Packet analysis in congested networks

This paper proposes new methods of measuring the Internet traffic. These are useful to analysing the network status, especially when the traffic is heavy, i.e. the network is congested. Our first method realizes a light weight measurement which counts only TCP flags, which occupies 6 bits in a TCP packet. Based on the simple flag counts, we can tell whether the network is congested or not. Moreover, we can estimate the average throughput of a network connection based on the flag count. Our second method analyses a sequence of TCP packets based on an automaton, or a protocol machine. The original automaton has been used in the formal specification of TCP protocol. However, it is not applicable to the real Internet traffic. We have improved the automaton in various ways, and established a modified machine. Using the new machine, we can analyse the Internet traffic even if there are packet losses.