Network Radar: Tomography from Round Trip Time Measurements · Network Radar: Tomography from Round Trip Time Measurements Yolanda Tsang, Mehmet Yildiz, Paul Barford, Robert Nowak∗

Network Radar: Tomography from Round Trip TimeMeasurements

Yolanda Tsang, Mehmet Yildiz, Paul Barford, Robert Nowak∗

ABSTRACTKnowledge of link specific traffic characteristics is importantin the operation and design of wide area networks. Networktomography is a powerful method for measuring character-istics such as delay and loss on network-internal links us-ing end–to–end active probes. Prior work has establishedthe basic mechanisms for the use of tomographic inferencetechniques in the networking context. However, the mea-surement methods described in prior network tomographystudies require cooperation between sending and receivingend-hosts, which limits the scope of the paths over whichthe measurements can be made. In this paper, we describea new network tomographic technique based on round triptime (RTT) measurements which eliminates the need forspecial-purpose cooperation from receivers. Our techniqueuses RTT measurements from TCP SYN and SYN-ACK seg-ments to estimate the delay variance of the shared networksegment in the standard one sender - two receivers config-uration. We call this approach Network Radar since it isanalogous to standard radar. We present an analytic eval-uation of Network Radar that specifies the variance boundswithin which the technique is effective. We also evaluateNetwork Radar in a series of tests conducted in a controlledlaboratory environment using live end hosts and IP routers.These tests demonstrate the boundaries of effectiveness ofthe RTT-based approach.

∗Y.Tsang is with the ECE Dept. of Rice University and Univer-sity of Wisconsin – Madison. E-mail: [email protected]. M.Yildizand R.Nowak are with ECE Dept. of University of Wisconsin –Madison. E-mail: [email protected] and [email protected] is with the CS Dept. of University of Wisconsin – Madi-son. E-mail: [email protected]. This work was partially supportedby the National Science Foundation, grants 0335234, 0325653,CCR-0310889, CCR-0325571, and ANI-0099148, DOE SciDAC,the Office of Naval Research, grant N00014-00-1-0966 and by sup-port from Cisco Systems. Any opinions, findings, and conclusionsor recommendations expressed in this material are those of theauthor(s) and do not necessarily reflect the views of the Officeof Naval Research, DOE, National Science Foundation or CiscoSystems.

Permission to make digital or hard copies of all or part of this work forpersonal or classroom use is granted without fee provided that copies arenot made or distributed for profit or commercial advantage and that copiesbear this notice and the full citation on the first page. To copy otherwise, torepublish, to post on servers or to redistribute to lists, requires prior specificpermission and/or a fee.IMC’04, October 25–27, 2004, Taormina, Sicily, Italy.Copyright 2004 ACM 1-58113-821-0/04/0010 ...$5.00.

KeywordsNetwork Tomography, Delay Measurement, Loss Measure-ment

1. INTRODUCTIONNetwork tomography is a powerful method for measuring

and analyzing link specific characteristics using end–to–endactive probes. This capability is important since link specificinformation such as delay and loss is otherwise only availableto network administrators who have direct access to thoselinks. Prior work has established the basic mechanisms forthe use of tomographic inference techniques in the network-ing context [1, 2, 3, 4, 5, 6, 7, 8]. However, the methodsdescribed in prior network tomography studies all require co-operation between sender and receiver end-hosts. This lim-its both the scope of the paths over which the measurementscan be made and wide-spread used of the technique. In thisstudy, we develop and evaluate a new network tomographictechnique based on round trip time (RTT) measurementswhich eliminates the need for special-purpose cooperationfrom receivers. This RTT-based approach can potentiallyexpand the range of paths over which tomographic mea-surements can be made and enable tomographic tools to bemore widely used than prior techniques.

