Round trip time (RTT) measurement based upon sequence number
Systems, methods, and computer-readable media are provided for determining a packet's round trip time (RTT) in a network. A system can receive information of a packet sent by a component of the network and further determine an expected acknowledgement (ACK) sequence number associated with the packet based upon received information of the packet. The system can receive information of a subsequent packet received by the component and determine an ACK sequence number and a receiving time of the subsequent packet. In response to determining that the ACK sequence number of the subsequent TCP packet matches the expected ACK sequence number, the system can determine a round trip time (RTT) of the packet based upon the received information of the packet and the received information of the subsequent packet.
1. A method comprising:
receiving, from a sensor of a plurality of sensors in a network, information of a first packet sent by a component of the network, the plurality of sensors configured to sense information of data packets moving through the network;
analyzing the information of the first packet to determine an expected acknowledgement (ACK) sequence number associated with the first packet;
receiving information of a following packet received by the component;
analyzing the information of the following packet to determine an ACK sequence number of the following packet;
determining that the ACK sequence number of the following packet matches the expected ACK sequence number;
determining a round trip time (RTT) of the first packet based upon the information of the first packet and the information of the following packet;
receiving, from the plurality of sensors, information of transmission control protocol (TCP) hand-shakes of the network within a specific time period; and
determining a number of re-transmission packets and new packets during the specific time period based upon the information of TCP hand-shakes.
2. The method of claim 1 , further comprising:
determining a sending time, a packet sequence number and a packet size of the first packet based upon the information of the first packet,
wherein the expected ACK sequence number associated with the first packet is determined based upon the packet sequence number and the packet size of the first packet.
3. The method of claim 2 , further comprising:
analyzing the information of the following packet to determine a receiving time of the following packet,
wherein the RTT of the first packet is determined based upon the sending time of the first packet and the receiving time of the following packet.
4. The method of claim 1 , further comprising:
determining that the ACK sequence number of the following packet does not match the expected ACK sequence number;
ignoring the following packet; and
receiving information of a next packet received by the component.
5. The method of claim 4 , further comprising:
analyzing the information of the next packet to determine an ACK sequence number of the next packet received by the component; and
determining that the ACK sequence number of the next packet matches the expected ACK sequence number,
wherein the RTT of the first packet is determined based upon the information of the first packet and the information of the next packet.
6. The method of claim 4 , further comprising:
analyzing the information of the next packet to determine an ACK sequence number of the next packet received by the component;
determining that the ACK sequence number of the next packet does not match the expected ACK sequence number; and
generating a warning report to indicate a potential attack.
7. The method of claim 1 , further comprising:
determining a congestion level of the network based at least upon the RTT of the first packet.
8. The method of claim 1 , further comprising:
determining a number of non-duplicative packets associated with the TCP hand-shakes based upon the information of TCP hand-shakes; and
determining a packet loss rate of the network during the specific time period based upon the number of non-duplicative packets and the number of re-transmission packets and new packets.
9. The method of claim 1 , further comprising:
selecting a range of packet sequence numbers for a specific network analysis;
determining a packet sequence number of the first packet based upon the information of the first packet; and
determining that the packet sequence number of the first packet is within the range of packet sequence numbers.
10. The method of claim 9 , further comprising:
receiving information of an additional packet from the plurality of sensors;
determining a packet sequence number of the additional packet based upon the information of the additional packet;
determining that the packet sequence number of the additional packet is not within the range of packet sequence numbers; and
ignoring the additional packet in the specific network analysis.
11. A system comprising:
a processor; and
a computer-readable storage medium storing instructions which, when executed by the processor, cause the system to perform operations comprising:
receiving, from a sensor of a plurality of sensors in a network, information of a first packet sent by a component of the network, the plurality of sensors configured to sense information of data packets moving through the network;
analyzing the information of the first packet to determine an expected acknowledgement (ACK) sequence number associated with the first packet;
receiving information of a following packet received by the component;
analyzing the information of the following packet to determine an ACK sequence number of the following packet;
determining that the ACK sequence number of the following packet matches the expected ACK sequence number;
determining a round trip time (RTT) of the first packet based upon the information of the first packet and the information of the following packet;
receiving, from the plurality of sensors, information of transmission control protocol (TOP) hand-shakes of the network within a specific time period; and
determining a number of re-transmission packets and new packets during the specific time period based upon the information of TOP hand-shakes.
12. The system of claim 11 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
determining a sending time, a packet sequence number and a packet size of the first packet based upon the information of the first packet,
wherein the expected ACK sequence number associated with the first packet is determined based upon the packet sequence number and the packet size of the first packet.
13. The system of claim 12 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
analyzing the information of the following packet to determine a receiving time of the following packet,
wherein the RTT of the first packet is determined based upon the sending time of the first packet and the receiving time of the following packet.
14. The system of claim 11 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
determining that the ACK sequence number of the following packet does not match the expected ACK sequence number;
ignoring the following packet; and
receiving information of a next packet received by the component.
15. The system of claim 14 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
analyzing the information of the next packet to determine an ACK sequence number of the next packet received by the component; and
determining that the ACK sequence number of the next packet matches the expected ACK sequence number,
wherein the RTT of the first packet is determined based upon the information of the first packet and the information of the next packet.
16. The system of claim 14 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
analyzing the information of the next packet to determine an ACK sequence number of the next packet received by the component;
determining that the ACK sequence number of the next packet does not match the expected ACK sequence number; and
generating a warning report to indicate a potential attack.
17. The system of claim 11 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
determining a number of non-duplicative packets associated with the TCP hand-shakes based upon the information of TCP hand-shakes; and
determining a packet loss rate of the network during the specific time period based upon the number of non-duplicative packets and the number of re-transmission packets and new packets.
18. The system of claim 11 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
selecting a range of packet sequence numbers for a specific network analysis;
determining a packet sequence number of the first packet based upon the information of the first packet; and
determining that the packet sequence number is within the range of packet sequence numbers.
19. The system of claim 18 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
receiving information of an additional packet from the plurality of sensors;
determining a packet sequence number of the additional packet based upon the information of the additional packet;
determining that the packet sequence number of the additional packet is not within the range of packet sequence numbers; and
ignoring the additional packet in the specific network analysis.
20. A non-transitory computer-readable storage medium storing instructions for determining a first packet's round trip time (RTT) in a network, that, when executed by at least one processor of a computing system, cause the computing system to perform operations comprising:
receiving, from a sensor of a plurality of sensors in the network, information of the first packet sent by a component of the network, the plurality of sensors configured to sense information of data packets moving through the network;
analyzing the information of the first packet to determine an expected acknowledgement (ACK) sequence number associated with the first packet;
receiving information of a following packet received by the component;
analyzing the information of the following packet to determine an ACK sequence number of the following packet;
determining that the ACK sequence number of the following packet matches the expected ACK sequence number;
determining a round trip time (RTT) of the first packet based upon the information of the first packet and the information of the following packet;
receiving, from the plurality of sensors, information of transmission control protocol (TOP) hand-shakes of the network within a specific time period; and
determining a number of re-transmission packets and new packets during the specific time period based upon the information of TCP hand-shakes.