Strengthening Packet Loss Measurement from the Network Intermediate Point

Abstract

Estimating loss rates with the packet traces captured from some point in the middle of the network has received much attention within the research community. Meanwhile, existing intermediate-point methods like [1] require the capturing system to capture all the TCP traffic that crosses the border of an access network (typically Gigabit network) destined to or coming from the Internet. However, limited to the performance of current hardware and software, capturing network traffic in a Gigabit environment is still a challenging task. The uncaptured packets will affect the total number of captured packets and the estimated number of packet losses, which eventually affects the accuracy of the estimated loss rate. Therefore, to obtain more accurate loss rate, a method of strengthening packet loss measurement from the network intermediate point is proposed in this paper. Through constructing a series of heuristic rules and leveraging the binomial distribution principle, the proposed method realizes the compensation for the estimated loss rate. Also, experiment results show that although there is no increase in the proportion of accurate estimates, the compensation makes the majority of estimates closer to the accurate ones.

1. Introduction

 It is now common for network operators to perform ongoing performance measurements, the packet loss rate as a key performance metric is important for an ISP offering the services specified in Service-Level-Agreement (SLA). Currently, researchers mainly achieve packet loss estimation through active measurement or passive measurement. Active measurement [2] is the use of probe tools (such as Ping, BADABING, etc.) to inject probe packets, e.g., Internet Control Message Protocol (ICMP) echo packets, into the network and measure how many of them eventually reach the destination. The accuracy guarantee of the active measurement lies in selecting proper measurement point and injecting probe packets in an appropriate way without disturbing the target traffic. However, this is difficult in actual implementation as the active measurement is usually rate-based and does not share the sending pattern of the sender side. If the rate is too low, the real network performance may not be measured, while if the rate is too high, the target traffic will be disturbed by the probe traffic. Despite some random sampling models can reduce the effect of these disadvantages to some extent [3] [4] [5], active measurement is still difficult to cope with problems like discrete sampling nature of the probe process and dependence on the feedback loop. Therefore, although active measurement is simple and feasible, researchers are increasingly seeking to estimate packet loss through passive measurement.

 All along, around passive packet loss measurement, research has focused on end-system measurement [6] [7] [8] [9] [10]. End-system methods have a common feature, viz., they are all based on the information available from the sender-side and/or receiver-side of a connection, which determines that they can only be used to evaluate the end-to-end performance of the individual connection. However, due to the traffic shaping and the events violating network neutrality [11] [12] [13], different connections may experience vastly different loss rates. From the perspective of network performance management [14], the packet loss rate obtained by end-system method is not suitable for evaluating the overall packet loss status of the monitored network. To this end, researchers explore to leverage the packet traces captured from the network intermediate point (e.g., at the boarder of an access network) to estimate packet losses. The intermediate-point methods can not only estimate the loss rates of individual end-to-end connection and aggregated traffic, but can also distinguish the packet losses within an ISP’s management domain and that in the outside Internet. All these provide operators with the possibility to precisely grasp network performance to achieve fine-grained network management [15].

 As connection-oriented and reliable transport protocol, TCP has a natural response to changes in network performance. Therefore, the research of intermediate-point methods has always been oriented towards TCP flows. For instance, Mellia et al. [16] built a tool Tstat for the first time to measure packet losses using TCP packet traces captured from the network intermediate point. For a TCP flow, Tstat simply takes retransmissions at the measurement point as the lost packets to estimate its packet losses. In the following years, due to its simplicity and practicability, Tstat is widely used in wired and wireless network performance evaluation and analysis [17] [18] [19] [20]. Meanwhile, due to the widespread application prospects of intermediate-point packet loss estimation, many scholars also embarked on the follow-up study of [16]. Benko et al. [21] used the traces captured from the network intermediate point to construct a series of heuristic rules to estimate packet losses before and after the measurement point. Favi et al. [22] analyzed the performance of the Benko-Veres algorithm [21] and found that the algorithm requires a considerable number of packets and lost-events to converge to a reasonable and accurate estimate. Jaiswal et al. [23] leveraged the information contained in the out-of-order packets to realize the estimation for packet losses. Collange et al. [24] estimated packet losses before and after the measurement point through the defined “Desequencements” data segment and retransmission mechanism. Moreover, with the proposed method, they also analyzed the relationship between packet loss rate and other traffic characteristics (e.g., connection time, connection size and the number of connection interruptions, etc.). Cheng et al. [25] extracted the information of fast retransmissions and timeout retransmissions contained in the data stream to realize the estimation for packet losses before and after the measurement point. With Retransmit TimeOut (RTO) and duplicate acknowledgments (ACKs), Ullah et al. [26] filtered the different types of retransmissions to estimate packet losses in the middle of the two ends. To troubleshoot packet losses, Cheng et al. [27] designed a lightweight efficient diagnosis tool TCPBisector to estimate packet losses in the middle of the network with relative error 3.5%-6.9%. In recent years, intermediate-point packet loss estimation has been introduced into Software Defined Network (SDN) applications, i.e., they combined with SDN to achieve packet loss monitoring [28] [29] [30], moreover, for good performance monitoring, Hark et al. [31] also evaluated the performance of these techniques to take the appropriate packet loss estimation technique in different network condition. In addition, Andrzej et al. [32] realized the packet loss estimation at the intermediate router by leveraging the stationary distribution of the queue size and the dropping function. While Sierra et al. [33] estimated packet losses in the network intermediate point by proposing a simplest approach of counting as a retransmission a packet whose sequence number is smaller than the previous one. Compared with the rich papers in this area, we only listed a part of them. The common feature of these methods is that they are all based on TCP packet traces captured from the boarder of the monitored network (typically Gigabit network). Therefore, the performance of the capturing system will directly affect the accuracy of such methods in practical applications. Actually, limited to the performance of current hardware (e.g., the processing power of the CPU) and software (e.g., the performance of the popular operating systems), capturing network traffic in a Gigabit environment is still a challenging task [34] [35] [36]. In other words, the capturing system is not able to capture everything. For instance, according to Schneider et al’s evaluation for the performance of capturing system under different combinations of hardware and software [37], the capture rate cannot reach 100% in most cases, and when the rate of traffic generation reaches 900 Mbit/s, even the best-performing FreeBSD/AMD combination still exhibited 10% to 20% packet losses. Although with the technological innovation of hardware and software, the capture rate has been improved in recent years, the problem of uncaptured packets in Gigabit environment is still inevitable as the rapid increment of the network traffic and transmission speed [38].

