KPAT: A kernel and protocol analysis tool for embedded networking devices

Sniffer tools capture protocol data. Kernel-profiling tools track function calls and events occurring in the kernel. These two types of tools help us observe external and internal behaviors of networking protocols, respectively. We need both types of data for a comprehensive view of protocol behavior. However, none of existing tools performs these two tasks in an integrated way. We developed Kernel and Protocol Analysis Tool (KPAT). KPAT injects software probes into Linux kernel to track interested function calls and event occurrences in the kernel. Probe injection is done systematically and does not require recompiling the kernel. A module in KPAT finds the association between the tracked functions and protocol data captured by an independent sniffer. The result as an integrated log allows users to identify two-way relationship between protocol data and the execution sequence of network functions in the kernel. We successfully used KPAT to identity accurate latency of each handover phase in IEEE 802.11 wireless networks. Experimental results show that KPAT causes light overhead to the patched kernel.