Method for collecting statistical traffic data

• US 7,010,592 B2
• Filed: 03/29/2001
• Issued: 03/07/2006
• Est. Priority Date: 03/29/2000
• Status: Expired due to Fees

• Current Assignee: DDI Corporation (TTM Technologies Incorporated)
• Original Assignee: DDI Corporation (TTM Technologies Incorporated)
• Inventors: Idoue, Akira, Kato, Toshihiko, Ogishi, Tomohiko, Hasegawa, Toru
• Primary Examiner(s): Caldwell, Andrew
• Assistant Examiner(s): VU, THONG H
• Application Number:
  US09/820,008
• Publication Number:
  US 20010027485A1
• Time in Patent Office: 1,804 Days
• Field of Search: 709/203, 709/229, 709224-226, 709/238, 709234-237, 370/389, 370/342, 370/466, 370/352, 370234-236, 370/230, 725/16, 714/752, 375/225, 713/201, 718/205
• US Class Current: 709/224
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Abstract

As shown in FIG. 2, when the SYN segment is detected, the amount of transmitted segment from the side which sent the detected SYN segment is obtained by counting the continuously detected DATA segments for collecting the traffic in a certain direction where it is impossible to directly capture the traffic. Further, the amount [ini_sdt] of the transmitted bytes from the side which sent the detected SYN segment is obtained by calculating the equation [ini_sdt]=[SEQn+LENn]−[SEQ1]. Wherein, [SEQ1] is the sequence number of the first detected DATA segment, [SEQn] is the sequence number of the last detected DATA segment and [LENn] is the user data length of the last detected DATA segment.

Claims

1. Method for collecting statistical traffic data comprising steps of:

detecting an SYN segment from a traffic in one of two directions on the Internet line;

detecting a DATA segment, which belongs to same connection as the detected SYN segment, from said traffic; and

obtaining at least one of an amount of transmitted segment at a side which sent the detected SYN segment, and an amount of transmitted bytes at said side;

wherein said amount of transmitted segment being obtained by counting a total amount of said detected DATA segment, and said amount of transmitted bytes being obtained by calculating a difference between a sequence number of the first detected DATA segment, and a sum of a sequence number of the last detected DATA segment and a user data length of said last detected DATA segment.

2. Method for collecting statistical traffic data comprising steps of:

detecting an SYN+ACK segment from a traffic in one of two directions on the Internet line;

detecting a DATA segment, which belongs to same connection as the detected SYN+ACK segment, from said traffic; and

obtaining at least one of an amount of transmitted segment at a side which sent the detected SYN+ACK segment, and an amount of transmitted bytes at said side;

wherein said amount of transmitted segment being obtained by counting a total amount of said detected DATA segments, and said amount of transmitted bytes being obtained by calculating a difference between a sequence number of the first detected DATA segment, and a sum of a sequence number of the last detected DATA segment and a user data length of said last detected DATA segment.

3. Method for collecting statistical traffic data comprising steps of:

detecting an SYN segment from a traffic in one of two directions on the Internet line;

detecting an ACK segment and a DATA segment, each of which belongs to same connection as the detected SYN segment, from said traffic; and

calculating, as an amount of received data at a side which sent the detected SYN segment, a difference between an acknowledgment number of the first detected ACK segment or DATA segment and an acknowledgement number of the last detected ACK segment or DATA segment.

4. Method for collecting statistical traffic data comprising steps of:

detecting an SYN+ACK segment from a traffic in one of two directions on the Internet line;

detecting an ACK segment and a DATA segment, each of which belongs to same connection as the detected SYN+ACK segment, from said traffic; and

calculating, as an amount of received data at a side which sent the detected SYN+ACK segment, a difference between an acknowledgment number of the first detected ACK segment or DATA segment and an acknowledgement number of the last detected ACK segment or DATA segment.

5. Method for collecting statistical traffic data comprising steps of:

detecting an SYN segment from a traffic in one of two directions on the Internet line;

detecting a DATA segment, which belongs to same connection as the detected SYN segment, from said traffic;

determining a sequence number of a DATA segment to be sent next, at every detection of the DATA segment, based on a sequence number of the detected DATA segment;

judging, at every detection of the DATA segment, whether a sequence number of the newly detected DATA segment is less than said determined sequence number at the last DATA segment detection; and

obtaining, when the sequence number of the newly detected DATA segment is less than said determined sequence number, at least one of a new amount of re-transmitted segment at a side which sent the detected SYN segment, and a new amount of re-transmitted bytes at said side;

wherein said new amount of re-transmitted segment being obtained by adding 1 to the last obtained amount of re-transmitted segment, and said new amount of re-transmitted bytes being obtained by adding a smaller one out of a first value and a second value to the last obtained amount of re-transmitted segment, wherein the first value being a difference between said determined sequence number and a sequence number of said newly detected DATA segment, and the second value being a user data length of said newly detected DATA segment.

