Exposing server performance to network managers through passive network measurements

We describe a novel approach to managing the application-level performance of servers within an enterprise network given only passively-collected TCP/IP headers of packets from a link connecting clients to servers. The analysis is driven by constructing, in real-time, a source-level model of the request-response exchanges between each server and all of its clients. By continuously monitoring traffic, we generate a statistical profile of numerous application-layer measures of server performance. Given these measures, and their distributions over time, a network manager can quickly triage server performance problems in generic terms without any knowledge of the servers operation or a priori interaction with the serverpsilas operators. This approach is illustrated by using a continuous, 2-month dataset taken from a border router on the UNC campus to diagnose an actual problem with a UNC web portal.