The link delay measurement method that we develop andanalyze in this study is based on the idea of sending twoclosely time-spaced (back–to–back) active probes from a sin-gle sender to two separate receivers. If one were to trace thepaths of these probes from sender to receiver, they wouldform a tree with the root at the sender, a common trunkand the leaves at the receivers. The basic tomographic ideais that the two probe packets should experience nearly thesame delay on each of the shared links of their paths. If thedelays on the shared links are identical, then any differencesin total delay measured are caused by the conditions experi-enced by the probe packets on the unshared links. This sim-ple observation forms the basis for the estimation of the de-lay characteristics on each link via tomography. By repeat-ing this sort of probing many times to many different pairsof receivers, it is possible to reconstruct the (logical) linkdelay distributions on all branches connecting the sender tothe receivers.

Our method uses RTT measurements of back–to–backpackets sent to different pairs of receivers. The importantadvantage of this approach is that it enables tomographicdelay measurement to be conducted widely in the Internet,since special-purpose measurement and cooperation is notrequired at the receivers. The basic idea is depicted in Fig-

ure 1. We send back-to-back packets from the sender 0 toreceiver nodes 1 and 2. We then collect response packetsfrom the receivers and measure round trip times. Assumingthat the delays experienced on all links beyond the branch-ing point are uncorrelated, it is theoretically possible to de-termine the delay characteristics on the shared segment fromthe source to the branching point and on the unshared seg-ments from the branching point, to the receivers, and backto the sender. We call this RTT-based approach NetworkRadar since it is analogous to the idea of standard radarwhich sends signals into a medium, collects the “echo” andcompares signal to echo strength ratio to estimate the dis-tance to the objects. In this paper, we assess the validityand capabilities of RTT-based network tomography throughdelay variance estimation.

There are several key challenges associated with RTT mea-surements (in addition to the issues faced by previous tomo-graphic methods which include route stability, identical de-lays on shared segment, spatial and temporal independenceotherwise) which must be considered in order for NetworkRadar to be practically used. First, extra delays may be in-curred due to random return/response generation times atthe receivers (ideally the response generation time is zero).Response delays may add a significant “noise” component tothe measured RTTs, limiting the accuracy of tomographicmethods. Second, a segment of the return paths will beshared by the response packets from the receivers. Thiscould introduce additional correlations into the RTT mea-surements that are not due to the shared outward segmentof interest (ideally the return paths are uncorrelated). Wepresent an initial investigation of the validity of all ideal as-sumptions as part of this work, and endeavor to determinethe robustness of our tomographic methods in realistic, non-ideal conditions.

In building a prototype tool to realize Network Radar ca-pability, we had to consider how to gather RTT measure-ments effectively. The most common tools for measuringRTTs between end-hosts employ the Internet Control Mes-sage Protocol (ICMP) using either time exceeded or echorequest/reply messages. While tools that use ICMP are use-ful in network troubleshooting, they have well-known limita-tions for precise delay measurements including the fact thatInternet Service Providers often block or rate-limit ICMPtraffic, and that ICMP traffic is often given lower priorityin routers. Our solution is the same as has been adopted inother tools which is to use TCP SYN and SYN-ACK connec-tion setup handshaking mechanism to measure RTT. Eventhis type of RTT measurement can include additional setuptime delays that do not occur with more standard RTT mea-surement techniques, we show that the setup time is quitesmall and nearly a constant offset which therefore does notsignificantly affect delay variance measurement.

1.1 ContributionsThe contributions of this paper are as follows: (1) devel-

opment of a tool, Network Radar, for estimating shared linkcharacteristics based on RTT measurements from the TCPconnection setup mechanism. The tool differs from priortomography tools in that it does not require special coop-eration from receivers or clock synchronization between endhosts, (2) development of a analytical characterization of thedelay variance estimator employed by Network Radar, (3)preliminary evaluation the practicality and effectiveness of

Network Radar in a controlled network laboratory environ-ment.

