M&M: A Passive Toolkit for Measuring, Correlating, and Tracking Path Characteristics

This paper presents M&M, a passive measurement toolkit suitable for large-scale studies of Internet path characteristics. The multiQ tool uses equally-spaced mode gaps in TCP flows’ packet interarrival time distributions to detect multiple bottleneck capacities and their relative order. Unlike previous tools, multiQ can discover up to three bottlenecks from the tcpdump trace of a single flow, and can work with acknowledgment as well as data interarrivals. We also describe the mystery tool, a simple TCP loss event, packet loss, and RTT analyzer designed to work in concert with multiQ. The M&M toolkit can measure simple path properties; correlate different types of measurement of the same path, producing new kinds of results; and because M&M is passive, it can use publicly-available traces to track the value of a measurement over multiple years. We validate our tools in depth using the RON overlay network [4], which provides more than 400 heterogeneous Internet paths and detailed information about their characteristics. We compare multiQ with Nettimer and Pathrate, two other capacity measurement tools, in the first wide-area, real-world validation of capacity measurement techniques. Each tool accurately discovers minimum capacities (85% of measurements are within 10% of the true value); multiQ additionally discovers multiple bottlenecks and their orderings. We also use our toolkit to perform several measurement studies using a reservoir of 375 million traced packets spanning the last two years. Among the results of these studies are that bottleneck capacity on our traced links has gone up by around an order of magnitude from 2002 to 2004, and that differences in levels of statistical multiplexing on 10 Mb/s and 100 Mb/s bottleneck links result in flows over those links having similar fair-share bandwidths.