METHOD AND APPARATUS TO DETERMINE THE AMOUNT OF DELAY IN THE TRANSFER OF DATA ASSOCIATED WITH A TCP ZERO WINDOW EVENT OR SET OF TCP ZERO WINDOW EVENTS

• US 20120290709A1
• Filed: 05/12/2011
• Published: 11/15/2012
• Est. Priority Date: 05/12/2011
• Status: Active Grant

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: Fluke Corporation (Fortive Corp.)
• Inventors: Roberts, Doug, Prescott, Dan, Kosbab, Bruce, McManus, Shawn, Vogt, Robert, Monk, John, O'Brien, Sean
• Granted Patent: US 8,849,994 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 47/266 Stopping or restarting the source, e.g. X-on or X-off
• CPC Class Codes: H04L 47/27 Evaluation or update of window size, e.g. using information derived from acknowledged [ACK] packets

Abstract

Network monitoring method and apparatus determines the zero window event data transfer delay, reporting the amount of data transfer delay caused thereby. Non-data-transfer-delaying zero window events can be separated from those causing actual delay, allowing reporting of actual delay events separate from non-delay causing events.

Claims

1. A method of monitoring network zero window events, comprising:

determining a zero window event advertised by a receiver; and

determining whether said receiver advertised zero window event resulted in data transfer delay.

2. The method according to claim 1, wherein said determining a zero window event comprises:

determining a start time of a zero window event from a receiver; and

determining an end time of zero window event.

3. The method according to claim 1, wherein said determining whether said zero window even resulted in data transfer delay comprises:

determining whether a sender withheld data transmission until the end of the zero window event; and

reporting a duration of the zero window delay if the determining whether said zero window even resulted in data delay step determines a sender withheld data transmission during said zero window event.

4. The method according to claim 3, wherein said determining a zero window event comprises:

determining a start time of a zero window event from a receiver; and

determining an end time of zero window event.

5. The method according to claim 1, wherein said determining a zero window event comprises:

determining a start time of a zero window event from a receiver;

determining an end time of zero window event;

determining the amount of time between said start time and end time;

determining whether a subsequent transmission after said end time was a data transmission that was likely delayed during said time between said zero window start time and said zero window end time; and

if said determining whether a subsequent transmission after said end time was a data transmission that was likely delayed results in a determination of delay, reporting a zero window delay time based on said determined amount of time between said start time and end time, but if said determining whether a subsequent transmission after said end time was a data transmission that was likely delayed results in a determination of not likely delay, not reporting a zero window delay.

6. A network test instrument for determining zero window delay, comprising:

a network interface for observing network traffic; and

a processor, said processor including employing observed network traffic to;

determine a start time of a zero window event advertisement from a receiver;

determine an end time of zero window event;

determine whether a sender withheld data transmission until the end of the zero window event; and

determine a duration of the zero window delay if the sender withheld data transmission.

7. A network test instrument according to claim 6, wherein said processor determines a zero window event by:

determining a start time of a zero window event from a receiver; and

determining an end time of zero window event.

8. A network test instrument according to claim 6, wherein said processor determines whether said zero window even resulted in data transfer delay by:

determining whether a sender withheld data transmission after the end of the zero window; and

reporting a duration of the zero window delay if the determining whether said zero window even resulted in data transfer delay step determines a sender withheld data transmission during said zero window event.

9. A network test instrument according to claim 8, wherein said processor determines a zero window event by:

determining a start time of a zero window event from a receiver; and

determining an end time of zero window event.

10. A network test instrument according to claim 6, wherein said processor determines a zero window event by:

determining a start time of a zero window event from a receiver;

determining an end time of zero window event;

determining the amount of time between said start time and end time;

determining whether a subsequent transmission after said end time was a data transmission that was likely delayed during said time between said zero window start time and said zero window end time; and

if said determining whether a subsequent transmission after said end time was a data transmission that was likely delayed results in a determination of delay, reporting a zero window delay time based on said determined amount of time between said start time and end time, but if said determining whether a subsequent transmission after said end time was a data transmission that was likely delayed results in a determination of not likely delay, not reporting a zero window delay.

11. A system for determining zero window delay, comprising:

a network monitor for observing network traffic at a first location on a network; and

a processor at a second location on the network different from said first location, said processor including employing observed network traffic to;

determine a start time of a zero window event advertisement from a receiver;

determine an end time of zero window event;

determine whether a sender withheld data transmission until the end of the zero window event; and

determine a duration of the zero window delay if the sender withheld data transmission.

12. A system according to claim 11, wherein said processor determines a zero window event by:

determining a start time of a zero window event from a receiver; and

determining an end time of zero window event.

13. A system according to claim 11, wherein said processor determines whether said zero window event resulted in data transfer delay by:

determining whether a sender withheld data transmission until the end of the zero window event; and

reporting a duration of the zero window delay if the determining whether said zero window event resulted in data transfer delay step determines a sender withheld data transmission during said zero window event.

14. A system according to claim 13, wherein said processor determines a zero window event by:

determining a start time of a zero window event from a receiver; and

determining an end time of zero window event.

15. A system test instrument according to claim 11, wherein said processor determines a zero window event by:

determining a start time of a zero window event from a receiver;

determining an end time of zero window event;

determining the amount of time between said start time and end time;

determining whether a subsequent transmission after said end time was a data transmission that was likely delayed during said time between said zero window event start time and said zero window event end time; and

if said determining whether a subsequent transmission after said end time was a data transmission that was likely delayed results in a determination of delay, reporting a zero window delay based on said determined amount of time between said start time and end time, but if said determining whether a subsequent transmission after said end time was a data transmission that was likely delayed results in a determination of not likely delay, not reporting a zero window delay.