Measuring Wireless Network Usage With The Experience Sampling Method
Measuring Wireless Network Usage With The Experience Sampling Method
Measuring Wireless Network Usage With The Experience Sampling Method
Abstract— Measuring wireless local area networks has proven We introduce the Experience Sampling Method in the next
useful for characterizing, modeling and provisioning these net- section, and describe previous ESM studies and wireless
works. These measurements are typically taken passively from a network measurement studies. Section II describes our exper-
vantage point on the network itself. Client devices, or users, are
never actively queried. These measurements can indicate what imental setup and methodology, and Section III presents some
is happening on the network, but it can be difficult to infer brief results. In Section IV we list some of the lessons that
why a particular behavior is occurring. In this paper we use the we learnt in the course of conducting the study, and Section V
Experience Sampling Method (ESM) to study wireless network concludes.
users. We monitored 29 users remotely for one week, and signaled
them to fill out a questionnaire whenever interesting wireless I. BACKGROUND AND RELATED WORK
behavior was observed. We find ESM to be a useful method
for collecting data about wireless network usage that cannot Diary methods are a group of research tools and meth-
be provided by network monitoring, and we present a list of ods used in psychology for “documenting the particulars
recommendations for network researchers who wish to conduct of life.” [6]. The distinguishing feature of a diary method
an ESM study. is that participants self-report their own ongoing experi-
Researchers have conducted many wireless local area net- ences. This enables the recording of events and experiences
work (WLAN) measurement studies, collecting data to help in a more natural context than a formal interview. Diary
characterize, model and provision these networks. Typically methods can be divided into three categories [22]: interval-
these studies take network-side measurements, counting the contingent, where participants report at regular intervals;
number of clients, the amount of traffic transmitted, client signal-contingent, where participants report when they receive
session durations and so forth. Such studies are useful for a signal; and event-contingent, where participants report when-
determining what is occurring on a network. They may not, ever a defined event occurs.
however, explain why a particular behavior is observed. For in- Within the broader category of diary methods, the Experi-
stance, in one of our recent studies [13], we observe increased ence Sampling Method (ESM) [18] has emerged as a popular
peer-to-peer filesharing on our campus WLAN, despite the method for evaluating user experiences and situations. In an
presence of a higher-bandwidth wired network. Why are users ESM study, also referred to in the literature as Ecological
choosing to use the slower wireless network for downloading Momentary Assessment (EMA), participants fill out a ques-
such large files? Is it because the convenience of the wireless tionnaire several times a day. The questionnaire asks about
network outweighs its limited capacity? Or is it because the the participant’s current activities, conditions and feelings.
users are unaware of the wired network? Such questions cannot A typical ESM study is signal-contingent, involving seven
be answered by network-side measurement alone. signals a day over seven days. ESM has been used to evaluate
a wide variety of experiences, such as job satisfaction amongst
To understand why particular wireless network behavior
teachers [5], happiness amongst American youths [9], and
occurs, it is useful to ask network users about their usage pat-
the quality of experience of new parents before and after
terns. A one-off survey or questionnaire, however, may not be
childbirth [10].
appropriate. If a user is asked about a wireless behavior some
Most relevant to our work are ESM studies that look
time after the event has occurred, they may have forgotten the
specifically at communications or technology. Kubey et al. [17]
conditions at the time of the event, or the particular reason
present a survey of communications-related ESM studies, such
for their actions. Instead, we need to way to non-intrusively
as television viewing, and communication patterns within
record all aspects of a user’s wireless network experience.
families and marriages. Consolvo and Walker [8] use ESM
In this paper, we describe an Experience Sampling Method to evaluate user experiences with the Intel Personal Server
(ESM) study of a campus-wide WLAN. ESM is a psychology ubiquitous computing device. Gaggioli et al. use ESM to
method for studying user experience. We compare the data analyze quality of experience and presence in virtual envi-
obtained through ESM to data from network monitoring. ronments [12].
