam is used, the mobile user will be authenticated at the home organisation (IdP) and authorized at the end-user's location (SP) on an IEEE 802.1X based WiFi network.

WiFiMon Admin

WiFiMon admin is the network administrator managing the WiFi network and the WiFiMon system. Using the WiFiMon UI, he/she can perform queries to the Elastic ELK Cluster and get the performance of the wireless network.

Elastic ELK Cluster

WiFiMon uses ELK cluster for performance measurement data processing and visualization. Elasticsearch , is a full-text, distributed NoSQL search engine . Elasticsearch uses documents rather than schema or tables (used in SQL databases), thus allowing leveraging and accessing data at very high speeds and making it appropriate for WiFiMon. which enables storing raw measurement data, its  high speed access and processing. 

Raw measurement data received from multiple measurement data sources is filtered and correlated in the Logstash and stored in the cluster. WiFiMon Admin uses Kibana as a web user interface. It provides cluster management and Exported Raw Data after filtered at Logstash, and the results of correlating them with the Collected Raw Data processed at WiFiMon Agent, are stored in the cluster. Part of Elastic ELK is also the Kibana platform (accessible from the browser) which provides cluster management and powers the WiFiMon UI. Another component of Elastic Stack is the Filebeat, which is installed as an agent in the severs holding the Exported Raw Data.

Data

Sources

• Collected Raw Data
  Data generated by network performance tools (Boomerang, NetTest and HTML5 SpeedTest) with the use of JavaScript code embedded on chosen web pages. Tests are run by hardware probes and performance data are retrieved when the hardware probes visit the web sources with the embedded code.
• Exported Raw Data
  Data generated from the interaction of mobile users with services like Eduroam and DHCP, whose logs are fetched from Filebeat agents and are then sent to Logstash pipelines for filtering and editing them according to the needs of WiFiMon, before storing them in the Elastic ELK Cluster.

Captioned Item
anchor ETF73 name Figure caption WiFiMon Architectural Components

WiFiMon Agent / UI

• WiFiMon Agent
  Processes Collected Raw Data to objects relevant to performance measurements, which are correlated with Exported Raw Data collected from RADIUS and DHCP logs, to provide insight on the wireless network performance per client or AP. The results of correlations are stored in the ELK Cluster.
• WiFiMon UI
  Powered by Kibana platform to perform queries, for example, to retrieve information about the measurements initiated to a specific AP and within a specific time period. Other queries could be made to retrieve information about specific IP ranges, test tools etc.

Data Security

WiFiMon respects the privacy of data. All the traffic in WiFiMon is encrypted with SSL/TLS certificates. Furthermore, sensitive data such as mobile users IP or MAC address is hash-ed before stored in the ELK Cluster. The correlation procedure mentioned at WiFiMon Agent above, is performed over the hash-ed data.

WiFiMon Measurement Workflow

WiFiMon Test Server (WTS)

The WiFiMon test server includes configured templates from NetTest, Boomerang and SpeedTests (HTML5), which provide information about RTTs and ping (ICMP) network relevant data like bandwidth and latency (represented in Figure 2 as lines marked as 2.1, 2.2, and 2.5). A standard image size is downloaded for NetTest, and for Boomerang it can be customisable to a maximum of 5 MByte size. The location of the WTS and its topological distance from the monitored WiFi network has a major impact on the crowdsourced measurement accuracy and reliability. You can read more about this here.

WiFiMon Software Probe (WSP)

The WiFiMon Software Probe takes the form of JavaScript integrated in often visited web pages. It includes the domain of the WiFiMon agent (e.g., wifimon.switch.ch), the listening agent port (8443) and the image location/path (e.g. https://eipa19.eipa.ttu.ee/wifimon/images/) as well as the cookie expiration time. The default value of this cookie is 1.5 min (currently) if it is not explicitly set in the WiFiMon test server.

WiFiMon Hardware Probe (WHP)

The WiFiMon hardware probes are set up on small form factor devices - such as the Raspberry Pi. The HW probe may be viewed as an end user logged in to the eduroam wireless network, but monitoring continuously from a fixed point. It measures bandwidth, latency, the average values of bit rate, the signal level, the link quality and the transmission power. The WiFiMon team recommends to set up a WHP on Raspberry Pi’s v3 Model B+ or v4

Captioned Item
anchor R6BC7 name Figure caption WiFiMon Measurement Workflow

WiFiMon Analysis Server (WAS)

The Analysis Server includes the WiFiMon agent, Elasticsearch, Logstash and the WiFiMon UI with Kibana for customizing reports and their visualization. The WiFiMon agent checks the subnet (2.3, 2.4) of a monitored device visiting the website that includes the JavaScript lines and downloads available images from the WiFiMon Test server (2.5). Network performance metrics are calculated and streamed from the end user to the WiFiMon Analysis Server (2.6). Furthermore, the WAS correlates performance data with client IPs and AP-IDs (2.7/2.8).