A Sketch Algorithm to Monitor High Packet Delay in Network Traffic

Abstract

Packet delay is a consensual indicator of network conditions. High delay packets of a flow indicate that there may be network congestion or network anomalies. In this paper, we consider Intra-FlowPacketDelay (IFPD), which is defined as the time span between two adjacent packets of a flow. In particular, we aim to detect packets that exhibit high IFPD. The key challenge is to simultaneously achieve high detection accuracy and preserve low resource usage. Existing measurement approaches reduce resource overheads by injecting probe packets or sampling. However, they can only measure an average delay of some packets but fail to monitor delay behavior of every single packet. To this end, we propose a sketch-based approach. Unfortunately, existing sketch-based methods cannot be directly applied to our high IFPD detection problem. That is because traditional sketch algorithms require that the update operation is additive, while measuring IFPD needs to deal with timestamps, which is not additive. We address this issue in three aspects: (i) using fingerprints to mitigate hash conflicts; (ii) a conservative update method that only selects one bucket to update; (iii) a replacement strategy that keeps potential flows with high IFPD in the sketch. Our experiments on real world traces demonstrate that our solution identifies high IFPD with nearly 99% recall rate and 99% precision with 600 KB memory, which outperforms existing sketch-based solutions.