Measuring IP and TCP behavior on edge nodes

Tstat [1] is a new tool for the collection and statistical analysis of TCP/IP traffic, able to infer TCP connection status from traces. Discussing its use, we present some of the performance figures that can be obtained and the insight that such figures can give on TCP/IP protocols and the Internet. While standard performance measure, such as flow dimensions, traffic distribution, etc., remain at the base of traffic evaluation, more sophisticated indices, like the out-of-order probability and gap dimension in TCP connections, obtained through data correlation between the incoming and outgoing traffic, give reliable estimates of the network performance also from the user perspective. Several of these indices are discussed on traffic measures performed for more than 2 months on the access link of our institution. I. TRAFFIC MEASURES IN THE INTERNET Planning and dimensioning of telecom networks is traditionally based on traffic measurements, upon which estimates and mathematical models are built. While this process proved to be reasonably simple in traditional, circuit switched, networks, it seems to be much harder in packet switched IP based networks, where the TCP/IP client-server communication paradigm introduces correlation both in space and time. While a large part of this difficulty lies in the failure of traditional modeling paradigms [2], [3], there are also several key points to be solved in performing the measures themselves and, most of all, in organizing the enormous amount of data that are collected through measures. First of all, the client-server communication paradigm implies that the traffic behavior does have meaning only when the forward and backward traffic are jointly analyzed, otherwise half of the story goes unwritten, and should be wearingly inferred (with high risk of making mistakes!). This problem makes measuring inherently difficult; it can be solved if measures are taken on the network edge, where the outgoing and incoming flows are necessarily coupled, but it can prove impossible in the backbone, where the peering contracts among providers often disjoint the forward and backward routes [4]. Second, data traffic must be characterized to a higher level of detail than voice traffic, since the ‘always-on’ characteristics of most sources and the nature itself of packet switching require the collections of data at the session, flow, and packet level, while circuit switched traffic is well characterized by the connection level alone. Summarizing, the layered structure of the TCP/IP protocol suite, requires the analysis of traffic at least at the IP, TCP/UDP, and Application level in order to have a picture of the traffic clear enough to allow the interpretation of data. We are interested in passive tools which analyze traces rather than active tools that derive performance indices injecting traffic in the network, like for example the classic ping or traceroute utilities. Among passive tools, many are based on the This work was supported by the Italian Ministry for University and Scientific Research through the PLANET-IP Project. libpcap library developed with the tcpdump tool [5], [6], that allow different protocol level analysis. However, none of the tools are able to derive statistical data collection and post-elaboration. Thus, to the best of our knowledge, this paper presents two different contributions in the field of Internet traffic measures. A new tool, briefly described in Sect. II, for gathering and elaborating Internet measurements has been developed and made available to the community. The description of the most interesting results of traffic analysis performed with the above tool, discussing their implication on the network, at both the IP level in Sect. IV, and the TCP level in Sect. V. In the remaining of the paper we assume that the reader is familiar with the Internet terminology, that can be found in [7], [8], [9] for example.