Antmonitor: a system for mobile network monitoring and its applications

A computer program product for mobile network monitoring, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions using a computer processor to cause the mobile device and/or a cloud server to:

• allow a user to turn a virtual private network on or off using a graphical user interface and select applications for contributing data to data collection;
• manage a network tunnel (TUN) interface and route the data for the data collection by extracting a datagram from the data, routing the datagram to a target host, wrapping a response from the target host in a datagram, and writing the response to the network tunnel interface;
• log files with some of the data for the data collection and upload them to a log server;
• and
• analyze packets from the data and visualize them.

A computer program product for mobile network monitoring, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions using a computer processor to cause the mobile device to:

• allow a user to turn a virtual private network on or off using a graphical user interface and select applications for contributing data to data collection;
• manage a network tunnel (TUN) interface and route the data for the data collection by extracting a datagram from the data, routing the datagram to a target host, wrapping a response from the target host in a datagram, and writing the response to the network tunnel interface;
• intercept the packets on the device using the aforementioned VPN service and corresponding TUN interface;
• route a datagram directly to and from the destination and source without involving a remote VPN server by having a forwarder module on the device, by translating all TCP and UDP flows on the device, between raw sockets (using the VPN service) and layer-4 sockets (over the network interface).
• the aforementioned forwarder module reads from a TUN interface using an event-based mechanism, uses a shared data structure to eliminate string copies;
• the aforementioned forwarder module uses a large MTU to read/write from/to the TUN interface and reads/writes in large chunks from/to the sockets, and matches the sizes between the TUN interface and sockets;
• and
• the forwarder module minimizes the number of threads used (1 thread for reading, 1 for writing and 1 for connection management) and the number of sockets used (1 socket for all TCP connections and 1 socket for all UDP connections).