 In our previous work [1], we enriched the body of intermediate-point estimation techniques by proposing an Algorithm for Estimating Packet Losses on Network Path (AEPLNP), which consists of two sub-algorithms. The first sub-algorithm estimates packet losses before the capture point by building a series of heuristic rules that aim to accurately reflect the state transitions of TCP congestion state machine in the sender-side associated with packet losses. At the same time, the factors like packet reordering, repeated packet losses, and so on were also considered to refine the first sub-algorithm in an effort to be more precise in estimation. While the second sub-algorithm realizes the estimate for packet losses after the capture point by distinguishing necessary retransmissions and spurious retransmissions with the information contained in the ACK stream. Therefore, besides the sender-side, the key for the second sub-algorithm is to leverage the state transitions in the receiver-side to locate the spurious retransmissions. Similar with other intermediate-point algorithms, for performance management reasons, the capture point of AEPLNP needs to be as close as possible to the boarder of an ISP’s management domain (typically Gigabit network), and needs to capture all the TCP traffic that crosses the entire border destined to or coming from the Internet. Therefore, a problem, for AEPLNP, is that the TCP traffic cannot be fully captured and the missing packet information will affect: 1) the total number of captured packets; 2) the estimated number of packet losses before and after the capture point, which eventually affects the accuracy of the estimated loss rates. In view of this, this paper is intended to improve the robustness of AEPLNP in practical applications by detailing and validating a method with an eye towards overcoming the impact of uncaptured packets.

 For packet capture, previous work [39] [40] [41] mainly focuses on how to improve the capture rate, and capture rate as an evaluation index is typically calculated by comparing the captured traffic with the original traffic that generated by different traffic generators [42] [43]. While about how to estimate the number of uncaptured packets with the captured packets, we looked up domestic and foreign literatures and found no relevant research about it. Therefore, in this work, we first explore leveraging the data and ACK streams to construct a series of heuristic rules to estimate the total number of uncaptured packets in a TCP connection. After that, we further leverage the estimated uncaptured packets combined with the binomial distribution principle to complete the compensation for the estimated number of packet losses before and after the capture point. Due to the impact of uncaptured packets, it is difficult to get an accurate loss rate with the packet traces captured in the actual network. Therefore in this paper, the simulations with practically relevant parameters are performed to evaluate the proposed method. And, the final experiment results show that although there is no increase in the proportion of accurate estimates, the compensation makes the majority of estimates closer to the accurate ones. In addition, what needs to be pointed out is that the previous work mainly focused on the intermediate-point algorithm itself and did not provide a solution to the problem of uncaptured packets in practical applications. From this angle, the contribution of this work not only lies in improving the robustness of AEPLNP, but also lies in providing a reference for other intermediate-point algorithms to overcome the impact of the uncaptured packets.

 The remainder of this paper is organized as follow. The compensation strategy is introduced in Section 2. Next, Section 3 presents the algorithm for estimating the total number of uncaptured packets in a TCP connection. Then, Section 4 describes the compensation for the estimated number of packet losses. After detailing the proposed method, Section 5 presents the validation and analysis for the proposed method. Finally, Section 6 concludes the paper and gives the research forecast.

 

2. Compensation Strategy

Fig. 1. Measurement scenario

 The measurement scenario is shown in Fig. 1. As can be seen, the capture point “P” is located at the boarder of the monitored network A and divides each network path crossing through the boarder of A into two segments. The network path segments before “P” can be used to evaluate the packet loss status within A, while the network path segments after “P” can be used to evaluate the packet loss status in the outside Internet. Given that a TCP connection without compensation is denoted with T, then its packet loss rate on network path before “P” can be calculated as:

\(L_{\text {before}\_ {without}}=\frac{N_{ {before}}}{N_{ {before}}+N_{ {capture}}}\)       (1)

where N_before denotes the number of estimated packet losses of T before “P”, and N_capture denotes the number of data packets of T captured at “P”.

 Similarly, for T, the packet loss rate on network path after “P” can be calculated as:

\(L_{ {after} \_ {without}}=\frac{N_{ {after}}}{N_{ {before}}+N_{ {capture}}}\)       (2)

where N_after denotes the number of estimated packet losses of T after “P”.

