An analysis of TCP reset behaviour on the internet

ABSTRACT

This paper presents a one-year study of Internet packet traffic from a large campus network, showing that 15-25% of TCP connections have at least one TCP RST (reset). Similar results have also been observed from measurements of other Internet links. The results in this paper show that reset connections arise from local events such as network outages, attacks, or reconfigurations, as well as from global trends in TCP usage. In particular, we identify application-level Web behaviour as the primary contributor to the global trend in reset TCP connections. The most prevalent anomaly is the absence of the normal connection termination handshake. Instead, connections are often reset by the client. We believe that particular implementations of HTTP/TCP connection management cause this global trend.

REFERENCES

• 1: M. Aron and P. Druschel, "TCP Implementation Enhancements for Improving Webserver Performance", Rice Computer Science Technical Report TR99-335, July 1999.
• 2: Paul Barford , Mark Crovella, Critical path analysis of TCP transactions, Proceedings of the conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, p.127-138, August 28-September 01, 2000, Stockholm, Sweden
• 3: T. Faber, J. Touch, and W. Yue, "The TIME-WAIT state in TCP and Its Effects on Busy Servers", Proceedings of IEEE INFOCOM, Vol. 3, pp. 1573--1583, March 1999.
• 4: S. Floyd, "Inappropriate TCP Resets Considered Harmful", RFC 3360, August 2002, http://www.ietf.org/rfc/rfc3360.txt
• 5: C. Fraleigh, S. Moon, B. Lyles, C. Cotton, M. Khan, D. Moll, R. Rockell, T. Seely, and C. Diot, "Packet-Level Traffic Measurements from the Sprint IP Backbone", IEEE Network, Vol. 17, No. 6, November/December 2003.
• 6: Microsoft Developer Network, Winsock shutdown function, http://msdn.microsoft.com/library/enus/winsock/winsock/shutdown_2.asp
• 7: Netcraft Web Server Survey, http://news.netcraft.com/archives/web_server_survey.html
• 8: V. Padmanabhan, personal communication (email), September 22, 2003.
• 9: V. Paxson, personal communication (email), May 11, 2003.
• 10: Vern Paxson, Empirically derived analytic models of wide-area TCP connections, IEEE/ACM Transactions on Networking (TON), v.2 n.4, p.316-336, Aug. 1994 [doi>10.1109/90.330413]
• 11: J. Postel, editor, "Transmission Control Protocol", RFC 793, September 1981, http://www.ietf.org/rfc/rfc0793.txt
• 12: W. Stevens, TCP/IP Illustrated, Volume 1, Addison-Wesley, New York, 1994.
• 13: K. Thompson, G. Miller, and R. Wilder, "Wide-area Internet Traffic Patterns and Characteristics", IEEE Network, Vol. 11, No. 6, pp. 10--23, November/December 1997.
• 14: Carey Williamson, Internet Traffic Measurement, IEEE Internet Computing, v.5 n.6, p.70-74, November 2001 [doi>10.1109/4236.968834]

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.5 Local and Wide-Area Networks
          Subjects: Internet (e.g., TCP/IP)

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.5 Local and Wide-Area Networks
          Subjects: High-speed (e.g., FDDI, fiber channel, ATM)
  C.4 PERFORMANCE OF SYSTEMS
      Subjects: Reliability, availability, and serviceability

General Terms:
Algorithms, Performance, Reliability

Keywords:
TCP, network traffic measurement, web, workload characterization