Method and apparatus to determine the amount of delay in the transfer of data associated with a TCP zero window event or set of TCP zero window events

• US 8,849,994 B2
• Filed: 05/12/2011
• Issued: 09/30/2014
• Est. Priority Date: 05/12/2011
• Status: Active Grant

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: Fluke Corporation (Fortive Corp.)
• Inventors: Roberts, Doug, Prescott, Dan, Kosbab, Bruce, McManus, Shawn, Vogt, Robert, Monk, John, O'Brien, Sean
• Primary Examiner(s): Gillis, Brian J
• Assistant Examiner(s): Keller, Michael A
• Application Number:
  US13/106,827
• Publication Number:
  US 20120290709A1
• Time in Patent Office: 1,237 Days
• Field of Search: 370/252, 709201-253
• US Class Current: 709/224
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 47/266 Stopping or restarting the source, e.g. X-on or X-off
• CPC Class Codes: H04L 47/27 Evaluation or update of window size, e.g. using information derived from acknowledged [ACK] packets

Abstract

Network monitoring method and apparatus determines the zero window event data transfer delay, reporting the amount of data transfer delay caused thereby. Non-data-transfer-delaying zero window events can be separated from those causing actual delay, allowing reporting of actual delay events separate from non-delay causing events.

Claims

1. A method of monitoring network zero window events via an interface connection to a network for observing traffic, comprising:

determining a zero window event advertised by a receiver;

determining whether a sender withheld data transmission until the end of the zero window event;

determining whether the zero window event caused said data transmission to be withheld; and

reporting a duration of a zero window delay only when it is determined the sender withheld said data transmission until the end of the zero window event.

2. The method according to claim 1, further comprising:

determining a start time of the zero window event from a receiver, and determining an end time of the zero window event.

3. The method according to claim 2, wherein said reporting a duration of a zero window delay comprises determining the amount of time between said start time and end time.

4. The method according to claim 2, wherein said determining whether a zero window event caused said data transmission to be withheld comprises determining whether a subsequent transmission after said end time was a data transmission delayed during said time between said zero window start time and said zero window end time.

5. A network test instrument for determining zero window delay, comprising:

a network interface for observing network traffic; and

a processor, said processor including employing observed network traffic to;

determine a start time of a zero window event advertisement from a receiver;

determine an end time of the zero window event;

determine whether a sender withheld data transmission until the end of the zero window event;

determine whether the zero window event caused said data transmission to be withheld; and

report a duration of a zero window delay only when it is determined the sender withheld said data transmission until the end of the zero window event.

6. A network test instrument according to claim 5, wherein said processor determines whether the zero window event caused said data transmission to be withheld by determining whether a subsequent transmission after said end time was a data transmission that was delayed between said zero window start time and said zero window end time and wherein said processor reports a duration of the zero window delay by:

determining the amount of time between said start time and end time; and

if said determining whether a subsequent transmission after said end time was a data transmission that was delayed results in a determination of delay, reporting the duration of the zero window delay based on said determined amount of time between said start time and end time.

7. A system for determining zero window delay, comprising:

a network monitor for observing network traffic at a first location on a network; and

a processor at a second location on the network different from said first location, said processor including employing observed network traffic to;

determine a start time of a zero window event advertisement from a receiver,

determine an end time of the zero window event;

determine whether a sender withheld data transmission until the end of the zero window event;

determine whether the zero window event caused said data transmission to be withheld; and

report a duration of a zero window delay only when it is determined the sender withheld said data transmission until the end of the zero window event.

8. A system test instrument according to claim 7, wherein said processor determines whether the zero window event caused said data transmission to be withheld by determining whether a subsequent transmission after said end time was a data transmission that was delayed between said zero window event start time and said zero window event end time;

and if said determining whether a subsequent transmission after said end time was a data transmission that was delayed results in a determination of delay, said processor reports the zero window delay based on an amount of time between said start time and end time.