 It is obvious that the uncaptured packets will result in an underestimate for N_capture. Meanwhile, AEPLNP leverages the information extracted from the captured packets to estimate Nbefore and N_after. The uncaptured packets will also result in the loss of relevant information and thus result in an underestimate for N_before and N_after. Referring to equation (1) and equation (2), the accuracy of L_before and L_after will inevitably be affected. Therefore, to further improve the robustness of the algorithm AEPLNP in the Gigabit network environment, next the compensation for AEPLNP is detailed and validated. Concretely, the compensation has the following two steps:

 Step1: Based on the seen sequence number pattern and the information contained in the ACK stream, the Algorithm for Estimating Uncaptured Packets (AEUP) consisting of a series of heuristic rules is first constructed to estimate the total number of uncaptured packets in a TCP connection, and thereby achieving the compensation for N_capture.

 Step2: Combined with the binomial distribution principle, we complete the compensation for N_before and N_after with the estimated uncaptured packets in Step1.

 

3. Estimate the Number of Uncaptured Packets

 In this section, the Algorithm for Estimating Uncaptured Packets (AEUP) is presented.

Fig. 2. Sample uncaptured packet pattern

 Fig. 2 shows the data sequence sample of a TCP connection appearing at the capture point. Referring to Fig. 2 and analyzing the type of TCP packets appearing at the capture point, we found that an uncaptured data packet will cause the following two cases:

 Case 1: If a data packet appears at the capture point only once (e.g., D1 in Fig. 2) and is not captured, then unfilled hole will appear in the captured data sequence of a successfully ended TCP connection.

 Case 2: Again, if a data packet appears at the capture point more than once, i.e., it is retransmitted (e.g., D2 in Fig. 2), in this case, even though it is not captured, we may not see any visible hole in the captured data sequence, viz., the hole caused by the uncaptured packet is refilled and becomes invisible (e.g., in Fig. 2, D2 is not captured, but D3 fills the hole caused by the lost D2).

 Given that the data sequence of a TCP connection is described with set \(S=\left\{<S_{l}, L_{1}>\right.\left.,...,<S_{n}, L_{n}>\right\}\), where \(\forall i \in N,<S_{i}, L_{i}>\), denotes the i^th data segment, S_ⁱ denotes the sequence number of , \(<S_{i}, L_{i}>, S_{i} \leq S_{i+1}\) and L_i denotes the byte length of \(\left\langle S_{i}, L_{i}\right\rangle\) . Then the unfilled hole and invisible hole in S are defined as follows.

 Definition 1: (Unfilled hole) If \(S_{t}+L_{t}<S_{t+1}\) then an unfilled hol appears between \(<S_{i}, L_{i}>\) and \(<S_{i+1}, L_{i+1}>\), we denote this unfilled hole \(H_{u n f i l l e d_{d}}=<S_{i}+L_{i}, S_{i+1}> \).

 Definition 2: (Invisible hole) If \(<S_{i}, L_{i}>\) is not captured and appears at the capture point more than once, in this case, we denote the invisible hole caused by the loss of \(\left\langle S_{i}, L_{i}\right\rangle\)  with \(H_{\text {imisible}_{i}}=<S_{i}, S_{i}+L_{i}>\)

 According to the discussion above, if the actual number of data segments corresponding to the unfilled holes and invisible holes in S can be determined, then the number of uncaptured data packets can be calculated as:

\(N_{ {uncaptured}}=N_{ {unfilled}}+N_{ {invisible}}\)       (3)

where N_unfilled and N_invisible represent the number of data segments corresponding to unfilled holes and invisible holes in S, respectively. Therefore, our goal is to seek N_unfilled and N_invisible.

 By definition, we can easily identity the unfilled holes in S by sorting the data packets in ascending order according to the sequence number. However, we also note that the byte range identified by the TCP sequence number is 0 to 2³². Moreover, in a TCP connection, the sequence number of the first data segment is random. Thus, the sequence number may appear cyclic reuse during a TCP transfer, which can also cause unfilled hole in the data sequence. In order to exclude the effect of sequence number cyclic reuse, the maximum hole-size is set in this paper. Referencing the typical capture rate and default Maximum Segment Size (MSS) (typically 1460 bytes), the maximum unfilled hole-size is set to:

\(H_{m a x_{-} u n f i l l e d}=\frac{1}{10} N_{c a p} * 1460\)       (4)

where N_cap is the total number of captured data packets corresponding to a TCP connection. Although N_{max_unfilled} does not necessarily exclude the effect of sequence number cyclic reuse completely, it is expected to bound the error.

 After identifying the unfilled holes in S, N_unfilled can be determined with the default MSS and ACK stream.

 For different TCP acknowledgement mechanisms, the form of ACK is different. Accordingly, different techniques will be used to determine N_unfilled in this paper. Currently there are three kinds of TCP acknowledgement mechanisms:

 • Standard Cumulative Acknowledgment (SCA): According to RFC5681 [44], it cooperates with the basic TCP congestion control mechanisms to repair the packet losses (e.g., Reno, NewReno, BIC and CUBIC, etc.). This mechanism only acknowledges the data segments that arrive in order, i.e., the received segments that are not at the left edge of the receive window cannot be acknowledged. Therefore, for TCP connection taking this mechanism, extracting information contained in the ACK stream is not able to identify the edges of out-of-order arrivals. In this case, the default MSS can be used to assist in determining edges of uncaptured segments.

 • Selective Acknowledgment (SACK): It combines with a selective retransmission policy at the sender-side to repair the packet losses and reduce the spurious retransmissions. This mechanism not only acknowledges the data segments that arrive in order, but can also acknowledge the out-of-order segments that have arrived at the receiver and not covered by the acknowledgement number. Therefore, for TCP connection taking this mechanism, the information contained in the SACK blocks is beneficial for determining the edges of partial out-of-order arrivals. More details about SACK are available from RFC2018 [45].

