Building a Low-cost Network Digital Twin for the IoT-Edge-Cloud Continuum Using Open-Source Tooling

Source: arXiv:2606.24853 · Published 2026-06-23 · By Josevany do Amaral, Rute C. Sofia

TL;DR

This paper tackles the operational challenge of validating network configurations and testing failure scenarios in heterogenous IoT-edge-cloud environments without risking live infrastructure. It presents a low-cost, fully open-source Network Digital Twin (NDT) tailored for IIoT edge deployments, leveraging Containerlab for container-native topology emulation, Open vSwitch for virtual switching, ONOS for SDN-based programmable control, and a Prometheus+Grafana stack for real-time observability. The NDT integrates Wi-Fi impairment profiles calibrated from empirical measurements to emulate wireless channel conditions faithfully. Validation against a realistic physical Raspberry Pi-based Wi-Fi edge testbed from the fortiss IIoT Labs demonstrates strong fidelity convergence for key metrics like median RTT (difference of 0.4 ms) and UDP throughput (0.03 Mbps difference). However, notable divergences in TCP throughput and packet loss arise due to virtualization artifacts related to token bucket shaping and probabilistic loss modeling. The authors identify root causes and propose mitigation strategies, thus delivering a reusable open research platform that also serves as a teaching artifact.

Key findings

• NDT median RTT differs from physical testbed by only +0.4 ms across 12,149 physical vs. 890 NDT samples (Table V).
• UDP throughput aligns closely: physical mean 7.12 Mbps vs. NDT mean 7.15 Mbps (∆= +0.03 Mbps) over 613 vs. 65 sessions.
• TCP throughput shows a notable gap attributable to MSS (max segment size) constraint: NDT mean 3.68 Mbps vs. physical 9.19 Mbps (−5.51 Mbps delta).
• ONOS-driven SDN traffic engineering reroutes degraded paths within <1 second, improving throughput from ~330 Mbps to ~9.5 Gbps with zero packet loss (Table VIII).
• Wi-Fi impairment profiles (Baseline, Open, Typical, Congested) induce expected monotonic degradation in RTT, jitter, throughput, and loss (Table IX).
• The Containerlab/OVS environment exhibits a Token Bucket Filter starvation artifact under default iPerf3 MTU=1500 fragmentation, causing TCP throughput collapse; mitigated by reducing MSS to 500 bytes.
• Packet loss distributions mismatch structurally: physical loss bimodal with some zero-loss sessions, NDT loss modeled probabilistically always >0%, leading to higher mean packet loss in NDT (15% vs. 8.5%).
• NDT RTT minima cluster higher (~20–26 ms) than physical (~2 ms) due to persistent internal OVS latency and dual netem delay application.

Threat model

The adversary model is centered on the need to validate network behaviors and failure scenarios without impacting production networks, rather than active attacks or intrusion. The NDT aims to provide a safe sandbox for experimentation mimicking the complex, heterogeneous IoT-edge-cloud environment. There is no adversary trying to evade detection or exploit vulnerabilities; rather, the threat is operational risk from changes or failures in live settings. The attacker cannot alter the physical network while tests run, nor bypass SDN control or telemetry systems.

Methodology — deep read

The authors define a threat model targeting safe validation of IoT-edge-cloud network setups without physical disruption; no active adversarial attacks considered. The experiments emulate a six-node Raspberry Pi edge cluster connected via Wi-Fi to an access point, representing an IIoT edge environment (CODECO testbed). The physical dataset includes nine days of measurements (May 19-27, 2026) with 14,665 filtered quality data points. The NDT is created with Containerlab using a YAML manifest replicating the physical topology, mapping IP addresses 1:1 to enable unified monitoring and commands. Open vSwitch bridges replace Linux kernel bridges at the AP container node. SDN control plane uses ONOS v2.7 for shortest-path routing and intent-driven traffic engineering; control via OpenFlow 1.3. The observability stack is Prometheus scraping Node Exporter agents every 15s on all nodes (physical and NDT), with Grafana dashboards enabling side-by-side comparisons. Wireless channel impairments are injected at the AP container interfaces using Linux traffic control (tc) netem for delay, jitter, and loss, combined with a Token Bucket Filter for bandwidth shaping. Four impairment profiles (Baseline, Open, Typical, Congested) were parameterized empirically from the physical setup. Importantly, the authors document and mitigate a discovered TBF token starvation artifact characterized as excessive packet drops when iPerf3 transmits MTU-sized bursts. This requires constraining iPerf3 segment sizes to 500 bytes, impacting TCP throughput fidelity. The evaluation includes five experiments: (E1) baseline NDT forwarding performance without impairments; (E2) Wi-Fi congestion impact on TCP/UDP flows; (E3) SDN path rerouting under artificial link delay; (E4) Digital Twin validation comparing distributions of key metrics over long-term archives and short 10-run controlled sessions; and (E5) SDN-driven traffic prioritization enforcing QoS between high- and low-priority flows. Data quality filtering removed corrupted or inconsistent iPerf3 results from both physical and NDT datasets. Cross-validation consisted of direct side-by-side metric comparisons, aggregate statistics (means, medians, deltas), and verification of reproducibility of impairments and responses under controlled conditions. Limitations include shorter NDT dataset duration and lack of temporal overlap with physical data, which limits variability testing; also, the static netem impairment profiles do not capture highly bursty wireless loss patterns. The full toolchain is open-source, though raw iPerf3 logs were not retained, preventing detailed packet-level reanalysis.

