Detecting and Profiling TCP Connections Experiencing Abnormal Performance

  • Aymen Hafsaoui
  • Guillaume Urvoy-Keller
  • Matti Siekkinen
  • Denis Collange
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7189)


We study functionally correct TCP connections – normal set-up, data transfer and tear-down – that experience lower than normal performance in terms of delay and throughput. Several factors, including packet loss or application behavior, may lead to such abnormal performance. We present a methodology to detect TCP connections with such abnormal performance from packet traces recorded at a single vantage point. Our technique decomposes a TCP transfer into periods where: (i) TCP is recovering from losses, (ii) the client or the server are thinking or preparing data, respectively, or (iii) the data is sent but at an abnormally low rate. We apply this methodology to several traces containing traffic from FTTH, ADSL, and Cellular access networks. We discover that regardless of the access technology type, packet loss dramatically degrades performance as TCP is rarely able to rely on Fast Retransmit to recover from losses. However, we also find out that the TCP timeout mechanism has been optimized in Cellular networks as compared to ADSL/FTTH technologies. Concerning loss-free periods, our technique exposes various abnormal performance, some being benign, with no impact on user, e.g., p2p or instant messaging applications, and some that are more critical, e.g., HTTPS sessions.


Server Side Access Technology Congestion Window Abnormal Performance Destination Port 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Vu-Brugier, G.: Analysis of the impact of early fiber access deployment on residential internet traffic. In: 21st International Teletraffic Congress, ITC 21 2009, pp. 1–8 (September 2009)Google Scholar
  2. 2.
    Barford, P., Kline, J., Plonka, D., Ron, A.: A signal analysis of network traffic anomalies. In: Proceedings of the 2nd ACM SIGCOMM Workshop on Internet Measurment, IMW 2002, pp. 71–82. ACM, New York (2002)CrossRefGoogle Scholar
  3. 3.
    Lakhina, A., Crovella, M., Diot, C.: Diagnosing network-wide traffic anomalies. In: ACM SIGCOMM, pp. 219–230 (2004)Google Scholar
  4. 4.
    Soule, A., Salamatian, K., Taft, N.: Combining filtering and statistical methods for anomaly detection. In: Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement, IMC 2005, p. 31. USENIX Association, Berkeley (2005)Google Scholar
  5. 5.
    Tellenbach, B., Burkhart, M., Sornette, D., Maillart, T.: Beyond Shannon: Characterizing Internet Traffic with Generalized Entropy Metrics. In: Moon, S.B., Teixeira, R., Uhlig, S. (eds.) PAM 2009. LNCS, vol. 5448, pp. 239–248. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  6. 6.
    Silveira, F., Diot, C., Taft, N., Govindan, R.: Astute: detecting a different class of traffic anomalies. SIGCOMM Comput. Commun. Rev. 40, 267–278 (2010)CrossRefGoogle Scholar
  7. 7.
    Hafsaoui, A., Collange, D., Urvoy-Keller, G.: Revisiting the Performance of Short TCP Transfers. In: Fratta, L., Schulzrinne, H., Takahashi, Y., Spaniol, O. (eds.) NETWORKING 2009. LNCS, vol. 5550, pp. 260–273. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  8. 8.
    Jaiswal, S., Iannaccone, G., Diot, C., Kurose, J., Towsley, D.: Measurement and classification of out-of-sequence packets in a tier-1 ip backbone. IEEE/ACM Trans. 15(1), 54–66 (2007)CrossRefGoogle Scholar
  9. 9.
    van der Maaten, L.J.P.: t-distributed stochastic neighbor embedding,

Copyright information

© IFIP International Federation for Information Processing 2012

Authors and Affiliations

  • Aymen Hafsaoui
    • 1
  • Guillaume Urvoy-Keller
    • 2
  • Matti Siekkinen
    • 3
  • Denis Collange
    • 4
  1. 1.EurecomFrance
  2. 2.Laboratoire I3S CNRS/UNS UMR 6070France
  3. 3.Aalto UniversityFinland
  4. 4.Orange LabsFrance

Personalised recommendations