Automated slow-start detection for anomaly root cause analysis and BBR identification

Network troubleshooting usually requires packet level traffic capturing and analyzing. Indeed, the observation of emission patterns sheds some light on the kind of degradation experienced by a connection. In the case of reliable transport traffic where congestion control is performed, such as TCP and QUIC traffic, these patterns are the fruit of decisions made by the congestion control algorithm (CCA), according to its own perception of network conditions. The CCA estimates the bottleneck’s capacity via an exponential probing, during the so-called “Slow-Start” (SS) state. The bottleneck is considered reached upon reception of congestion signs, typically lost packets or abnormal packet delays depending on the version of CCA used. The SS state duration is thus a key indicator for the diagnosis of faults; this indicator is estimated empirically by human experts today, which is time-consuming and a cumbersome task with large error margins. This paper proposes a method to automatically identify the slow-start state from actively and passively obtained bidirectional packet traces. It relies on an innovative timeless representation of the observed packets series. We implemented our method in our active and passive probes and tested it with CUBIC and BBR under different network conditions. We then picked a few real-life examples to illustrate the value of our representation for easy discrimination between typical faults and for identifying BBR among CCAs variants.