Packet timing compression

In Section 5.1.2 we mentioned a phenomenon called ``packet timing compression''. In this subsection we look at this phenomenon in more detail.

Packet timing compression is a phenomenon when a flight of packets are sent over an interval $\Delta T$ but arrive at the receiver over an interval smaller than $\Delta T$.

Zhang et al. predicted from theory and simulation that TCP acknowledgements could be compressed (``ack compression'') [41]. Mogul confirmed the existence of ack compression [30]. Bolot when measuring round trip delays of UDP probe packets at regular time intervals observed a similar phenomenon of compression (or clustering) of the probe packets [19]. Paxon characterised three different types of TCP compression: ack compression, data packet compression, and receiver compression [32].

Packet timing compression was also observed in this study. A typical example is shown in Figure 5.6. In the experiment that generated this traffic pattern, flood ping packets were sent from atmmon to 202.37.129.2, a New Zealand Web server. Three ICMP packets did not get replies.

In the plot, there are times that the WRTT suddenly jumps up then decreases slowly. During those periods of decreases, the date points either locate so close to each other that they coalesce in the plot, or they are nearly uniformly spaced and approximate a straight line. We can see two vertical marks at the bottom of the plot, but there are actually three, two of which are so close to each other that they can not be distinguished in this plot.

Figure 5.6: WRTT plot of packet timing compression

Packet timing compression is better viewed through a receive time plot shown in Figure 5.7. The receive time of a reply packet is plotted against the send time of its corresponding request packet. For ease of comparison, the send time of the request packet is also plotted against itself. The small ticks at the bottom of the graphs indicate the send times of the lost packets. The figure shows that bunches of reply packets were received nearly at the same time, or received within an interval that was smaller than the interval the request packets were sent.

Figure 5.7: Receive time plot of packet timing compression

A phase plot for the same experiment is shown in Figure 5.8. There are data points that lie on a line parallel to the diagonal $y = x$. These points are caused by packet timing compressions. The few data points which lie high above the diagonal $y = x$ correspond to the jumps shown in Figure 5.6.

Figure 5.8: Phase plot of packet timing compression

The cause of packet timing compression can be explained as follows. The first packet of a flight of packets is held up by a router in the buffer so that the other packets in the flight have time to catch up. If there is not much other traffic, then these packets may be queued just behind each other. This can cause the clusters in Figure 5.6. If they and the other traffic both arrive steadily, then their spacing in the buffer may be roughly preserved. This can cause the fairly uniformly spaced data points in the same figure.

We can recognise a signature that can be used to identify the occurrence of packet timing compression as: sudden jump in WRTT followed by nearly sustained WRTTs or nearly uniformly spaced WRTT decreases.