Abstract
In both active and passive network Internet measurements, the IP packet has a number of important header fields that have played key roles in past measurement efforts, e.g., IP source/destination address, protocol, TTL, port, and sequence number/acknowledgment. The 16-bit identification field (IPID) has only recently been studied to determine what information it might yield for network measurement and performance characterization purposes. We explore several new uses of the IPID field, including how it can be used to infer: (a) the amount of internal (local) traffic generated by a server; (b) the number of servers in a large-scale, load-balanced server complex and; (c) the difference between one-way delays of two machines to a target computer. We illustrate and validate the use of these techniques through empirical measurement studies.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
List of the fortune 500, http://www.usatoday.com/money/companies/2004-03-22-fortune-500-list_x.htm
Top 101 wet sites: Fall, asp (2004), http://www.pcmag.com/category2/0,1738,7488,00.asp
Bellovin, S.: A technique for counting NATed hosts. In: Proc. ACM Internet Measurement Workshop(IMW) (November 2002)
Coates, M., Nowak, R.: Network tomography for internal delay estimation. In: Proc. IEEE International Conference on Acoustics, Speech and Signal Processing (May 2001)
Lo Presti, F., Duffield, N., Horowitz, J., Towsley, D.: Multicast-based inference of network-internal delay distributions. IEEE/ACM Trans. Networking 10, 761–775 (2002)
Hussain, A., Heidemann, J., Papadopoulos, C.: A framework for classifying denial of service attacks. In: Proc. ACM SIGCOMM (August 2003)
Insecure.org. Idle scanning and related IPID games, http://www.insecure.org/nmap/idlescan.html
Jaiswal, S., Iannaccone, G., Diot, C., Kurose, J., Towsley, D.: Measurement and classification of out-of-sequence packets in a tier-1 IP backbone. In: Proc. IEEE INFOCOM (April 2003)
Mahajan, R., Spring, N., Wetherall, D., Anderson, T.: User-level internet path diagnosis. In: Proc. ACM Symp. on Operating Systems Principles (SOSP) (October 2003)
Rabbat, M., Coates, M., Nowak, R.: Multiple source, multiple destination network tomography. In: Proc. IEEE INFOCOM (March 2004)
Spring, N., Mahajan, R., Wetherall, D.: Measuring ISP topologies with Rocketfuel. In: Proc. ACM SIGCOMM (August 2002)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Chen, W. et al. (2005). Exploiting the IPID Field to Infer Network Path and End-System Characteristics. In: Dovrolis, C. (eds) Passive and Active Network Measurement. PAM 2005. Lecture Notes in Computer Science, vol 3431. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-31966-5_9
Download citation
DOI: https://doi.org/10.1007/978-3-540-31966-5_9
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-25520-8
Online ISBN: 978-3-540-31966-5
eBook Packages: Computer ScienceComputer Science (R0)