A non-instrusive, wavelet-based approach to detecting network performance problems

摘要

The main objective of this paper is to explore how much information about the characteristics of end-to-end network paths can be inferred from relying solely on passive packet-level traces of existing traffic collected from a single tap point in the network. To this end, we show that a number of structural properties of aggregate TCP/IP packet traces reveal themselves and can be compared across different time periods and across paths of the traffic destined to different subnets by exploiting the built-in scale-localization ability of wavelets. In turn, these structural properties and the resulting comparisons suggest the feasibility of new approaches for inferring and detecting qualitative aspects of network performance in a fashion that is similar to relying on active measurements, but without disturbing or biasing the metrics of interest. To showcase the feasibility, we developed WIND, a prototype tool for Wavelet-based INference for Detecting network performance problems and illustrate its capabilities to detect anomalies in underlying network path conditions with two examples of passively measured packet traces from two different networking environments. We address and experiment with ways of validating the output of WIND and end with a discussion of the potential of full-fledged wavelet-based analysis (i.e., the ability to localize a signal in scale and time) for future measurement studies.