 • Duplicate Selective Acknowledgment (D-SACK): This version, described in RFC2883 [46], is an extension to the SACK. It allows the receiver to inform the sender about segments that have already arrived more than once. Therefore, a spurious retransmission can be accurately identified with an ACK containing D-SACK information. As we know, since the flaws in TCP’s retransmission schemes [47], spurious retransmissions are inevitable in a number of cases. On the basis of SACK, the information in DSACK blocks can not only specify the segments that arrive in order and out-of-order, but can also specify the redundant segments caused by spurious retransmissions. Therefore, DSACK combined with the various holes defined in this paper can comprehensively determine the edges of the uncaptured segments.

 For easy discussion, we redefine the ACK number here. For SCA, the ACK number refers to acknowledgement number (hereinafter referred to as ack-number), while for SACK and D-SACK, the ACK number includes ack-number, SACK block left edge (hereinafter referred to as left-edge) and SACK block right edge (hereinafter referred to as right-edge). For ack-number A, when we speak of it falls into the unfilled hole H_{unfilled_i}, we are referring to that \(S_{i}+L_{i}<A \leq S_{i+1}\) while for right-edge R, when we speak of it falls into the unfilled hole H_{unfilled_i}, we are referring to that \(S_{i}+L_{i}<R \leq S_{i+1}\) According to whether or not an unfilled hole has an ACK number to fall into, it can be divided into the following categories.

Definition 3: (Pure hole) It has no any ACK number to fall into.

 Definition 4: (Impurity hole) It has one or more ACK number(s) to fall into.

 Definition 5: (Overlapped hole) It has duplicate ACK number to fall into.

 Indeed, by definition, the overlapped hole belongs to impurity hole. In order to facilitate the calculation for N_unfilled, we further divide the impurity hole into disjoint categories.

 Definition 6: (Normal hole) Among the impurity holes, except the overlapped holes, the remaining are normal holes.

 According to the discussion above, eventually the unfilled hole is divided into the following three disjoint categories: pure hole, normal hole and overlapped hole.

\(\text { Unfilled hole }\left\{\begin{array}{l}\blacklozenge\text { Pure hole } \\\text { Impurity hole }\left\{\begin{array}{l}\blacklozenge \text { Normal hole } \\\blacklozenge\text { Overlapped hole }\end{array}\right.\end{array}\right.\)

 For pure hole, because it has no any ACK number to fall into, so AEUP uses the default MSS to determine the number of data segments corresponding to the pure holes in S:

\(N_{ {pure}}=\sum_{i=1}^{p}\left\lceil\frac{P_{i}}{1460}\right\rceil\)       (5)

where p is the number of pure holes in S, and P_i is the byte length of the i^th pure hole.

 For normal hole, it has no any duplicate ACK number to fall into. Thus, we just need to leverage the ACK numbers falling into it and the default MSS to determine the edges of the data segments corresponding to it. Accordingly, AEUP first uses ACK numbers falling into a normal hole to divide it into some small fragments. After the first round of dividing, if the byte length of the divided fragment is greater than 1460, then it will be further randomly divided into F smaller fragments whose byte length is greater than 1. F equals to the byte length of the divided fragment divided by 1460. Eventually, AEUP uses the number of final divided fragments as the number of data segments corresponding to the normal holes in S:

\(N_{ {nomal}}=\sum_{i=1}^{n}\left[F_{i}+B_{i} \sum_{j=1}^{F_{i}}\left(\left[\frac{L_{j}}{1460}\right]-1\right)\right]\)       (6)

where n is the number of normal holes in S, F_i is the number of fragments in the i^th normal hole after the first round of dividing, L_j is the byte length of the j^th divided fragment belonging to the ith normal hole after the first round of dividing, and Bi is a Boolean variable that reports the situation of the i^th normal hole after the first round of dividing.

\(B_{i}=\left\{\begin{array}{l}1: \text { if the } i^{\text {th }} \text { normal hole contains fragment that is greater than } 1460 \text { bytes } \\ 0: \text { otherwise }\end{array}\right.\)

 For overlapped hole, compared with normal hole, the difference is that it has duplicate ACK numbers to fall into. For these duplicate ACK numbers, what do they represent is important for us to determine the number of data segments corresponding to the overlapped holes in S (No_verlapped). It should be noted that the sole function of the right-edge in this section is just to identify the edge of data segment, so when we discuss duplicate ACK number, the duplicate right-edge is not included. Since the duplicate ACK number may be duplicate ack-number or duplicate left-edge, we discuss the overlapped holes for SCA, SACK and D-SACK, respectively.

 For SCA, about duplicate ack-number, we can prove the following:

 Proposition 1: The duplicate ack-number is caused by either spurious retransmission or packet reordering.

 Proof: In order to let TCP sender sent the data segment D that is suspected to be lost as soon as possible to avoid RTO expiration, the fast retransmission mechanism requires the receiver to immediately generate an ACK for expecting D upon receiving an out-of-order data segment. Therefore, if the received data is out-of-order, then a duplicate ack-number will be generated. In contrary, if the received data is orderly and non-retransmitted, then it will cause a new ACK. Else if the received data is orderly and necessary retransmission, it will also cause a new ACK, but if it is orderly and spurious retransmission, the duplicate ack-number will be generated since the buffer state of the receiver-side is not changed.

