Measuring IP and TCP behavior on edge nodes with Tstat

Field measurements have always been the starting point for network design and planning; however, their statistical analysis beyond simple traffic volume estimation is not so common. In this paper we present and discuss Tstat, a tool for the collection and statistical analysis of TCP/IP traffic, which, in addition to recognized performance figures, infers TCP connection status from traces. Besides briefly discussing its rationale and use, we present part of the performance figures that can be obtained, and we highlight the insight that such figures can give on TCP/IP protocols and the Internet, thereby supporting the usefulness of a widespread use of Tstat or similar tools.Analyzing Internet traffic is difficult because a large amount of performance figures can be devised in TCP/IP networks, but also because many performance figures can be derived only if both directions of bidirectional traffic are jointly considered. Tstat automatically correlates incoming and outgoing packets. Sophisticated statistics, obtained through data correlation between incoming and outgoing traffic, give reliable estimates of the network performance also from the user perspective.Tstat computes over 80 different performance statistics at both the IP and TCP layers, allowing a good insight in the network performance. To support the latter statement, we discuss several of these figures computed on traffic measurements performed for a time period equivalent to more than three months spread during the years 2000–2003 on the access link of Politecnico di Torino.