Technology can also be used to improve ESM methodol- were extensive, containing 25 questions, some of which had
ogy. Instead of using a notebook or paper questionnaires to several parts and open-ended questions, and thus would be
record responses, Palen and Salzman ask their participants impractical to fill out using a PDA. Second, we considered
to record voicemail messages upon receiving an alert [19]. using a PDA equipped with an 802.11 network adapter, as this
Another common electronic ESM tool is to use a PDA for would have allowed us to use the same device for signalling
questionnaires [4]. participants, for participants to fill out questionnaires, and
Several researchers have measured and characterized wire- for the questionnaire responses to be transmitted to a central
less LANs, mainly in academic settings. Academic WLANs data-collection server. We rejected this solution, however, as
that have been measured include those at Stanford [21], participants could not be signalled when they were out of
Georgia Tech [14], Dartmouth [13], [16], UNC [7] and the range of an 802.11 network (for example, if they were off
University of Saskatchewan [20]. These studies have all taken campus). Moreover, participants could not be signalled if the
place on the wired side of the access points, using packet 802.11 network was having trouble, which was one of the
sniffers, SNMP polling, syslog records, or a combination of aspects that we were interested in monitoring. Rather than
these techniques. The non-academic WLANs that have been require participants to carry two electronic devices (a PDA
studied include a conference WLAN [2], and the WLAN at and a pager), which would only increase the probability of a
a corporate research campus [3], both of which were also device malfunction during the study, we chose to use a pager
measured using SNMP or packet sniffing. and a notebook.
More recently, WLANs have been measured from the wire- Participants provided “conflict times” at which they did not
less side of the access point; that is, measuring the wireless want to be paged, for example, when they were asleep or in an
medium itself. Wireless-side measurement is complex due examination. Using this information, we drew up a schedule of
to the unreliable nature of the wireless medium, hardware signal-contingent alerts. At each signal-contingent alert time,
and software incompatibilities, and so forth. As such, most we sent participants a page containing a numeric code. This
wireless-side studies are of a smaller scale than wired-side code indicated the page in the notebook to be filled out (in case
studies. Yeo et al. measure a single access point at the a participant missed an alert). Each participant received seven
University of Maryland [23], while various other studies have signal-contingent alerts per day, and each alert was scheduled
taken place in controlled wireless conditions [1], [11], [15]. at least 45 minutes after the preceding alert, to prevent the
alerts from being too intrusive.
II. M ETHODOLOGY
B. Wireless monitoring setup
In this section we describe our experimental setup. Our
study differs slightly from most ESM studies in that it is both We monitored our campus WLAN using our existing mea-
signal-contingent and event-contingent. Participants are sent surement infrastructure. This uses four techniques to trace
signals to record details about their general wireless network WLAN usage: syslog and DHCP records, SNMP polls and
experience, but in addition, we use our network monitoring network sniffers (see [13] for further details). We record
infrastructure to detect interesting events and send event- syslog messages from every AP on campus every time a
contingent signals. user associates, disassociates, authenticates, deauthenticates or
roams. Every five minutes, we poll each AP using SNMP to
A. ESM setup collect detailed client statistics including bytes, packets and
We recruited participants using a website and college bul- errors transmitted; signal strength and quality. We have in-
letin boards. The website used a registration form to preselect stalled 18 Linux boxes in various switchrooms around campus,
participants (to make sure, for instance, that all participants connected to the wired side of the APs, and use tcpdump to
owned a wireless device). We interviewed all of the respon- capture headers of packets sent to and from the APs.
dents and selected 30 participants: 15 male and 15 female. In addition to the measurement mechanisms described
All of the participants were undergraduate students. To attract in [13], we obtained logs from our central campus e-mail
students and encourage participation, we offered them $100 server. This server writes a timestamped record to a log
each to participate in the study. One participant dropped out whenever a user logs on to the e-mail server (logout times are
during the study; this participant’s data is excluded from the not recorded). Our system administrators filtered these logs by
results. username, to provide us with records for our 30 participants.
We issued each participant with a pager and a questionnaire To detect interesting wireless events, we used the syslog and
notebook. The pager was a Motorola Bravo numeric pager SNMP data since these are collected in real-time.1 We detected
operating in the 406-512MHz band. To programmatically send the following events (the data source is listed in brackets):
pages to the participants, we used a SMTP-to-page gateway • [syslog] Excessive associations and disassociations in a
operated by the pager service provider. The notebook con- short time period (“ping-ponging” between APs). We define
tained questionnaires with questions about communications ping-ponging as a median interarrival between a client’s last
usage (wired, wireless and other communications devices), five associations of less than 10 seconds.
their current activities, location and so forth. We chose to 1 While the sniffers collect data in real-time, logs are stored on the sniffers
use a notebook for several reasons. First, our questionnaires and uploaded to our analysis server in off-peak periods.
