[1] Peng Yanbing, Gong Jian, Ding Wei,. TCP flow identification by sequence and acknowledgement number [J]. Journal of Southeast University (English Edition), 2005, 21 (4): 414-418. [doi:10.3969/j.issn.1003-7985.2005.04.008]
Copy
TCP flow identification by sequence and acknowledgement number(
)
基于顺序号和确认号的TCP流标识
)Journal of Southeast University (English Edition)[ISSN:1003-7985/CN:32-1325/N]
- Volumn:
- 21
- Issue:
- 2005 4
- Page:
- 414-418
- Research Field:
- Computer Science and Engineering
- Publishing date:
- 2005-12-30
Info
- Title:
- TCP flow identification by sequence and acknowledgement number
- 基于顺序号和确认号的TCP流标识
- Author(s):
- Peng Yanbing; Gong Jian; Ding Wei
- Department of Computer Science and Engineering, Southeast University, Nanjing 210096, China
- Keywords:
- flow labelling; flow ID; observing window; TCP; IP
- PACS:
- TP393
- DOI:
- 10.3969/j.issn.1003-7985.2005.04.008
- Abstract:
- To reduce the TCP flow processing cost, some bit patterns selected from the TCP/IP packet can be used as TCP flow identification.Based on the entropy and randomness analysis of the distribution of sequence number(SN)and acknowledgement number(AN)in the first packet of a TCP flow, this paper proposes a new uniform TCP flow identification by sequence and acknowledgement number(FIDSAN)to the heavy-tailed IP or TCP traffic.The experimental results suggest that some bits in the TCP sequence number and acknowledgment number can be selected out as flow ID with acceptable confliction probability.The bit length of flow ID selected under given confliction probability can be conducted from an equation deduced from the observing window and flow ID range.FIDSAN has low computation cost in the comparison with the traditional methods, such as 5-tuple, CRC, and Checksum etc.
- 为了降低TCP流的处理开销, 可以从TCP/IP报文中选取某些位串来作为流的标识.从位熵和随机性的角度分析了TCP流首报文的顺序号(SN)和确认号(AN)的分布, 提出了一种从重尾的IP或TCP流里获得随机均匀的流标识的新方法(FIDSAN).实验结果表明, 在可以接受的冲突概率下, TCP流首报文的顺序号和确认号的部分高位比特可以用来作为流标签.给定冲突概率时, 该流标识的比特长度可以根据一个由观察窗口和流ID值域导出的关系式求出.与TCP五元组, CRC, Checksum等比较发现, FIDSAN具有更低的计算开销.
References:
[1] Sarvotham S, Riedi R, Baraniuk R.Connection-level analysis and modeling of network traffic [A].In:ACM SIGCOMM Internet Measurement Workshop [C].New York: ACM Press, 2001.99-103.
[2] Kohler E, Li J Y, Paxson V, et al.Observed structure of addresses in IP traffic[A].In:Internet Measurement Workshop[C].New York: ACM Press, 2002.253-266.
[3] Cao Z, Wang Z, Zegura E.Performance of hasing-based schemes for Internet load balancing [A].In:Proceedings of IEEE Infocom [C].Tel Aviv, Israel, 2000.332-341.
[4] Rajahalme J, Conta A, Carpenter B, et al.RFC3697 IPv6 flow label specification [S]. Internet Society, 2004.
[5] Partridge C.RFC1809 Using the flow label field in IPv6 [S].Internet Society, 1995.
[6] Postel J.RFC793 Transmission control protocol [S].Internet Society, 1981.
[7] Cheng G, Gong J, Ding W.Network traffic sampling measurement model on packet identification [J].Chinese Journal of Electronics, 2002, 30(12A):83-89.(in Chinese)
[8] Zhu X L.Fundamentals of applied information theory [M].Beijing: Tsinghua University Press, 2001.16.(in Chinese)
Memo
- Memo:
- Biographies: Peng Yanbing(1975—), male, gradute;Gong Jian(corresponding author), male, doctor, professor, jgong@njnet.edu.cn.