 Therefore, for an overlapped hole, we first use the method dealing with the normal hole to determine the number of non-retransmitted data segments in it. Then the number of spurious retransmissions specified by some (not all) duplicate ACK numbers falling into the overlapped hole can be determined after excluding the effect of packet reordering. As we know, the essence that packet reordering can generate duplicate ACK is fast retransmission mechanism. Again, sufficient packet reordering will cause fast retransmission (typically over three duplicate ACKs). Therefore, for a duplicate ACK, if the number of times it appears at the capture point is greater than or equal to 4, we assume it is caused by packet reordering. Ultimately, for SCA, N_overlapped can be calculated as:

\(N_{{overlapped}}=\sum_{i=1}^{o}\left[F_{i}+B_{i} \sum_{j=1}^{F_{i}}\left(\left[\frac{L_{j}}{1460}\right]-1\right)+D_{i}-R_{i}\right]\)       (7)

where o is the number of overlapped holes in S, D_i is the number of duplicate ack-numbers falling into the i^th overlapped hole, R_i is the number of duplicate ack-numbers caused by packet reordering in D_i.

 For SACK, about duplicate ACK numbers, we can prove the following:

 Proposition 2: The duplicate ack-number is caused by either spurious retransmission or packet reordering, but the duplicate left-edge is caused by spurious retransmission.

 Proof: Just like the proof for SCA, for SACK, a duplicate ack-number is caused by either spurious retransmission or packet reordering. While for SACK block, the receiver always acknowledges the most recently transmitted ones [48]. Therefore, if the left-edge is duplicate, we can determine that it is caused by a spurious retransmission.

 According to proposition 2, when determining N_overlapped, duplicate left-edge falling into the overlapped hole can be directly used to confirm a spurious retransmission. While for duplicate ack-number falling into overlapped hole, if the ACK where it is located doesn’t contains duplicate left-edge, we can think it may be caused by a spurious retransmission and use it to determine a spurious retransmission, but need to exclude the effect of packet reordering, viz., we require the number of times it appears at “P” is less than or equal to 3. Therefore, for SACK, N_overlapped can be calculated as:

\(N_{ {overlapped}}=\sum_{i=1}^{o}\left[F_{i}+B_{i} \sum_{j=1}^{F_{i}}\left(\left[\frac{L_{j}}{1460}\right]-1\right)+D_{i}+E_{i}\right]\)       (8)

where D_i is the number of duplicate ack-numbers identifying spurious retransmissions and falling into the i_th overlapped hole, and E_i is the number of duplicate left-edges falling into the i_th overlapped hole.

 Actually, for our work, the only valuable information that a duplicate ACK number can provide is whether it specifies a spurious retransmission or not. In this case, for D-SACK, we don’t take the duplicate ACK numbers into account when determining N_overlapped. But we use the DSACK block to detect the spurious retransmission belonging to the overlapped hole, viz., if the left-edge falling into the overlapped hole is a DSACK block left edge, we add the number of spurious retransmissions belonging to this overlapped hole by 1.

 Therefore, for D-SACK, N_overlapped can be calculated as:

\(N_{ {overlapped}}=\sum_{i=1}^{o}\left[F_{i}+B_{i} \sum_{j=1}^{F_{i}}\left(\left[\frac{L_{j}}{1460}\right]-1\right)+E_{i}\right]\)       (9)

where E_i is the number of DSACK block left edges falling into the i^th overlapped hole.

 Based on the discussion above, N_unfilled is calculated as:

\(N_{u n f i l l e d}=N_{p u r e}+N_{n o r m a l}+N_{o v e r l a p p e d}\)       (10)

 And, N_invisible can be denoted as:

\(N_{ {invisible}}=N_{ {rts}}-N_{ {cap}_{-} r t s}\)       (11)

where N_rts denotes the total number of retransmissions appearing at the capture point, and N_{cap_rts} denotes the number of retransmissions actually captured by the capturing system.

 According to equation (11), the key to obtain Ninvisible lies in determining N_rts. To this end, we leverage the conclusion in [49] to approximate N_rts. For illustrative purposes, we introduce the following metric:

 Ratio_data/ack: the ratio of the number of data packets to the number of ACKs.

 As Wu et al. [49] point out, for a TCP connection, Ratio_data/ack is about 2:1 when there is no packet loss. On the contrary, Ratio_data/ack will change from 2:1 to 1:1 until the lost packets are repaired. Therefore, we have:

\(\left\{\begin{array}{l}N_{a c k}=N_{r t s}+\frac{N_{n o n\_ r t s}}{2} \\N_{n o n_{-} r t s}=N_{n o n_{-} u n f i l le d}+N_{n o n_{-} c a p}\end{array}\right.\)       (12)

where N_ack is the number of ACKs, Nnon_trs is the number of non-retransmitted segments, N_{non_unfilled} is the number of non-retransmitted segments in unfilled holes and N_{non_cap} is the number of captured non-retransmitted segments. Solve equation (12), we have:

\(N_{r t s}=\left\lfloor N_{a c k}-\frac{N_{n o n\_ { unfilled }}+N_{n o n \_c a p}}{2}\right\rfloor\)       (13)

 Finally, the algorithm AEUP is given in Algorithm 1.