1.2 Paper structureThe remainder of the paper is structured as follows. In

Section 2 we described related work. In Section 3 we de-scribe the methodology, measurement framework and ana-lytical implications. In Section 4 we describe the details ofthe experimental environment, the test conducted and thetest results. In section 5, we conclude and discuss our futureresearch direction.

2. RELATED WORKNetwork tomography based on the use of one-way mea-

surements between cooperating end-hosts has received con-siderable attention in the networking community [1, 3, 6,7, 9, 10, 11, 12]. These techniques require synchronizationat the end hosts and/or special-purpose measurement ca-pabilities at internal routers. Most of these methods arenot widely applicable because of the lack of an availablewidespread infrastructure for monitoring.

Some recent studies describe measurement tools that at-tempt to infer path characteristics from RTT measurementsare based on the use of Internet Control Message Protocol(ICMP) time-to-live (TTL) [10, 11] and ICMP timestampoptions [3]. Our measurement methodology is distinguishedfrom those in our use of the TCP three way handshakemechanism which is essential to the majority of traffic inthe Internet, making it widely applicable and easy to de-ploy. Other tools that use TCP SYN, SYN-ACK for RTTmeasurements include Sting for loss measurement [13] andSynack for RTT estimation [14].

The tomographic study conducted by Duffield and LoPresti in [7] is perhaps the most closely related to oursand serves as a guide for our approach. That paper esti-mates link delay variance from tomographic measurementsin a multicast setting. Specifically, the authors evaluatedlink delay variance from one-way end-to-end measurementsin both an analytical framework and in ns-2 simulations.The objective of our study is to consider link delay varianceas a mechanism for evaluating the robustness of our Net-work Radar tool. The Duffield and Lo Presti method alsoassumes the availability of multicast routing, synchronizedclocks and the ability to measure at both sender and re-ceiver. Network Radar’s RTT-based design mitigates all ofthese requirements.

3. METHODOLOGY AND MEASUREMENTFRAMEWORK

In this paper, we concentrate on networks comprised ofa single source transmitting measurement probes to two re-ceivers. We assume that the topology is fixed throughoutthe measurement period; i.e., the routing table does notchange. For the networks we consider, standard networkrouting protocols produce a tree-structured topology, withthe source at the root and the receivers at the leaves. Theone–sender–two–receiver network is depicted in Fig. 1. Thebranching node between the source and receivers representsan internal router. Connections between the source, router,and receivers are called links. Each link between may be adirect connection, or there may be “hidden” routers (whereno branching occurs) along the link that are not explicitly

shown in Fig. 1.The basic measurement and inference idea is quite straight-

forward. Suppose two closely time-spaced (back-to-back)packets are sent from the source to two different receivers.The paths to these receivers traverse a common set of links,but at some point the two paths diverge (as the tree branches).The two packets should experience approximately the samedelay on each shared link in their path. The round trip delayconsists of

y = ttransmission + tpropagation + tprocessing + tqueueing.

The delay variances are mainly caused by tqueueing, and theother terms in the delay can be modeled as a nearly constantquantities.

1

0

2

sσ

1σ 2σ

2

2 2

Figure 1: A one sender (0) two-receiver (1, 2) network

with delay variances denoted.

For this study we focus on the problem of estimating de-lay variance of the shared network segment. Extending ourtechnique to the problems of delay distribution and loss es-timation is beyond the scope of this work although there isnothing inherent in our approach that prevents the estima-tion of these characteristics. The delay variance estimationproblem is easily understood in the case depicted in Fig-ure 1. We index the RTT packet pair measurements byk = 1, ..., N . Denote the round trip time measurements tobe y ≡ {y1(k), y2(k)}N

k=1 where y1(k) and y2(k) denote thekth RTT measurements to/from receiver 1 and 2, respec-tively. Denote the delay on each link as di, i ∈ {s, 1, 2},then y1(k) = ds(k) + d1(k) and y2(k) = ds(k) + d2(k). Notethat because the TCP SYN packets are sent back-to-back,the delay on the shared link ds(k) is assumed to be identicalin y1(k) and y2(k). Also note that di, i = 1, 2, refers to thetotal time that the TCP SYN-ACK packets spend travelingfrom the branching node to the corresponding receiver, andthen back to the sender. Let σ2

