Computer Science > Networking and Internet Architecture
[Submitted on 30 Dec 2022 (this version), latest version 19 Feb 2023 (v2)]
Title:Detecting TCP Packet Reordering in the Data Plane
View PDFAbstract:Network administrators are often interested in detecting TCP-level packet reordering to diagnose performance problems and neutralize attacks. However, packet reordering is expensive to measure, because each packet must be processed relative to the TCP sequence number of its predecessor in the same flow. Due to the volume of traffic, the detection of packet reordering should take place in the data plane of the network devices as the packets fly by. However, restrictions on the memory size and the number of memory accesses per packet make it impossible to design an efficient algorithm for pinpointing the flows with heavy packet reordering.
In practice, packet reordering is typically a property of a network path, due to a congested or flaky link. Flows traversing the same path are correlated in their out-of-orderness, and aggregating out-of-order statistics at the IP prefix level would provide useful diagnostic information. In this paper, we present efficient algorithms for identifying IP prefixes with heavy packet reordering under memory restrictions. First, we analyze as much of the traffic as possible by going after the largest flows. Next, we sample as many flows as possible, regardless of their sizes. To achieve the best of both worlds, we also combine these two methods. In all algorithms, we resolve the challenging interplay between measuring at the flow level and aggregating at the prefix level by allocating memory using prefix information. Our simulation experiments using packet traces from a campus network show that our algorithms are effective at identifying IP prefixes with heavy packet reordering using moderate memory resources.
Submission history
From: Yufei Zheng [view email][v1] Fri, 30 Dec 2022 21:44:24 UTC (598 KB)
[v2] Sun, 19 Feb 2023 20:34:20 UTC (2,623 KB)
References & Citations
Bibliographic and Citation Tools
Bibliographic Explorer (What is the Explorer?)
Connected Papers (What is Connected Papers?)
Litmaps (What is Litmaps?)
scite Smart Citations (What are Smart Citations?)
Code, Data and Media Associated with this Article
alphaXiv (What is alphaXiv?)
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
DagsHub (What is DagsHub?)
Gotit.pub (What is GotitPub?)
Hugging Face (What is Huggingface?)
Papers with Code (What is Papers with Code?)
ScienceCast (What is ScienceCast?)
Demos
Recommenders and Search Tools
Influence Flower (What are Influence Flowers?)
CORE Recommender (What is CORE?)
arXivLabs: experimental projects with community collaborators
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.