Algorithm 1: AEUP

//Preprocessing stage Pure_h = Normal_h = Overlapped_h = Invisible_h = 0 for pkt in trace of one TCP connection    if pkt.is_Data() then      H = pkt.form_Hole()    else      A = pkt.form_Ack()    end if end for for hole in H    if hole.pure_Check(A)      Pure_h = hole.pure_Num()    else if hole.normal_Check(A)      Normal_h = hole.normal_Num(A)    else      Overlapped_h = hole.overlapped_Num(A) end for      Invisible_h = hole.invisible_Num(A) Return Pure_h + Normal_h + Overlapped_h + Invisible_h

 

4. Compensate the Estimated Number of Packet Losses

 To simplify discussion, we introduce the following identifiers:

 S: the uncaptured data segments in a TCP connection

 S_{non_r}: the non-retransmitted data segments in a TCP connection

 S_r: the retransmitted data segments in a TCP connection

 S_b: the data segments that are related to packet losses before the capture point

 S_{n_b}: the data segments that are not related to packet losses before the capture point

 S_a: the data segments that are related to packet losses after the capture point

 S_{n_a}: the data segments that are not related to packet losses after the capture point

 S_{b_s}: S_b ∩ S

 S_{b_n}: Sd ∩ ¬S

 S_{n_b_s}: S_{n_b} ∩ S

 S_{n_b_n}: S_{n_b} ∩ ¬S

 S_{a_s}: S_a ∩ S

 S_{a_n}: S_a ∩ ¬S

 S_{n_a_s}: S_{n_a} ∩ S

 S_{n_a_n}: S_{n_a} ∩ ¬S

 S_{non_s}: S_{non_r} ∩ S

 S_{non_ns}: S_{non_r} ∩ ¬S

 S_{r_s}: S_r ∩ S

 S_{r_ns}: S_r ∩ ¬S

 P_b: the probability that a segment in Snon_r belongs to Sb

 P_{b_s}: the probability that a segment in Snon_s belongs to Sb_s

 P_{b_n}: the probability that a segment in Snon_ns belongs to Sb_n

 P_a: the probability that a segment in Sr belongs to Sa

 P_{a_s}: the probability that a segment in Sr_s belongs to Sa_s

 P_{a_n}: the probability that a segment in Sr_ns belongs to Sa_n

 N_{non_s}: card(S_{non_s})

 N_{non_ns}: card(S_{non_ns})

 N_{r_s}: card(S_{r_s})

 N_{r_ns}: card(S_{r_ns})

 N_{b_s}: card(S_{b_s})

 N_{b_n}: card(S_{b_n})

 N_{a_s}: card(S_{a_s})

 N_{a_n}: card(S_{a_n})

Fig. 3. Categories of data segments in a TCP transfer

 With the defined identifiers, we divide the data segments in a TCP connection (denoted with D) into several categories shown in Fig. 3. As can be seen, N_{b_s} and N_{a_s} are the compensation numbers of N_before and N_after, respectively. Therefore, the goal becomes to seek N_{b_s} and N_{a_s}, and our methodology has the following two steps:

 Step1: Leverage binomial distribution and maximum likelihood estimation to get P_{b_s} and P_{b_n} (P_{a_s} and P_{a_n}).

 Step2: Let P_{b_s}=P_{b_n} (P_{a_s}=P_{a_n}) to obtain N_{b_s} (N_{a_s}).

 In S_{non_ns}, one segment either belongs to S_{b_n} or to S_{n_b_n}. We use a random variable X to denote one segment belongs to S_{b_n} or to S_{n_b_n}. Let

\(\mathrm{X}=\left\{\begin{array}{l}0: \text { denotes one segment belongs to } S_{b_{-} n} \\ 1: \text { denotes one segment belongs to } S_{n_{-} b_{-} n}\end{array}\right.\)

then X ~ b (1, P_{b_n}). For a data flow, we take sample S_{non_ns} to observe how many segments belong to S_{b_n} and how many segments belong to S_{n_b_n}. Here, S_{non_ns} is recorded as (x₁, …, x_n), the probability of this observation event is:

\(\begin{aligned}P\left(\mathrm{X}_{1}=x_{1}, \ldots, \mathrm{X}_{n}=x_{n} ; P_{b_{-} n}\right) &=\prod_{i=1}^{n} {P_{b_{-} n}}^{x_{i}} *\left(1-P_{b_{-} n}\right)^{1-x_{i}} \\&={P_{b_{-} n}}^{\sum x_{i}} *\left(1-P_{b_{-} n}\right)^{\mathrm{n}-\sum x_{i}}\end{aligned}\)       (14)

 According to the maximum likelihood principle, maximum likelihood principle we choose P_{b_n} to make equation (14) maximum. Equation (14) can be further expressed as:

\(\mathrm{L}\left(P_{b\_ n}\right)={P_{b_{-} n}}^{ \Sigma x_{i} }*\left(1-P_{b_{-} n}\right)^{n-\Sigma x_{i}}\)       (15)

 Equation (15) is transformed into the following form:

\(\ln \mathrm{L}\left(P_{b_{-} n}\right)=\ln \left[{P_{b_{-} n}}^{\sum x_{i}} *\left(1-P_{b_{n} n}\right)^{n-\sum x_{i}}\right]\)       (16)

 Derive the derivative of equation (16) with respect to P_{b_n} and let its result be zero:

\(\frac{\partial \ln \mathrm{L}\left(P_{b_{-} n}\right)}{\partial P_{b_{-} n}}=\frac{\partial \ln \left[{P_{b_{-n}}}^{\Sigma x_{i }}*\left(1-P_{b_{-} n}\right)^{n-{\sum x_{i}}}\right]}{\partial P_{b_{-n}}}=0\)       (17)

