• Proactive routing protocols: For example, OLSR, each node maintains its routing table by periodically updating its information [6]; this increases network overhead. On the other hand, routes will always be available with a minimum delay. Proactive protocols provide better performance than reactive protocols as each node continuously updates its awareness of network changes. When a request is received, the packet forwarding procedure is directly handled.
• Reactive routing protocols: For example, AODV and DSR, when a source node tries to perform a packet transmission, it initiates a route discovery mechanism to know how to reach the destination. After the route is determined and updated in the routing table, the packet is forwarded [7]. Reactive protocols have minimal network overhead, but there is a delay time consumed in the route discovery.
• Hybrid routing protocols: For example, ZRP, the close local neighbors to a node are periodically updated, and the global nodes that are not direct neighbors will be updated on demand such as in reactive routing protocols [8].

• Destination node address;

3. Simulation in MANETs

3.0. Simulation in MANETs

MANET technology is rapidly changing, and new protocols and mechanisms are continuously proposed by researchers. Evaluating a network’s performance under different attacks is important to be able to propose protection mechanisms. Therefore, a cost-effective method that empowers researchers to set up and test MANETs plays a key role in research.

3.1. MANETs Simulators

Simulators are software tools used to create a virtual environment that supports researchers to set up and test a network’s performance under different conditions. Simulators are GUI-driven tools used to set up a network environment and then perform different attacks on the defined network or make comparisons between a standard routing protocol and a newly proposed protocol. Using the defined evaluation metrics, a simulator is also capable of collecting the network’s results and evaluating the overall performance [30].

There is another method for developers to define and test MANETs using testbeds. Testbeds are experimentation in-lab networks that researchers can set up using dedicated hardware sets for this purpose. Testbeds lack the flexibility to define a MANET network, as MANETs are dynamic networks where nodes continuously join and leave the network. Additionally, the cost is much higher than software simulations to define a MANET using testbeds.

To be able to select a suitable simulator, the researchers need to know the simulator’s key features [31]. Table 2 is a comparison between the widely used simulators in MANETs.

• THPT: Throughput is the rate of successfully delivered packets that reached the receiver node per time slot ^[30][43]. Throughput is affected by topology changes, noise on communication links, the power of transmission from the source node, and the existence of malicious nodes affecting the throughput ratio.

• Number of hop counts to reach the destination;
• Intermediate nodes address;
• Route entry expiry time;
• Destination node sequence number.

• Network diameter: The network diameter value sets the maximum number of hop counts between two nodes in MANETs. The network diameter default value is up to thirty-five hops at most as per RFC 3561 standard.

• Node transversal time: The node transversal time is the estimation of packet transversal time between two neighbor nodes; this estimation should consider the network, processing, and transfer delay time. The default configuration time is 40 ms.

[32]. This malicious node would then block the data packets from being forwarded to the destination node. Such malicious activity leads to increasing the loss of important data packets, and it is reducing the network’s overall throughput.

MANETs suffer from malicious activities where malicious nodes tend to impact the routing protocol mechanism. The direct impact of the attacks on routing protocols is to degrade the MANET’s performance. To disrupt the MANET routing protocol, attackers tend to use several techniques such as follows:

1. Routing table overflow attack: In this attack, the attacking node tends to crowd the network by advertising several non-existing nodes to overflow the routing table ^[22]. This prevents legitimate nodes from being aware of network nodes and routing their packets normally.

• Network transversal time: The network transversal time is the expected time between sending the RREQ packet and the reception of the RREP packet as per the equation
• [14]:

3.2. Attacks on MANETs’ Routing Protocols

The MANET’s environment is dynamic, and nodes continuously join and leave. An attacker could easily take a critical location in the network to block data packets from being delivered to the destination node. Moreover, a malicious node might produce a high-power signal that covers a wide range of network nodes to introduce itself as the best routing path to forward the packet between the source node and the destination node

• Routing table overflow attack: In this attack, the attacking node tends to crowd the network by advertising several non-existing nodes to overflow the routing table

• [33]

• . This prevents legitimate nodes from being aware of network nodes and routing their packets normally.

• Flooding attack: In a flooding attack, malicious nodes tend to waste network resources such as memory, bandwidth, and battery by flooding the network with bogus packets [34]. For example, flooding RREQ packets prevents the MANET from functioning normally.
• DDoS attack: In a DDoS attack, attackers tend to keep the targeted legitimate node busy by continuously requesting RREQ messages from collaborative attackers at the same time without respecting the TTL time [35].
• False removal of working route: In this attack, the malicious node advertises a false state of the link with the destination node as if the link is broken. This enforces the source node to re-initiate route discovery protocol to find another path to reach the destination. Additionally, it slows down packet transmission. False removal of working route attack could be used with another collaborative attack to isolate the targeted legitimate node from MANET.
• Node isolation attack: Attackers isolate an innocent node by blocking routing information about this targeted node from the entire network [36]. This leads to an ignorance of the presence of this innocent node.
• Routing table poisoning: In this attack, the attacker sends false RREQ packets with a higher sequence number to force all nodes to delete the old genuine route to a destination and update this route with a corrupted one.
• Blackhole attack: The attacker tends to change the routing protocol packets to be the best route known for a targeted destination, and when it is requested to forward data packets to the destination node, it starts discarding the received packets to slow down the network performance [37].
• Grayhole attack: Grayhole attack is an instance of a blackhole attack where an attacker selectively drops some data packets and normally forwards others [38], or drops all packets but only at a certain time. This makes the attack difficult to detect.
• Wormhole attack: In a wormhole attack, two attacking nodes cooperate where one attacker at a specific location encapsulates some packets and tunnels them to the second attacker, bypassing all intermediate nodes to introduce itself as the fastest route to a destination and then drop the data packets later [39]. It can also be used to replay the received data packets in the other side of the network to disrupt the routing protocol.
• Rushing attack: In a rushing attack, the malicious node sends RREQ messages with high-power transmission to introduce itself as the shortest path to any destination with only one hop count [40], this manipulates all network nodes to use this routing path. The rushing attack is most likely used alongside another attack such as dropping the network packets that need forwarding.

4. Evaluation Metrics and Performance Analysis in MANETs

Figure 45. The different evaluation metrics used in MANETs.