Improving passive estimation of TCP round-trip times using TCP timestamps

In order to make accurate routing and queueing decisions, passive measurement of TCP flows is becoming increasingly common. Passive measurement techniques have the advantage that they do not inject extra traffic into the connection. These techniques work by associating packet pairs (e.g., a data packet and its acknowledgement during slow start) and and then measuring the RTT for those pairs. Unfortunately, such association is difficult in the general case, primarily because an acknowledgement can rarely be associated with the data packets that it triggers. This paper presents a new passive measurement technique that associates packet pairs using TCP timestamps. The basic idea is to capture all packets that pass through the measurement point, and match two pairs of packets, where one timestamp is common to both pairs. Unlike previous techniques, this allows us to obtain samples throughout the lifetime of the connection. Results show that our technique has less than a 1% error on average for an ftp download. As most end hosts currently employ the timestamp option, our technique is widely applicable in practice.