Technical innovations

• Combining container-native topology emulation (Containerlab) with programmable SDN control (ONOS) and live telemetry (Prometheus/Grafana) in a unified low-cost NDT for IIoT edge scenarios.
• Empirically calibrated Wi-Fi impairment profiles integrated via reusable tc netem + Token Bucket Filter scripting for accurate channel emulation.
• Identification and mitigation of Token Bucket Filter segment starvation artifact caused by default large iPerf3 MTU bursts in containerized OVS environments using MSS reduction.
• Dynamic ONOS SDN intent-based traffic engineering enabling sub-second path rerouting driven by link degradations.
• Side-by-side real-vs-emulated node metrics mapping using unified IP address space and scraping setup.

Datasets

• CODECO physical IIoT edge testbed — 14,665 measurement rows — Multi-day Wi-Fi connected Raspberry Pi cluster
• NDT emulation dataset — 1,113 measurement rows — Containerlab-based virtual replica of CODECO testbed

Baselines vs proposed

• Physical testbed TCP throughput mean = 9.19 Mbps vs. NDT TCP throughput mean = 3.68 Mbps
• Physical testbed UDP throughput mean = 7.12 Mbps vs. NDT UDP throughput mean = 7.15 Mbps
• Physical testbed median RTT = 22.3 ms vs. NDT median RTT = 22.7 ms
• Baseline NDT (E1) TCP throughput = ~2.01 Gbps vs. congested profile TCP throughput (E2) = 471 Kbps
• SDN degraded path throughput = ~330 Mbps vs. SDN rerouted path throughput = ~9.5 Gbps (E3)
• Packet loss mean physical = 8.49% vs. NDT mean loss = 15.04%

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2606.24853.

Fig 1: NDT three-plane architecture and component interactions.

Fig 2: Reference network.

Limitations

• NDT TCP throughput underestimates physical TCP throughput due to required MSS=500 byte constraint for TBF mitigation.
• Packet loss model in NDT is fixed probabilistic (Gilbert-Elliott) and does not reproduce bursty, bimodal real wireless loss patterns, causing structural mismatch.
• NDT RTT minima are higher than physical due to OVS internal delay and symmetric netem delay application, creating a stable baseline offset.
• NDT measurement dataset spans only 2 days vs. 9 days for physical testbed — limits ability to characterize temporal variability or time-of-day effects.
• No temporal overlap between physical and NDT data collection periods prevents aligned session-level comparison.
• Static netem impairment profiles do not capture highly volatile Wi-Fi spike latency events evidenced in physical data.
• Raw iPerf3 logs were not retained, impairing ability to fully diagnose some anomalous throughput artifacts.

Open questions / follow-ons

• How to implement stochastic or trace-driven wireless impairment models that better capture spike latency and bursty loss seen in real Wi-Fi wireless channels?
• Can advanced Linux shaping disciplines such as HTB or HFSC replace TBF to avoid the MSS constraint that limits TCP throughput fidelity?
• What mechanisms enable federated digital twinning across multiple administrative domains and dynamic recalibration of impairment profiles in real time?
• How to integrate the NDT framework with lightweight Kubernetes CNI overlays while resolving flow rule conflicts between ONOS and CNI iptables?

Why it matters for bot defense

For bot-defense and CAPTCHA engineers, the paper’s approach to building high-fidelity, reproducible network digital twins in resource-constrained edge environments offers insights relevant for security testing of distributed authentication infrastructures and telemetry systems. Its emphasis on programmable SDN control with real-time telemetry enables controlled failure injection and traffic prioritization, techniques that could be adapted to stress-test CAPTCHA detection pipelines or bot mitigations under network impairment scenarios. The documented virtualization artifacts and mitigation strategies highlight key pitfalls in container-based network emulations that practitioners should be aware of to avoid misestimating network conditions during bot-defense evaluations. Moreover, the open-source, container-native approach lowers deployment cost and complexity for research labs studying edge network behaviors impacting bot traffic analysis.

Cite

@article{arxiv2606_24853,
  title={ Building a Low-cost Network Digital Twin for the IoT-Edge-Cloud Continuum Using Open-Source Tooling },
  author={ Josevany do Amaral and Rute C. Sofia },
  journal={arXiv preprint arXiv:2606.24853},
  year={ 2026 },
  url={https://arxiv.org/abs/2606.24853}
}

Read the full paper

• arXiv:2606.24853 (abstract)
• arXiv:2606.24853 (PDF)