6. Method for collecting statistical traffic data comprising steps of:

detecting an SYN+ACK segment from a traffic in one of two directions on the Internet line;

detecting a DATA segment, which belongs to same connection as the detected SYN+ACK segment, from said traffic;

determining a sequence number of a DATA segment to be sent next, at every detection of the DATA segment, based on a sequence number of the detected DATA segment;

judging, at every detection of the DATA segment, whether a sequence number of the newly detected DATA segment is less than said determined sequence number at the last DATA segment detection; and

obtaining, when the sequence number of the newly detected DATA segment is less than said determined sequence number, at least one of a new amount of re-transmitted segment at a side which sent the detected SYN+ACK segment, and a new amount of re-transmitted bytes at said side;

wherein said new amount of re-transmitted segment being obtained by adding 1 to the last obtained amount of re-transmitted segment, and said new amount of re-transmitted bytes being obtained by adding a smaller one out of a first value and a second value to the last obtained amount of re-transmitted segment, wherein the first value being a difference between said determined sequence number and a sequence number of said newly detected DATA segment, and the second value being a user data length of said newly detected DATA segment.

7. Method for collecting statistical traffic data comprising steps of:

detecting an SYN segment from a traffic in one of two directions on the Internet line;

detecting an ACK segment, which belongs to same connection as the detected SYN segment, from said traffic;

determining an acknowledgment number of an ACK segment to be sent next and a window size of an ACK segment having the maximum acknowledgment number, at every detection of the ACK segment, based on an acknowledgment number of the detected ACK segment;

judging, at every detection of the ACK segment, whether both of an acknowledgment number and a window size of the newly detected ACK segment are equal to said determined acknowledgment number and said determined window size at the last ACK segment detection; and

obtaining, when both of the acknowledgment number and the window size of the newly detected two or more ACK segments are equal to said determined acknowledgment number and said determined window size, a new amount of missing DATA segment at a side which sent the detected SYN segments, by adding 1 to the last obtained amount of missing DATA segment.

8. Method for collecting statistical traffic data comprising steps of:

detecting an SYN+ACK segment from a traffic in one of two directions on the Internet line;

detecting an ACK segment, which belongs to same connection as the detected SYN+ACK segment, from said traffic;

determining an acknowledgment number of an ACK segment to be sent next and a window size of an ACK segment having the maximum acknowledgment number, at every detection of the ACK segment, based on an acknowledgment number of the detected ACK segment;

judging, at every detection of the ACK segment, whether both of an acknowledgment number and a window size of the newly detected ACK segment are equal to said determined acknowledgment number and said determined window size at the last ACK segment detection; and

obtaining, when both of the acknowledgment number and the window size of the newly detected two or more ACK segments are equal to said determined acknowledgment number and said determined window size, a new amount of missing DATA segment at a side which sent the detected SYN+ACK segments, by adding 1 to the last obtained amount of missing DATA segment.

9. Method for collecting statistical traffic data comprising steps of:

detecting an SYN segment from a traffic in one of two directions on the Internet line;

detecting continuous plural DATA segments and continuous plural ACK segments in succession to the DATA segments, all of which belong to same connection as the detected SYN segment, from said traffic; and

obtaining at least one of an HTTP response time at a side which sent the detected SYN segment, and an HTTP throughput at said side;

wherein said HTTP response time being obtained by calculating a time difference from the last detection of the DATA segment to the first detection of the ACK segment, and said HTTP throughput being obtained by calculating a ratio of a difference, between an acknowledgement number of the first detected ACK segment and an acknowledgement number of the last detected ACK segment, to a time difference from the first detection of the ACK segment to the last detection of the ACK segment.

10. Method for collecting statistical traffic data comprising steps of:

detecting an SYN+ACK segment from a traffic in one of two directions on the Internet line;

detecting continuous plural ACK segments and continuous plural DATA segments in succession to the ACK segments, all of which belong to same connection as the detected SYN+ACK segment, from said traffic; and

obtaining at least one of an HTTP response time at a side which sent the detected SYN+ACK segment, and an HTTP throughput at said side;

wherein said HTTP response time being obtained by calculating a time difference from the last detection of the ACK segment to the first detection of the DATA segment, and said HTTP throughput being obtained by calculating a ratio of a difference, between a sequence number of the first detected DATA segment and a sum of a sequence number of the last detected DATA segment and a user data length of the last detected DATA segment, to a time difference from the first detection of the DATA segment to the last detection of the DATA segment.

11. Method for collecting statistical traffic data comprising steps of:

detecting an SYN+ACK segment from a traffic in one of two directions on the Internet line;

detecting continuous plural ACK segments, which belong to same connection as the detected SYN+ACK segment, from said traffic; and

calculating, as an FTP throughput at a side which sent the detected SYN+ACK segment, a ratio of a difference, between an acknowledgement number of the first detected ACK segment and an acknowledgement number of the last detected ACK segment, to a time difference from the first detection of the ACK segment to the last detection of the ACK segment.

12. Method for collecting statistical traffic data comprising steps of:

detecting an SYN segment from a traffic in one of two directions on the Internet line;

detecting continuous plural DATA segments, which belong to same connection as the detected SYN segment, from said traffic; and

calculating, as an FTP throughput at a side which sent the detected SYN segment, a ratio of a difference, between a sequence number of the first detected DATA segment and a sum of a sequence number of the last detected DATA segment and a user data length of the last detected DATA segment, to a time difference from the first detection of the DATA segment to the last detection of the DATA segment.