• Proactive routing protocols: For example, OLSR, each node maintains its routing table by periodically updating its information [6]; this increases network overhead. On the other hand, routes will always be available with a minimum delay. Proactive protocols provide better performance than reactive protocols as each node continuously updates its awareness of network changes. When a request is received, the packet forwarding procedure is directly handled.
• Reactive routing protocols: For example, AODV and DSR, when a source node tries to perform a packet transmission, it initiates a route discovery mechanism to know how to reach the destination. After the route is determined and updated in the routing table, the packet is forwarded [7]. Reactive protocols have minimal network overhead, but there is a delay time consumed in the route discovery.
• Hybrid routing protocols: For example, ZRP, the close local neighbors to a node are periodically updated, and the global nodes that are not direct neighbors will be updated on demand such as in reactive routing protocols [8].

• Destination node address;
• Number of hop counts to reach the destination;
• Intermediate nodes address;
• Route entry expiry time;
• Destination node sequence number.

• Network diameter: The network diameter value sets the maximum number of hop counts between two nodes in MANETs. The network diameter default value is up to thirty-five hops at most as per RFC 3561 standard.
• Node transversal time: The node transversal time is the estimation of packet transversal time between two neighbor nodes; this estimation should consider the network, processing, and transfer delay time. The default configuration time is 40 ms.
• Network transversal time: The network transversal time is the expected time between sending the RREQ packet and the reception of the RREP packet as per the equation [14]:

• Discovery hop limit: The discovery hop limit value is defined as the limit to the route request re-broadcast. If the first attempt of RREQ does not reach the destination node, the default value of the discovery hop limit is 255 hops, and the minimum value is one hop.
• Broadcast jitter: The destination node should delay the RREP message by a random value that does not exceed the broadcast jitter’s maximum delay time. The broadcast jitter default value is ten milliseconds.

• THPT: Throughput is the rate of successfully delivered packets that reached the receiver node per time slot [43]. Throughput is affected by topology changes, noise on communication links, the power of transmission from the source node, and the existence of malicious nodes affecting the throughput ratio.
• AETED: Average end-to-end delay is the average time taken to send a packet to the destination node [44]. This delay is due to many reasons such as route discovery queuing and process latency, delays caused by wireless links, and processing delays at both the sender and the receiver sides.
• Route cache timeout: The route cache timeout is associated with each route entry in the cache [23]. When the timeout is reached, this means that the related route is not used and needs to be deleted from the node’s cache. Route cache timeout default value is three hundred milliseconds.
• PDR: Packet delivery ratio is the ratio of packets that are received by the destination across the overall transmitted packets from the source node [45]. The packet delivery ratio represents the maximum throughput that can be achieved by the MANET network.
  Send buffer timeout: When a packet cannot be transmitted to the next-hop node, this packet is queued inside a buffer to try sending it when possible. Send buffer timeout is the maximum time associated with a packet to be sent before being removed from the send buffer. The default value for send buffer timeout is 30 s.
• Max request period: After a route discovery attempt fails to find a route to the destination node, the time between successive route discovery attempts doubles until the maximum request period is reached. The default value for the maximum request period time is 10 s.
• Re-transmit buffer size: Re-transmit buffer holds the maximum number of packets waiting for the next-hop reachability confirmation. If the buffer is not sufficient to keep the new packet, this packet is discarded without notification. The re-transmit buffer size defines the buffer size with a default value of 50 packets.
• Max maintenance re-transmission: The maximum number of re-transmissions for a packet waiting for a confirmation from the next hop should be limited by the configuration value of the max maintenance re-transmission parameter. The default value is only two transmissions.

3.0. Simulation in MANETs

MANET technology is rapidly changing, and new protocols and mechanisms are continuously proposed by researchers. Evaluating a network’s performance under different attacks is important to be able to propose protection mechanisms. Therefore, a cost-effective method that empowers researchers to set up and test MANETs plays a key role in research.

3.1. MANETs Simulators

Simulators are software tools used to create a virtual environment that supports researchers to set up and test a network’s performance under different conditions. Simulators are GUI-driven tools used to set up a network environment and then perform different attacks on the defined network or make comparisons between a standard routing protocol and a newly proposed protocol. Using the defined evaluation metrics, a simulator is also capable of collecting the network’s results and evaluating the overall performance [30].

