Chair of Network Architectures and Services Department of Informatics Technical University of Munich Key Performance Indicators of TCP Flows Patryk Brzoza Advisor(s): M.Sc. Simon Bauer Supervisor: Prof. Dr.-Ing. Georg Carle Technical University of Munich (TUM) Department of Informatics Chair of Network Architectures and Services Garching, 06.04.2018
Agenda Introduction Protocol Background KPI Overview Measurement Methods Data Processing Deriving Network Events Conclusion Patryk Brzoza | Key Performance Indicators of TCP Flows 2
Introduction • Studies: 95% of total traffic volume provided by TCP [1] • TCP Flows play crucial role for overall performance How to evaluate this and which metrics are important? Patryk Brzoza | Key Performance Indicators of TCP Flows 3
Protocol Background: Transport Control Protocol (TCP) • Reliable and connection-oriented communication • Connection: two unidirectional flows Patryk Brzoza | Key Performance Indicators of TCP Flows 4
KPI Overview • Performance of TCP constrained by its features Deriving metrics: Key Performance Indicators (KPIs) TCP Flow KPIs Packet Loss Latency Throughput Other Indicators Indicators Indicators Indicators Patryk Brzoza | Key Performance Indicators of TCP Flows 5
KPI Overview: Latency Indicators Temporal quality and responsiveness metrics of flows Round Trip Time (RTT): •Interval between sending segment and receiving acknowledgement Connection Setup Time (CST): •Interval for establishing connection Patryk Brzoza | Key Performance Indicators of TCP Flows 6
KPI Overview: Packet Loss Indicators Patryk Brzoza | Key Performance Indicators of TCP Flows 7
KPI Overview: Throughput Indicators Patryk Brzoza | Key Performance Indicators of TCP Flows 8
KPI Overview: Other Indicators Metrics that do not fit in previous categories Response Time (RT): •Processing time between last packet of response and first packet of request Reset Rate (RT): •Relation of RST segments to overall transmitted segments Patryk Brzoza | Key Performance Indicators of TCP Flows 9
Measurement Methods • Data must be measured first before processing it: Measurement Methods Active Passive Generate probe Capture segments segments from link ✔ ✘ Patryk Brzoza | Key Performance Indicators of TCP Flows 10
Measurement Methods • How many monitors should be set up and at which location? [3] Algorithms can determine good solutions Patryk Brzoza | Key Performance Indicators of TCP Flows 11
Measurement Methods • Possible measurement setup [4]: • Differentiation between bidirectional and unidirectional measurement Patryk Brzoza | Key Performance Indicators of TCP Flows 12
Measurement Methods Bidirectional approach: •Extract KPIs by correlating segments Unidirectional approach: •Determine flow type first [4]: ? Unknown Download Feedback Patryk Brzoza | Key Performance Indicators of TCP Flows 13
Data Processing • Measurements can generate vast amounts of data • Use data mining approaches to reduce it [5]: − Find relationships − Filter out unnecessary packets Patryk Brzoza | Key Performance Indicators of TCP Flows 14
Data Processing: RTT calculation Patryk Brzoza | Key Performance Indicators of TCP Flows 15
Data Processing: RTT calculation Unidirectional measurements: − SYN-based method: determine segment distance depending on flow type − Flight method: group packets by inter-arrival time, measure distance of groups Patryk Brzoza | Key Performance Indicators of TCP Flows 16
Network Event Derivation • KPIs give valuable information for intrusion detection, e.g.: − Throughput spikes: flood-based DoS attacks [5] − High Reset Rate: port scan attacks • Can also expose errors and misconfigurations Patryk Brzoza | Key Performance Indicators of TCP Flows 17
Conclusion • TCP flow performance constrained • Measurable with various classifiable KPIs • Collect data with either active or passive measurements • Reduce data amount with mining approaches • Extract KPIs from bi- or unidirectional measurements • Detect intrusion attacks or network errors using KPIs Patryk Brzoza | Key Performance Indicators of TCP Flows 18
Questions? Thank you for your attention! Any questions? Contact: brzoza@in.tum.de Patryk Brzoza | Key Performance Indicators of TCP Flows 19
Sources [1] Feldmann et al. “Efficient policies for carrying Web traffic over flow- switched networks“ [2] RFC 793. ”Transmission Control Protocol Specification” [3] Chaudet et al. ”Optimal Positioning of Active and Passive Monitoring Devices” [4] Shakkottai et al. ”The RTT Distribution of TCP Flows in the Internet and its Impact on TCP-based Flow Control” [5] Dickerson. ”Fuzzy Network Profiling for Intrusion Detection” [6] Plonka. ”FlowScan: A Network Traffic Flow Reporting and Visualization Tool” Patryk Brzoza | Key Performance Indicators of TCP Flows 20
Recommend
More recommend
