M&M: A Passive Toolkit for Measuring, Correlating, and Tracking Path Characteristics

Abstract

This paper presents M&M, a passive measurement toolkitsuitable for large-scale studies of Internet path characteristics.The multiQ tool uses equally-spaced mode gaps in TCP flows’packet interarrival time distributions to detect multiple bottleneckcapacities and their relative order. Unlike previous tools,multiQ can discover up to three bottlenecks fromthe tcpdumptrace of a single flow, and can work with acknowledgment aswell as data interarrivals.We also describe the mystery tool, asimple TCP loss event, packet loss, and RTT analyzer designedto work in concert with multiQ. The M&M toolkit can measuresimple path properties; correlate different types of measurementof the same path, producing new kinds of results; andbecause M&M is passive, it can use publicly-available traces totrack the value of a measurement over multiple years.We validate our tools in depth using the RON overlay network[4], which provides more than 400 heterogeneous Internetpaths and detailed information about their characteristics.We compare multiQ with Nettimer and Pathrate, two othercapacity measurement tools, in the first wide-area, real-worldvalidation of capacity measurement techniques. Each tool accuratelydiscovers minimum capacities (85% of measurementsare within 10%of the true value); multiQ additionally discoversmultiple bottlenecks and their orderings. We also use ourtoolkit to perform several measurement studies using a reservoirof 375 million traced packets spanning the last two years.Among the results of these studies are that bottleneck capacityon our traced links has gone up by around an order ofmagnitudefrom 2002 to 2004, and that differences in levels of statisticalmultiplexing on 10 Mb/s and 100 Mb/s bottleneck links resultin flows over those links having similar fair-share bandwidths.