Passive, Streaming Inference of TCP Connection Structure for Network Server Management

Authors:
Jeff Terrell;Kevin Jeffay;F. Donelson Smith;Jim Gogan;Joni Keller
Affiliations:
Department of Computer Science,;Department of Computer Science,;Department of Computer Science,;ITS Communication Technologies, University of North Carolina, Chapel Hill NC 27599;ITS Communication Technologies, University of North Carolina, Chapel Hill NC 27599
Venue:
TMA '09 Proceedings of the First International Workshop on Traffic Monitoring and Analysis
Year:
2009

Citing 7
Cited 0

BLT: Bi-layer tracing of HTTP and TCP&slash;IP

Proceedings of the 9th international World Wide Web conference on Computer networks : the international journal of computer and telecommunications netowrking
What TCP/IP protocol headers can tell us about the web

Proceedings of the 2001 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
Tmix: a tool for generating realistic TCP application workloads in ns-2

ACM SIGCOMM Computer Communication Review
Understanding the management of client perceived response time

SIGMETRICS '06/Performance '06 Proceedings of the joint international conference on Measurement and modeling of computer systems
Generation and validation of empirically-derived tcp application workloads

Generation and validation of empirically-derived tcp application workloads
ksniffer: determining the remote client perceived response time from live packet streams

OSDI'04 Proceedings of the 6th conference on Symposium on Opearting Systems Design & Implementation - Volume 6
Compact appearance in object populations using quantile function based distribution families

Compact appearance in object populations using quantile function based distribution families

Quantified Score

Hi-index	0.00

Visualization

Abstract

We have developed a means of understanding the performance of servers in a network based on a real-time analysis of passively measured network traffic. TCP and IP headers are continuously collected and processed in a streaming fashion to first reveal the application-layer structure of all client/server dialogs ongoing in the network. Next, the representation of these dialogs are further processed to extract performance data such as response times of request-response exchanges for all servers. These data are then compared against archived historical distributions for each server to detect performance anomalies. Once found, these anomalies can be reported to server administrators for investigation. Our method uncovers nontrivial performance anomalies in arbitrary servers with no instrumentation of the server nor even knowledge of the server's function or configuration. Moreover, the entire process is completely transparent to servers and clients. We present the design of the tools used to perform this analysis, as well as a case study of the use of this method to uncover a significant performance anomaly in a UNC web portal.