Round trip time (rtt) measurement based upon sequence number

Patent metadata

Field	Value
Publication number	US-2016359712-A1
Application number	US-201615170837-A
Country	US
Kind code	A1
Filing date	Jun 1, 2016
Priority date	Jun 5, 2015
Publication date	Dec 8, 2016
Grant date	—

Abstract

Systems, methods, and computer-readable media are provided for determining a packet's round trip time (RTT) in a network. A system can receive information of a packet sent by a component of the network and further determine an expected acknowledgement (ACK) sequence number associated with the packet based upon received information of the packet. The system can receive information of a subsequent packet received by the component and determine an ACK sequence number and a receiving time of the subsequent packet. In response to determining that the ACK sequence number of the subsequent TCP packet matches the expected ACK sequence number, the system can determine a round trip time (RTT) of the packet based upon the received information of the packet and the received information of the subsequent packet.

First claim

What is claimed is:

1 . A method comprising:
receiving, from a sensor of a plurality of sensors in a network, information of a first packet sent by a component of the network, the plurality of sensors configured to sense information of data packets moving through the network; analyzing the information of the first packet to determine an expected acknowledgement (ACK) sequence number associated with the first packet; receiving information of a following packet received by the component; analyzing the information of the following packet to determine an ACK sequence number of the following packet; determining that the ACK sequence number of the subsequent packet matches the expected ACK sequence number; and determining a round trip time (RTT) of the first packet based upon the information of the first packet and the information of the subsequent packet.

2 . The method of claim 1 , further comprising:
determining a sending time, a packet sequence number and a packet size of the first packet based upon the information of the first packet, wherein the expected ACK sequence number associated with the first packet is determined based upon the packet sequence number and the packet size of the first packet.

3 . The method of claim 2 , further comprising:
analyzing the information of the following packet to determine a receiving time of the following packet, wherein the RTT of the first packet is determined based upon the sending time of the first packet and the receiving time of the following packet.

4 . The method of claim 1 , further comprising:
determining that the ACK sequence number of the subsequent packet doesn't match the expected ACK sequence number; ignoring the following packet; and receiving information of a next packet received by the component.

5 . The method of claim 4 , further comprising:
analyzing the information of the next packet to determine an ACK sequence number of the next packet received by the component; and determining that the ACK sequence number of the next packet matches the expected ACK sequence number, wherein the RTT of the first packet is determined based upon the information of the first packet and the information of the next packet.

6 . The method of claim 4 , further comprising:
analyzing the information of the next packet to determine an ACK sequence number of the next packet received by the component; determining that the ACK sequence number of the next packet doesn't match the expected ACK sequence number; and generating a warning report to indicate a potential attack.

7 . The method of claim 1 , further comprising:
determining a congestion level of the network based at least upon the RTT of the first packet.

8 . The method of claim 1 , further comprising:
receiving, from the plurality of sensors, information of transmission control protocol (TCP) hand-shakes of the network within a specific time period; determining a number of re-transmission packets and new packets during the specific time period based upon the information of TCP hand-shakes; determining a number of non-duplicative packets associated with the TCP hand-shakes based upon the information of TCP hand-shakes; and determining a packet loss rate of the network during the specific time period based upon the number of non-duplicative packets and the number of re-transmission packets and new packets.

9 . The method of claim 1 , further comprising:
selecting a range of packet sequence numbers for a specific network analysis; determining a packet sequence number of the first packet based upon the information of the first packet; and determining that the packet sequence number of the first packet is within the range of packet sequence numbers.

10 . The method of claim 9 , further comprising:
receiving information of an additional packet from the plurality of sensors; determining a packet sequence number of the additional packet based upon the information of the additional packet; determining that the packet sequence number of the additional packet is not within the range of packet sequence numbers; and ignoring the additional packet in the specific network analysis.

11 . A system comprising:
a processor; and a computer-readable storage medium storing instructions which, when executed by the processor, cause the system to perform operations comprising:
receiving, from a sensor of a plurality of sensors in a network, information of a first packet sent by a component of the network, the plurality of sensors configured to sense information of data packets moving through the network;
analyzing the information of the first packet to determine an expected acknowledgement (ACK) sequence number associated with the first packet;
receiving information of a following packet received by the component;
analyzing the information of the following packet to determine an ACK sequence number of the following packet;
determining that the ACK sequence number of the subsequent packet matches the expected ACK sequence number; and
determining a round trip time (RTT) of the first packet based upon the information of the first packet and the information of the subsequent packet.

12 . The system of claim 11 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
determining a sending time, a packet sequence number and a packet size of the first packet based upon the information of the first packet, wherein the expected ACK sequence number associated with the first packet is determined based upon the packet sequence number and the packet size of the first packet.

13 . The system of claim 12 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
analyzing the information of the following packet to determine a receiving time of the following packet, wherein the RTT of the first packet is determined based upon the sending time of the first packet and the receiving time of the following packet.

14 . The system of claim 11 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
determining that the ACK sequence number of the subsequent packet doesn't match the expected ACK sequence number; ignoring the following packet; and receiving information of a next packet received by the component.

15 . The system of claim 14 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
analyzing the information of the next packet to determine an ACK sequence number of the next packet received by the component; and determining that the ACK sequence number of the next packet matches the expected ACK sequence number, wherein the RTT of the first packet is determined based upon the information of the first packet and the information of the next packet.

16 . The system of claim 14 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
analyzing the information of the next packet to determine an ACK sequence number of the next packet received by the component; determining that the ACK sequence number of the next packet doesn't match the expected ACK sequence number; and generating a warning report to indicate a potential attack.

17 . The system of claim 11 , wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:
receiving, from the plurality of sens

Assignees

• Cisco Tech Inc

Inventors

• Alizadeh Attar Mohammadreza
• Yadav Navindra
• Singh Abhishek Ranjan
• Jeyakumar Vimalkumar
• Gandham Shashidhar
• Spadaro Roberto Fernando

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• H04W72/54

  based on quality criteria · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L47/11

  Identifying congestion · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title