 Solve equation (17) to get the maximum likelihood estimation of P_{b_n}:

\(\widehat{P_{b_{-} n}}=\widehat{P_{b_{-} n}}\left(x_{1}, \ldots, x_{n}\right)=\frac{\sum x_{i}}{n}\)       (18)

 Next, we prove ("P" _"b_n"  ) ̂ is unbiased:

\(\mathrm{E}(\widehat{P_{b_{-} n}})=\mathrm{E}\left(\frac{\Sigma x_{i}}{n}\right)=\frac{1}{n} \mathrm{E}\left(\sum x_{i}\right)=\frac{1}{n} n \widehat{P_{b_{-} n}}=\widehat{P_{b\_n}}\)       (19)

 Thus, the unbiasedness of \(\widehat{P_{b_{-} n}}\) is proved. Similarly, Pb_s can be obtained.

 As we know, \(S_{n o n_{J}} \subset S_{n o n_{-} r}\) , so \(\widehat{P_{b_{-}}}=P_{b}\). Again, since\(S_{n o n_{-} n s} \subset S_{n o n_{-}}\)  and \(\operatorname{card}\left(S_{n o n_{n s}}\right)>\operatorname{card}\left(S_{n o n_{r}}\right)\), according to the large sample theory of maximum likelihood estimation, we have \(\widehat{P_{b}}=P_{b_{-} n}\) . Because \(\widehat{P_{b_{-}}}=P_{b}\) and\(\) \(\widetilde{P_{b}}=P_{b_{-} n}\), so \(\widehat{P_{b_{J}}}=P_{b_{D}}\) . After obtaining \(P_{b_{z}}\) and \(P_{b_{-} n}, N_{b_{5}}\) can be calculated as follows:

\(\left\{\begin{array}{l}P_{b_{-} s}=\frac{N_{b_{-} s}}{N_{ {non }_{-} s}} \\P_{b_{-} n}=\frac{N_{b_{-} n}}{N_{ {non }_{-} n s}} \stackrel{\text { yields }}{\longrightarrow} N_{b_{-} s}=\left\lfloor\frac{\left(N_{ {uncaptured }}-N_{r_{-} s}\right) * N_{ {before }}}{N_{ {cap }}-N_{{cap }_{-} r t s}}\right] \\P_{b_{-} s}=P_{b_{-} n}\end{array}\right.\)       (20)

where N_uncaptured denotes the number of uncaptured segments estimated by AEUP.

 Similarly, N_{a_s} can be calculated as follows:

\(\left\{\begin{array}{l}P_{a_{-} s}=\frac{N_{a_{-} s}}{N_{n o n\_s}} \\P_{a_{-} n}=\frac{N_{a_{-} n}}{N_{r_{-} n s}} \stackrel{\text { yields }}{\longrightarrow} N_{a_{-} s}=\left\lfloor\frac{N_{ {after}} * N_{r_{-} s}}{N_{ {cap}_{-} {trs }}-N_{ {after}}} |\right. \\P_{a_{-} s}=P_{a_{n}}\end{array}\right.\)       (21)

 

5. Validation and Analysis

 

Fig. 4. Simulation scenario

Table 1. Simulation parameters

 

5.1 Validation for Compensation

 To evaluate the proposed method, we implemented and tested it on packet traces obtained from simulation. The simulation was carried out using Network Simulator (NS-2) [50]. The simulated scenario, shown in Fig. 4, consists of three nodes: n0 (server), n1 (capture point) and n2 (client), and the common simulation parameters are shown in Table 1. During simulation, total 30 TCP transfers (10 for SCA, 10 for SACK and 10 for D-SACK) were scheduled between the server and the client to transfer a fixed-size file. For each transfer, packets were dropped independently and with equal probability on network path segments before and after “P”. During transfer, we first collected packet traces from n2 and then randomly discarded some ones to simulate the situation that the capturing system is not able to capture everything. This allows us to study how the proposed method behaves when capturing system is not able to capture everything and experiences different capture rates. To test the improvement effect of the proposed method on AEPLNP, we run AEPLNP with Compensation (AEPLNP-C) and pure AEPLNP on the remaining traces, respectively. Correspondingly, the relative error is used to evaluate the accuracy of the compensation, and it is calculated as the absolute difference between the estimated loss rate and the accurate loss rate divided by the accurate loss rate:

\( {Error _{relative}}=\frac{\left|L_{ {estimated}}-L_{ {accurate}}\right|}{L_{ {accurate}}}\)       (22)

where L_estimated denotes the estimated loss rate, and Laccurate denotes the accurate loss rate.

 After the compensation, the estimated loss rates of a TCP connection on network paths before and after “P” can be calculated as:

\(L_{ {before} \_ {with}}=\frac{N_{ {before}}+N_{b\_s}}{N_{ {cap}}+N_{ {before}}+N_{ {uncaptured}}+N_{b\_ s}}\)       (23)

\(L_{ {after}\_ {with}}=\frac{N_{ {after}}+N_{a\_ s}}{N_{ {cap}}+N_{ {before}}+N_{ {uncaptured}}+N_{b\_s}}\)       (24)

 Finally, the simulation results of the compensation are shown in Fig. 5. Specifically, the first column consisting of Fig. 5(a), Fig. 5(c) and Fig. 5(e) shows the compensation results for packet loss before the capture point, while the second column consisting of Fig. 5(b), Fig. 5(d) and Fig. 5(f) shows that for after the capture point. In each row, the compensation effect under different capture rate can be seen. The first row is under capture rate of 99.9%, while the second and the third are under capture rate of 99% and 90%, respectively. In the plots, different colored lines represent the algorithms under different TCP acknowledgement mechanisms, while the solid and dotted lines of the same color represent algorithms AEPLNP-C and AEPLNP, respectively.