• [SNMP] A client associates with an AP that is heavily- Fig. 1. Number of locations at which a participant is signalled, compared
loaded with clients. We define such a “busy” AP as one to the number of locations where a participant is signalled and connected to
the wireless network. Distribution across locations per day.
with more than 16 associated clients. 1
• [SNMP] A client associates with an AP that is not reachable
0.9
via SNMP. An AP that cannot be reached by SNMP, but
0.8
is still sending syslog messages, may be having network or
0.7
operational problems. We define such an “unreachable” AP
0.6
as one that has not been polled successfully for one hour.
0.5
• [SNMP] A client associates with an AP that is heavily-
0.4
loaded with traffic. We define such a “high traffic” AP as
0.3
one where the mean inbound or outbound bytes per second
0.2
over the last two SNMP polls is greater than 250Kb/s.
0.1 All locations
• [SNMP] A client associates with an AP that is experiencing Locations when on wireless
0
high levels of errors or retransmits. We define such an 0 1 2 3 4 5 6
“error-prone” AP as one with an error/retransmit level of Daily number of locations
≥ 10%.
• [syslog] A client associates with an AP after a long period
of inactivity, defined as two hours. We ignored the first
association of the day, as this might be the participant correctly-determined locations is surprisingly low. It means
waking up. that our raw syslog data may require some processing or ad-
Whenever one of the above events occurred, an event- ditional context-specific information before conclusions about
contigent alert was triggered, which sent a page to the relevant user locations or user mobility can be made.
participant. These pages contained a different code, indicating
that the participant should fill out an event-contingent survey. The ESM questionnaires provide a useful mechanism for
This survey was shorter, containing questions that were solely understanding errors in location-determination. Where there
about the participant’s wireless experience. is a discrepancy in locations, syslog reported a building that
Each participant was sent up to three event-contigent alerts is adjacent to the self-reported location 5% of the time. Errors
a day. Event alerts were only sent if the participant had not in the self-reporting, such as a blank entry in the location field
received a page in the last 45 minutes. of the questionnaire, account for 13.4% of the discrepancies.
The study took place over one week, starting on a Sunday. The largest cause of discrepancies is where we believe the
participant leaves their laptop at home, but still powered up
III. R ESULTS and connected to the wireless network. We distinguish this
In this section we present some results from our study. behavior by looking for a long wireless session, where a client
The study generated an enormous amount of data; with 29 is observed associated with the same AP, but the corresponding
users filling out up to 10 questionnaires a day over seven participant’s self-reported locations change more than once.
days, there were over 270,000 individual data points from the These situations account for 23.2% of the discrepancies.
questionnaires alone, in addition to the data from pre-study and One use for tracking the location of network users is
post-study interviews, and the network monitoring. As such, in to estimate or model their mobility. Using AP associations,
this paper we only provide selected statistics, and concentrate however, only allows us to track user mobility while they are
on those results that could not be obtained through network- associated with the network. While this may be appropriate
monitoring. for laptop users, who are nomadic in their network usage,
A. User location newer wireless devices such as VoIP phones tend to be always-
on, and so have different mobility characteristics. To better
In previous measurement studies we have used syslog
anticipate the nature of these devices’ mobility, we may want
records to determine the approximate location of a user at
to track users’ overall physical mobility, i.e., track all of the
a given point in time. We use a client’s association records,
locations that they visit, rather than just those where they are
and assume that the client is located near to this AP. This
using the WLAN.
location information may not always be accurate, however, due
to different client driver behavior, or ping-ponging between Figure 1 shows the total number of different locations at
APs, which can make it difficult to determine an accurate which a participant self-reported each day, compared to the
location. Asking users to self-report their location may solve number of locations at which they self-reported themselves
these problems. and were also connected to the wireless network. The median
Comparing the locations determined via syslog with the total number of locations is 2, whereas the median number of
participants’ self-reported locations at the time of a page shows wireless locations is 0. By only observing users on our campus
that syslog accurately determined the building in which a while they are connected to the WLAN, we are clearly missing
participant is located 55% of the time. This proportion of out on a large part of their mobility.
B. Device usage Fig. 2. Total participant traffic (GB), by TCP or UDP protocol.
By monitoring an 802.11 wireless network, we can observe Inbound
Outbound
the behavior of the clients on that network. By analyzing TCP database
flows, it may also be possible to determine the device type of bulk
each client, which we have done in a previous study [13]. We interactive
are limited, however, to wireless devices that use the 802.11 unknown
PHY and MAC layers. A given user may be carrying a variety services
devices, such as phones that can operate on both 802.11 and www