Some observations on individual TCP flows behavior in network traffic traces

Abstract

We propose a modified Transmission Control Protocol (TCP) flow classification method and Round Trip Time (RTT) computation method which is more precise and more dynamic than the traditional fixed timeout method, especially for long, sparse TCP flows and long RTTs. Then we present passive measurement results for TCP RTT and RTT variation in network traffic traces. Analysis shows several interesting behavior patterns in individual flows. We observe TCP flows with regular patterns of RTT distribution. Individual TCP flows may also apparently have self-similar RTT distributions. Most long-active but sparse TCP flows use port 80 with a relatively short RTT. Lastly, we show and discuss plots of TCP flows with very long RTT values.