[e2e] Estimating MS windows RTO equation

[Marco Mellia]

We are working on the same topic, identifying packet anomalies (e.g.
retransmissions) in a TCP flow from passive measurement.
If you are interested, here are the links on the papers that we'll be
presented in June at ICC

M.Mellia, M.Meo, L.Muscariello, D.Rossi,
"Passive Identification and Analysis of TCP Anomalies",
IEEE ICC'06, Istanbul, Turkey, 11-15 June 2006
http://www.tlc-networks.polito.it/mellia/papers/icc06_passive.pdf

The tool we are using which implements all the code is available as well
from
http://tstat.tlc.polito.it

Hope this helps.

> Hi,
> It is not that we are interested in only MS windows machines; however, it is
> the only one which we have not figured out yet. 
> 
> We have created a partial state machine based tool for tracing the state of
> the TCP connections. This helps us identify the cause of retransmission of a
> packet and by using extra logic we can identify other things like whether
> the packet was needed or not. 
> 
> Now the problem with creating a general partial state-machine is that there
> is a lot of variation in the way TCP is implemented in the different OSes
> (windows for e.g. enters fast retransmit after 2 dupack instead of 3 as
> suggested in the RFC). There are many other differences across the different
> OSes especially in the way the RTO is estimated. We are trying to determine
> the RTO equations so that we can (i) exactly tell which packet is triggered
> by a timeout and (2) if we get a very good match between the observed
> retransmission time and calculated RTO, we would also be able to tell that
> the particular connection below to a particular OS.  We have been able to
> build almost perfect state machines for Linux, Solaris and FreeBSD (MacOS)
> and have been able to do a decent job for windows (including identifying
> certain unusual behavior which is peculiar to windows OSes). However, we are
> still struggling to get the RTO estimation perfected.  Details about the
> tool are available in the following tech report
> http://www.cs.unc.edu/~rewaskar/publication/TR06-002.pdf
> 
> About the RTT calculation. For the experiments I mentioned in the last mail
> we are collecting a tcpdump at the sender (FreeBSD machine) and calculate
> RTT using karls Algorithm. The details for RTT estimation are in the
> following paper  http://www.cs.unc.edu/~jasleen/papers/imc03.pdf
> 
> Thank you,
> Sushant Rewaskar
> -----------------------------
> UNC Chapel Hill
> www.cs.unc.edu/~rewaskar
> 
> 
> -----Original Message-----
> From: detlef.bosau at web.de [mailto:detlef.bosau at web.de] 
> Sent: Thursday, February 02, 2006 6:31 AM
> To: rewaskar at cs.unc.edu
> Cc: end2end-interest at postel.org
> Subject: Re: [e2e] Estimating MS windows RTO equation
> 
> Hm.
> 
> First of all, its interesting why you are interested in just MS Windows´
> RTO esitmator ;-)
> Basically, MS is free to implement anything they like as long as their
> OS are well behaved, i.e. do not cause trouble to other network
> participants.
> Of course, it might be a good idea to follow the actual RFC ;-)
> 
> To your problem.
> 
> How did you obtain the rtxtimer samples from which you try to estimate
> your parameters?
> 
> Presumably, you did not take them from the OS kernel code, because if
> that were available for you you could easily look up the RTO equation
> from
> that ;-)
-- 
Ciao,                    /\/\/\rco

+-----------------------------------+  
| Marco Mellia - Assistant Professor|
| Tel: 39-011-2276-608              |
| Tel: 39-011-564-4173              |
| Cel: 39-340-9674888               |   /"\  .. . . . . . . . . . . . .
| Politecnico di Torino             |   \ /  . ASCII Ribbon Campaign  .
| Corso Duca degli Abruzzi 24       |    X   .- NO HTML/RTF in e-mail .
| Torino - 10129 - Italy            |   / \  .- NO Word docs in e-mail.
| http://www1.tlc.polito.it/mellia  |        .. . . . . . . . . . . . .
+-----------------------------------+
The box said "Requires Windows 95 or Better." So I installed Linux.