[1] Peng Yanbing, Gong Jian, Ding Wei,. TCP flow identification by sequence and acknowledgement number [J]. Journal of Southeast University (English Edition), 2005, 21 (4): 414-418. [doi:10.3969/j.issn.1003-7985.2005.04.008]

Copy

TCP flow identification by sequence and acknowledgement number()

Share：

Journal of Southeast University (English Edition)[ISSN:1003-7985/CN:32-1325/N]

Volumn:

21

Issue:

2005 4

Page:

414-418

Research Field:

Computer Science and Engineering

Publishing date:

2005-12-30

Info

Title:

TCP flow identification by sequence and acknowledgement number

Author(s):

Peng Yanbing;  Gong Jian;  Ding Wei

Department of Computer Science and Engineering, Southeast University, Nanjing 210096, China

Keywords:

flow labelling;  flow ID;  observing window;  TCP;  IP

PACS:

TP393

DOI:

10.3969/j.issn.1003-7985.2005.04.008

Abstract:

To reduce the TCP flow processing cost, some bit patterns selected from the TCP/IP packet can be used as TCP flow identification.Based on the entropy and randomness analysis of the distribution of sequence number(SN)and acknowledgement number(AN)in the first packet of a TCP flow, this paper proposes a new uniform TCP flow identification by sequence and acknowledgement number(FIDSAN)to the heavy-tailed IP or TCP traffic.The experimental results suggest that some bits in the TCP sequence number and acknowledgment number can be selected out as flow ID with acceptable confliction probability.The bit length of flow ID selected under given confliction probability can be conducted from an equation deduced from the observing window and flow ID range.FIDSAN has low computation cost in the comparison with the traditional methods, such as 5-tuple, CRC, and Checksum etc.

References:

[1] Sarvotham S, Riedi R, Baraniuk R.Connection-level analysis and modeling of network traffic [A].In:ACM SIGCOMM Internet Measurement Workshop [C].New York: ACM Press, 2001.99-103.
[2] Kohler E, Li J Y, Paxson V, et al.Observed structure of addresses in IP traffic[A].In:Internet Measurement Workshop[C].New York: ACM Press, 2002.253-266.
[3] Cao Z, Wang Z, Zegura E.Performance of hasing-based schemes for Internet load balancing [A].In:Proceedings of IEEE Infocom [C].Tel Aviv, Israel, 2000.332-341.
[4] Rajahalme J, Conta A, Carpenter B, et al.RFC3697 IPv6 flow label specification [S]. Internet Society, 2004.
[5] Partridge C.RFC1809 Using the flow label field in IPv6 [S].Internet Society, 1995.
[6] Postel J.RFC793 Transmission control protocol [S].Internet Society, 1981.
[7] Cheng G, Gong J, Ding W.Network traffic sampling measurement model on packet identification [J].Chinese Journal of Electronics, 2002, 30(12A):83-89.(in Chinese)
[8] Zhu X L.Fundamentals of applied information theory [M].Beijing: Tsinghua University Press, 2001.16.(in Chinese)

Memo

Memo:

Biographies: Peng Yanbing(1975—), male, gradute;Gong Jian(corresponding author), male, doctor, professor, jgong@njnet.edu.cn.

Common functions