Passive analysis of TCP anomalies
详细信息 查看全文
- 作者：Marco Mellia ; Michela Meo ; Luca Muscariello ; Dario Rossi
- 关键词：Traffic measurements ; TCP
- 刊名：Computer Networks
- 出版年：2008
- 出版时间：9 October 2008
- 年：2008
- 卷：52
- 期：14
- 页码：2663-2676
- 全文大小：551 K
文摘
In this paper, we focus on passive measurements of TCP traffic. We propose a heuristic technique to classify TCP anomalies, i.e., segments that have a sequence number different from the expected one, such as out-of-sequence and duplicate segments. Since TCP is a closed-loop protocol that infers network conditions from packet losses and reacts accordingly, the possibility of carefully distinguishing the causes of anomalies in TCP traffic is very appealing and may be instrumental to understand TCP behavior in real environments. We apply the proposed heuristic to traffic traces collected at both network edges and backbone links. By comparing results obtained from traces collected over several years, we observe some phenomena such as the impact of the introduction of TCP SACK which reduces the unnecessary retransmissions, the large percentage of network reordering, etc. By further studying the statistical properties of TCP anomalies, we find that, while their aggregate exhibits long-range dependence, anomalies suffered by individual long-lived flows are on the contrary uncorrelated. Interestingly, no dependence on the actual link load is observed.