Side_1_360

4.5 Packet Attributes and

Characterization of Packets

A packet travelling through the network domain

is characterised by certain attributes. For a

packet11), p, the following functions are exam-

ples of definitions that characterize packet prop-

erties:

• src(p) – returns the source IP address of
  packet p;


• dst(p) – returns the destination IP address of
  packet p;


• pri(p) – returns the priority level of packet p;


• m(p) – returns the total length of the IP packet
  pin bytes;


• pth(p) – returns the path that packet pshall
  follow through the network domain. The path
  is defined by the sequence of nodes that
  should be traversed by the packet as deter-
  mined by the routing algorithm;


• lnk(p) – returns the links that should be tra-
  versed along the path of packet p.

Generally, every header field of a packet corre-

sponds to an attribute. Note that whether a cer-

tain function exists or not depends on the con-

text12). Further, functions that return the time a

given event took place are defined. These func-

tions are needed to describe network-level met-

rics that depend on the time certain events hap-

pened, as are metrics like unidirectional packet

delay and round-trip time.

• ta(p, n) denotes the time of arrival for packet
  p∈Rn(t 1 , t 2 ) at node n∈V. The time of
  arrival is defined as the time when the last bit
  of packet pwas received by node n.


• td(p, n) denotes the time of departure for
  packet p∈Sn(t 1 , t 2 ) from node n∈V. The
  time of departure is defined as the time when
  the last bit of packet pwas transmitted from
  node n.

For a packet, p, that was lost in node nor on link

l= (n, k) the time the loss occurred is referred to

as ta(p, n) and td(p, n), respectively.

By using the definitions from the previous sec-

tions of this chapter, various sets of events that

satisfy more complex properties can now be

expressed.

4.5.1 Unusual Network Behavior

Unusual network behavior13)[Paxson97] in-

cludes packet re-ordering, packet misdirection,

packet replication and packet corruption. These

unexpected behaviors can all be expressed by the

model. Note that the model does not explicitly

define how to handle unusual network behavior.

However, the model allows various approaches

to be precisely expressed. Below are some ex-

amples of how the conceptual model is applied.

• A packet, p, is misdirected if it is received by
  a node, n, that is not a part of its path, pth(p).
  The set of misdirected packets received by
  node nin time window [t 1 , t 2 > is defined by
  {p|p∈Rn(t 1 , t 2 , ∧n∉pth(p)}.


• A packet, p, is replicated if the network deliv-
  ers multiple copies of the same14)packet. The
  set of replicated packets received by node nin
  time window [t 1 , t 2 > is defined by {p|p∈
  Rn(t 1 , t 2 ) ∧∃pj∈Rn(t 1 , t 2 ) such that p≡pj}.

Figure 4.2 Fundamental sets
of events as observed at node n

Rn(t 1 , t 2 ) Node n Sn(t 1 , t 2 )

Xn(t 1 , t 2 )

11)A packet, p, is considered to be unique. That is, it is assumed that packets are uniquely identified.

However, in a real network the ability to uniquely identify a packet depends on which attributes

that are available.

12)In a real network, the measurement instrumentation decides which attributes that are observable.

However, the conceptual model provides a flexible framework that can be adjusted according to

an actual measurement set-up.

13)It may be noted that packet re-ordering is usual behavior in a network with service differentia-

tion. Further, packet corruption not detected from the packet header checksum is not considered.

14)The definition of multiple copies of the same packet depends on which packet attributes that are

available. Generally, two packets are equal if all header fields are equal. This is denoted by

pi≡pj. Note that packets with equal attributes can be differentiated by the time of observation.