[Bloat] Passive RTT measurements [was: Re: Bufferbloat Paper]

[Simon Leinen <simon.leinen@switch.ch>]

[CC'ing Shawn as the author of tcptrace]

Mark Allman writes:
[Toke Høiland-Jørgensen:]
>> Incidentally, are the data extraction scripts available somewhere?
>> Might be worthwhile to distribute them as some kind of tool that
>> people with interesting vantage points could apply to get useful data?

> Well, they are not readily available.  I used a non-public extension
> to Bro (that is not mine) to get the RTT samples.

I have found that with "tcptrace -Z -lrn", I can extract lots of RTT
samples and also some per-connection statistics (which are useful but
not as detailed as I'd like to or as in your paper).  This even works in
finite time, like a couple minutes per 100Mpacket trace of mostly HTTP
traffic taken near a popular archive server.  As a bonus, it supports IPv6.

So it seems that tcptrace (6.6.7) does *almost* what we need.  But you
probably have reasons why you haven't extended Bro rather than using
tcptrace (possibly after improving it somehow).  Care to elaborate?

Maybe we can add the necessary improvements to tcptrace and make it even
more awesome.  (I'm sure Bro is awesome too, I'm just not as familiar
with it.)

> So, that is a sticking point.  And, then there is a ball of goop to
> analyze those.  If folks have a place they can monitor and are
> interested in doing so, please contact me.

* raises hand *

> I can probably get this in shape enough to give you.  But, I doubt
> I'll be able to somehow package this for general consumption any time
> soon.

Understood.
-- 
Simon.