Subject: [ippm] IP ID problem

From: "Pusz, Mateuszx" <[email-masked]>
Date: Mon, 26 Aug 2002 07:01:21 +0100

Hello

I have following problem. I have to make an application which will monitor
and analyze streams of IP packets in the Internet (for example VoIP
transmission) in real time. It must measure such QoS parameters as OTT, OTT
variation, and some more parameters. To do that I have to find out how to
uniquelly identify measured packets on the end-points of the connection.

Some time ago I decided to use IP ID and IP offset to do that but I
discovered that my RedHat Linux sends UDP packets with the same IP ID value
in IP header (transfer is beetween the same sockets on the peers). Of course
there is DF flag set in each packet. I must add that IP packets have that
field filled and as you all know it has unique TCP sequence number already
(DF flag is also set). Why in the same system IP packets for TCP and UDP
traffic differ?

Do you know how many current IP implementations do the same? Is it a big
percent of all UDP traffic in the Internet?

I'm not an originator of measured traffic so kernel recompilation or manual
setting of IP ID field in each packet is not the answer for me. I don't want
to compare data field of the UDP header because that data are not store on
local system but are being sent to analyzer process somewhere in the
Internet so it could increase load of the measured links. The only field
that differ for each packets is UDP checksum but firstly it is not uniqe for
different data in the packet and secondly it must not be set in the UDP
header. There is also IP total length field but I think it is not the
answer.

Do you have any suggestions how to deal with that problem?

Please help me.

Best regards

Mateusz Pusz
_______________________________________________
ippm mailing list
[email-masked]
http://mailhost.advanced.org/mailman/listinfo/ippm

---

From: Tanja Zseby <[email-masked]>
Date: Mon, 26 Aug 2002 10:30:53 +0200

Dear Mateusz,

we had the same problem for passive measurement of one-way-delay. We 
decided to use a packet ID which is generated based on the
invariant fields of the packet header for identifying packest at 
different measurement points.

This concept (using a CRC-based packet ID) was introduced in

Ian D. GRAHAM, Stephen F. DONNELLY, Stele MARTIN, Jed MARTENS, John G. 
CLEARY: Nonintrusive and Accurate Measurement of Unidirectional Delay 
and Delay Variation on the Internet, INET'98, Geneva, Switzerland, 21-24 
July, 1998

A hash-based packet ID can be found in:

Nick Duffield, Matthias Grossglauser: Trajectory Sampling for Direct 
Traffic Observation, Proceedings of ACM SIGCOMM 2000, Stockholm, Sweden, 
August 28 - September 1, 2000.

In our PAM 2001 poster presentation we had a look at different packet 
IDs for one-way-delay measurements and compared their sizes and 
collision probability. You can find the document

Tanja Zseby, Sebastian Zander, Georg Carle: Evaluation of Building 
Blocks for Passive One-way-delay Measurements, PAM 2001

on the PAM 2001 pages: http://www.ripe.net/pam2001/program.html

We also had the problem that Linux 2.4 sets the datagram ID to zero 
(probably due to security reasosns ). Although this implementation is 
fully interoperable (because the dont fragment flag is set) I am in 
doubt whether this behavior conforms to RFC791 which states that an 
identifier has to be chosen that is "unique for this source destination 
pair and protocol for the time the datagram (or any fragment of it) 
could be active in the network".

Hope this helps
Tanja

-- 
Dipl.-Ing. Tanja Zseby			    	      	
FhI FOKUS/Global Networking			Email: [email-masked]	
Kaiserin-Augusta-Allee 31				Phone: +49-30-3463-7153
D-10589 Berlin, Germany				Fax:   +49-30-3463-8153
-------------------------------------------------------------------------------------- 
"Living on earth is expensive but it includes a free trip around the sun." (Anonymous)
--------------------------------------------------------------------------------------