TStat: TCP STatistic and Analysis Tool

Internet traffic analysis is one of the core topics of research in the evolution and planning of the next generation integrated networks. In spite of this fact, standard, open source tools for the collection and, most of all, the elaboration of traffic data are very few and far from comprehensive and easy to use. This paper present a new tool named Tstat, that allows the collection of traffic data and is able to reconstruct the traffic characteristics at several different logical level, from the packet level up to the application level. Tstat is made available to the scientific and industrial community [1] and, as of today, offer more than 80 different types of measurements, starting from classical traffic volume measurements, up to sophisticated analysis regarding the round trip times measured by TCP or the loss probability and correlation of each flow.One of the key characteristics of Tstat is that, though it is capable of analyzing the traffic at the flow level, it is an entirely passive tool, that does not alter in any way the traffic pattern at the network interface where its data collection module is installed.

[1]  Dong Lin,et al.  IP packet generation: statistical models for TCP start times based on connection-rate superposition , 2000, SIGMETRICS '00.

[2]  Bogdan M. Wilamowski,et al.  The Transmission Control Protocol , 2005, The Industrial Information Technology Handbook.

[3]  Deborah Estrin,et al.  An Empirical Workload Model for Driving Wide-Area TCP/IP Network Simulations , 2001 .

[4]  Vern Paxson,et al.  Empirically derived analytic models of wide-area TCP connections , 1994, TNET.

[5]  Michael J. Feeley,et al.  The Measured Access Characteristics of World-Wide-Web Client Proxy Caches , 1997, USENIX Symposium on Internet Technologies and Systems.

[6]  Peter B. Danzig,et al.  tcplib: A Library of TCP Internetwork Traffic Characteristics , 2002 .

[7]  Sally Floyd,et al.  Wide area traffic: the failure of Poisson modeling , 1995, TNET.

[8]  Kevin Jeffay,et al.  What TCP/IP protocol headers can tell us about the web , 2001, SIGMETRICS '01.

[9]  Vern Paxson,et al.  End-to-end routing behavior in the Internet , 1996, TNET.

[10]  Luca Deri,et al.  Effective traffic measurement using ntop , 2000 .

[11]  Bruce A. Mah,et al.  An empirical model of HTTP network traffic , 1997, Proceedings of INFOCOM '97.

[12]  Sally Floyd,et al.  On inferring TCP behavior , 2001, SIGCOMM 2001.

[13]  Azer Bestavros,et al.  Self-similarity in World Wide Web traffic: evidence and possible causes , 1997, TNET.

[14]  尾家 祐二,et al.  IEEE INFOCOM '97 , 1997 .

[15]  Srinivasan Seshan,et al.  TCP behavior of a busy Internet server: analysis and improvements , 1997, Proceedings. IEEE INFOCOM '98, the Conference on Computer Communications. Seventeenth Annual Joint Conference of the IEEE Computer and Communications Societies. Gateway to the 21st Century (Cat. No.98.

[16]  Sally Floyd,et al.  TCP Selective Acknowledgement Options , 1996 .

[17]  Mark Crovella,et al.  Self - similarity in World Wide Web: Evidence and possible causes , 1997 .

[18]  Nick McKeown,et al.  Monitoring very high speed links , 2001, IMW '01.

[19]  Li Fan,et al.  Summary cache: a scalable wide-area Web cache sharing protocol , 1998, SIGCOMM '98.

[20]  Anja Feldmann,et al.  Performance of Web proxy caching in heterogeneous bandwidth environments , 1999, IEEE INFOCOM '99. Conference on Computer Communications. Proceedings. Eighteenth Annual Joint Conference of the IEEE Computer and Communications Societies. The Future is Now (Cat. No.99CH36320).

[21]  Peter B. Danzig,et al.  Characteristics of wide-area TCP/IP conversations , 1991, SIGCOMM 1991.