Passive detection of TCP congestion events

Detailed passive analysis of TCP sender behaviour requires accurate identification of congestion events. Previous tools that attempt to provide such information do not incorporate the behaviour of recent operating systems and TCP features and are therefore of little use to researchers analysing contemporary TCP traffic. In this paper, we present a new tool for identifying and classifying TCP congestion events from a passive packet trace, called tcpcsm, which understands modern operating system TCP behaviour. We discuss the major problems that occur when passively identifying TCP congestion events and describe how tcpcsm solves them. We also show that tcpcsm is more accurate than previous tools using a series of controlled experiments involving a variety of operating systems.