Subject: Determining the number of lost packets

From: Bogdan Ghita <[email-masked]>
Date: Wed, 24 May 2000 12:57:27 +0100

Hello everybody

- if the content of this e-mail is not relevant to the topic of the
list, then, if possible, tell me if there is any other mailing list
where I could ask the question - 

I am trying to determine the number of lost packets for TCP connections.
I created an emulated 'lossy link' (10% packet loss) using Nistnet, and
downloaded a file through this link. I get the number of 'lost' packets
within a connection from the program, then compare it to my estimates.
The monitoring point is AFTER the lossy link, on the direction of the
download.
I noticed that the nearest estimator is the number of 'inverted'
packets, as in the following example:
12:41:35.990251 50.234.ftp-data > ac.uk.1096: . 5841:7301(1460) ack 1
win 8760 (DF)
12:41:35.990294 ac.uk.1096 > 50.234.ftp-data: . 1:1(0) ack 7301 win
30660 (DF) [tos 0x8] 
12:41:36.294567 141.163.50.234.ftp-data > ac.uk.1096: . 8761:10221(1460)
ack 1 win 8760 (DF)
12:41:36.294616 ac.uk.1096 > 50.234.ftp-data: . 1:1(0) ack 7301 win
30660 (DF) [tos 0x8] 
12:41:38.919563 50.234.ftp-data > ac.uk.1096: P 7301:8761(1460) ack 1
win 8760 (DF)

The packet containing data 7301 - 8761 seems to be inverted but, in
fact, it was lost, and this is a retransmission.

The main problem with counting the inverted packets is that it fails to
see a lost packet if it is at the end of a transmission window (there is
no packet sent after it, no duplicate ACK and the sender retransmits it
when the timer expires), which makes it inaccurate.

I have tried also with the Estimated Timeout, but, because I am not
measuring it right at the sending endpoint, the measurement is not as
acurate as it should be, and it gives me some 'false alarms'.

The question is: are there any good estimators for the number of lost
packets?
Any suggestions / relevant papers are welcome as well.

Than kyou very much for your time

Best regards
Bogdan Ghita

---

From: "Eric A. Hall" <[email-masked]>
Date: Wed, 24 May 2000 08:33:24 -0700

> packets? Any suggestions / relevant papers are welcome as well.
> 

I would start by counting the duplicate ACKs. There are of course some 
exclude cases but by and large the presence of multiple ACKs is what TCP
uses to indicate loss and that seems to be what you're really interested
in, right?

-- 
Eric A. Hall                                            [email-masked]
+1-650-685-0557                                    http://www.ehsco.com