There is another method for developers to define and test MANETs using testbeds. Testbeds are experimentation in-lab networks that researchers can set up using dedicated hardware sets for this purpose. Testbeds lack the flexibility to define a MANET network, as MANETs are dynamic networks where nodes continuously join and leave the network. Additionally, the cost is much higher than software simulations to define a MANET using testbeds.

To be able to select a suitable simulator, the researchers need to know the simulator’s key features [31]. Table 2 is a comparison between the widely used simulators in MANETs.

Table 2. Comparison between simulation tools in MANETs.

• PLR: The packet loss ratio is the opposite of PDR; PLR measures the total lost packets that did not reach the destination node across the overall transmitted packets [
• 46
• ].
• ROR: Routing overhead ratio is the size of control and header packets needed by the protocol for route discovery and maintenance over the total data packets received by the destination node [47].
• NRL: Normalized routing load is the ratio between the total number of control packets sent by a source node over the total number of data packets received by a destination node [48]. An increase in normalized routing load metric indicates the efficiency of the used routing protocol.
• NL: The network load is the average amount of data packets that are being carried by the entire network over time [49]. Increasing the network load ratio increases the possibility of data collision in the wireless medium.

• source node identifier;
• destination node identifier;
• route request identifier;
• record listing the address of all intermediate nodes.

3.2. Attacks on MANETs’ Routing Protocols

The MANET’s environment is dynamic, and nodes continuously join and leave. An attacker could easily take a critical location in the network to block data packets from being delivered to the destination node. Moreover, a malicious node might produce a high-power signal that covers a wide range of network nodes to introduce itself as the best routing path to forward the packet between the source node and the destination node [32]. This malicious node would then block the data packets from being forwarded to the destination node. Such malicious activity leads to increasing the loss of important data packets, and it is reducing the network’s overall throughput.

MANETs suffer from malicious activities where malicious nodes tend to impact the routing protocol mechanism. The direct impact of the attacks on routing protocols is to degrade the MANET’s performance. To disrupt the MANET routing protocol, attackers tend to use several techniques such as follows:

• Routing table overflow attack: In this attack, the attacking node tends to crowd the network by advertising several non-existing nodes to overflow the routing table [33]. This prevents legitimate nodes from being aware of network nodes and routing their packets normally.
• Flooding attack: In a flooding attack, malicious nodes tend to waste network resources such as memory, bandwidth, and battery by flooding the network with bogus packets [34]. For example, flooding RREQ packets prevents the MANET from functioning normally.
• DDoS attack: In a DDoS attack, attackers tend to keep the targeted legitimate node busy by continuously requesting RREQ messages from collaborative attackers at the same time without respecting the TTL time [35].
• False removal of working route: In this attack, the malicious node advertises a false state of the link with the destination node as if the link is broken. This enforces the source node to re-initiate route discovery protocol to find another path to reach the destination. Additionally, it slows down packet transmission. False removal of working route attack could be used with another collaborative attack to isolate the targeted legitimate node from MANET.
• Node isolation attack: Attackers isolate an innocent node by blocking routing information about this targeted node from the entire network [36]. This leads to an ignorance of the presence of this innocent node.
• Routing table poisoning: In this attack, the attacker sends false RREQ packets with a higher sequence number to force all nodes to delete the old genuine route to a destination and update this route with a corrupted one.
• Blackhole attack: The attacker tends to change the routing protocol packets to be the best route known for a targeted destination, and when it is requested to forward data packets to the destination node, it starts discarding the received packets to slow down the network performance [37].
• Grayhole attack: Grayhole attack is an instance of a blackhole attack where an attacker selectively drops some data packets and normally forwards others [38], or drops all packets but only at a certain time. This makes the attack difficult to detect.
• Wormhole attack: In a wormhole attack, two attacking nodes cooperate where one attacker at a specific location encapsulates some packets and tunnels them to the second attacker, bypassing all intermediate nodes to introduce itself as the fastest route to a destination and then drop the data packets later [39]. It can also be used to replay the received data packets in the other side of the network to disrupt the routing protocol.
• Rushing attack: In a rushing attack, the malicious node sends RREQ messages with high-power transmission to introduce itself as the shortest path to any destination with only one hop count [40], this manipulates all network nodes to use this routing path. The rushing attack is most likely used alongside another attack such as dropping the network packets that need forwarding.

4. Evaluation Metrics and Performance Analysis in MANETs

Figure 5. The different evaluation metrics used in MANETs.