 

5.2 Result Analysis

 As can be seen, on the whole, although there is no increase in the proportion of accurate estimates, the compensation makes the majority of estimates closer to the accurate ones. Comparing the graphs in the same column from top to bottom, we can see that with the decline of the capture rate, AEPLNP-C is more and more superior to AEPLNP. Specifically, when the capture rate is high, e.g., 99.9% of Fig. 5(a) and Fig. 5(b), the relative errors of Lbefore_with and Lbefore_without are almost the same and stay below 10%, while the relative errors of Lafter_with and Lafter_without are also almost the same and around 10%. In this case, the compensation has no obvious effect on AEPLNP. With the further decline in capture rate, e.g., 99% of Fig. 5(c) and Fig. 5(d), whether for L_{before_with} and L_{before_without} or L_{after_with} and L_{after_without}, their relative errors all increase slightly at the majority of the parameter space. However, even in this case, AEPLNP-C still exhibits better performance compared with pure AEPLNP. When the capture rate declines to a certain value, e.g., 90% of Fig. 5(e) and Fig. 5(f)_, the relative errors of L_{before_without} and L_{after_without} are significantly higher than that of L_{before_with} and L_{after_with}, respectively. This illustrates that AEPLNP-C is more robust and therefore significantly superior to pure AEPLNP in the face of lower capture rate. After having a general description for the experiment results, we systematically analyze them from the following three aspects.

 (a) Impact of capture rate

 From Fig. 5(a) → Fig. 5(c) → Fig. 5(e), and Fig. 5(b) → Fig. 5(d) → Fig. 5(f), we can see that with the decrease in capture rate, the compensation appreciably improves the accuracy of loss estimation. Indeed, with the decrease in capture rate, the loss rate will be underestimated due to the increased uncaptured packets. In this case, the introduction of N_uncaptured, N_{b_s} and N_{a_s} made both the total number of captured packets and the estimated number of packet losses closer to their respective actual values to improve the underestimation obviously.

 (b) Impact of packet loss rate

 To fully verify the compensation effect, different packet loss rates were introduced. As can be seen, especially in Fig. 5(e) and Fig. 5(f), the lower packet loss rates outperform the higher ones in terms of compensation effect when capture rate is fixed. Actually, it can be inferred that with the packet loss rate becomes higher, the more likely the uncaptured packet contains the information indicating packet losses. When the loss of such information increases as the increase of the packet loss rate, it will become difficult to conduct effective compensation, which skews our compensation results.

 (c) Impact of TCP acknowledgement mechanism

As we can see, especially from Fig. 5(e) and Fig. 5(f), on the whole, the compensation achieved better performance on SACK and D-SACK transfers. This can be attributed to the good performance of SACK and D-SACK in handling spurious retransmissions. D-SACK accurately identifies spurious retransmissions with the help of DSACK blocks, while the duplicate left edge also makes the SACK realize a good detection for spurious retransmissions. On the contrary, for SCA, setting the threshold to 3 may be too strict to effectively detect the spurious retransmissions. Moreover, for SACK and D-SACK, the left-edge and right-edge also provide more information to help accurately determine the edges of the uncaptured data segments.

Fig. 5. Simulation results of the compensation

 

5.3 Error Sources

 For the compensation errors, we found the following three factors can account for to some extent.

 • Strict segment size: As we know, the byte length of data segment is not always equal to 1460. If it is less than 1460, the calculation accuracy of N_unfilled will be affected.

 • Packet reordering: Although rule was used to exclude the effect of packet reordering, but the effect can only be limited and cannot be completely eliminated.

 • Lost ACKs: If an ACK is lost, the data segment specified by this ACK may not be identified.

 According to the error sources listed above, one may be able to design a better algorithm by being more careful. That is, the error sources listed above provide a direction for further improving our algorithm. For instance, the calculation accuracy for Nunfilled can be further improved by replacing the static segment size (1460 bytes) with a dynamic rule that depends on the distribution of the segment size in a TCP data sequence. Similarly, using a dynamic threshold obtained from the distribution of duplicate ACK numbers may also produce more complete and effective rules for detecting packet reordering.

 

6. Conclusion

 The purpose of our study is to explore how to measure packet loss from the network intermediate point in a more robust way when facing with uncaptured packets that are inevitable in actual network. To this end, based on our previous work [1], a method of strengthening packet loss measurement from the network intermediate point is proposed and validated in this paper. Through constructing a series of heuristic rules and leveraging the binomial distribution principle, the proposed method realized the compensation for AEPLNP. And, the experimental results show that when capture rate is higher, the estimation accuracy of AEPLNP-C and AEPLNP is similar, but with the capture rate becomes lower, the former is obviously superior to the latter. Besides the capture rate, we also compared AEPLNP-C and AEPLNP by considering the packet loss rate and TCP acknowledgement mechanism. Similarly, although AEPLNP-C exhibited different performance under different packet loss rates and acknowledgement mechanisms, it is still clearly preferred over AEPLNP at the majority of parameter space. In addition, while AEPLNP-C enables relatively superior accuracy when facing with uncaptured packets, its accuracy is still expected to be further improved by overcoming the effect of the error sources listed in subsection 5.3.