s denote the delay variance ofthe shared link and σ2

i , i = 1, 2, denote the delay varianceson the unshared paths. Because the delays on the shared andunshared links are assumed to be independent, a straight-forward calculation shows that σ2

s = var(ds) = cov(y1, y2)(see Proposition 1 in Section 3.2). Also, from these packetpair RTT measurements, we can resolve the variances oneach segment by solving the following equation:24 var(y1)

var(y2)var(y1 − y2)

35 =

24 1 1 01 0 10 1 1

3524 σ2s

σ21

σ22

35 ,

but we will focus on the estimation of the variance on theshared path in the remainder of the paper.

3.1 Measurement Methodology

Our method is based on sending back-to-back pairs ofTCP SYN packets to different receivers and measuring thedelay between the sending time and the time at which theTCP SYN-ACKs are received at the sender. This requires asimple time difference measurement at the sender. Most im-portantly, this scheme does not require synchronization withthe receivers nor special purpose support from any internalnetwork elements. The time-stamping mechanism used atthe sender is the tcpdump [15] utility, which can be com-monly found on most systems. The precision of the times-tamp of tcpdump is 1µsec and the two packets in a packetpair are sent as close as possible. In our measurements, theaverage spacing between an outbound packet pair is 10µsec.

xT

0

xT

R R R

xT

2

1

S2

S1

xT R

Figure 2: The network under study in WAIL, with 4

Routers and 9 pcs. The sending host is 0 and the re-

ceivers are 1 and 2 (logical topology in grey). The boxes

xT denote cross-traffic generators and the balls R denote

CISCO 3600 series routers. S1 and S2 denote measure-

ment systems in place to validate the performance of our

Network Radar tool.

3.2 Analytical frameworkThe key statistical quantity in Network Radar is the de-

lay correlation estimator defined as follows. Here, the twoendpoints involved in the packet pair probing are denotedsimply as 1 and 2.

Definition 1. Denote the N RTT packet pair measure-ments y ≡ {y1(k), y2(k)}N

k=1. The RTT covariance is de-fined as

bρ ≡ 1

N − 1

NXk=1

(y1(k)− y1)(y2(k)− y2) (1)

where yi is the sample mean of {yi(k)}Nk=1 for i = 1, 2.

Proposition 1. bρ is an unbiased estimator of the vari-ance on the shared path.

Proof 1. Let µi, i = 1, 2, denote the (unknown) meanRTT in each case. We show first that the true correlationρ ≡ E[(y1(k)−µ1)(y2(k)−µ2)] is equal to the delay varianceon the shared path. Then we show that bρ is an unbiasedestimator of ρ. Let yi(k) = yi(k) − µi, i = 1, 2. Then ρ =E[y1(k)y2(k)]. Each RTT measurement can be written as asum of the delay on the shared path and the delay incurredon the unshared path:

yi(k) = yi,shared(k) + yi,unshared(k), i = 1, 2.

Assuming the delays on the unshared paths are independent,we have

ρ = E[(y1,shared(k) + y1,unshared(k))(y2,shared(k) +

y2,unshared(k))],

= E[y1,shared(k)y2,shared(k)],

where we exploit the fact that yi(k), i = 1, 2, are zero mean.Now, assuming the two packets were back-to-back on theshared path, the delays on the shared path are identical andquantity E[y1,shared(k)y2,shared(k)] is precisely the delay vari-ance on the shared path. To show that E[bρ] = ρ, verifyingthat bρ is an unbiased estimator of the delay variance on theshared path, let us consider the expectation of one term inthe summation in (1):

E[(y1(k)− y1)(y2(k)− y2)]

= E[(y1(k)y2(k)]− 1

N

NX`=1

E[(y1(k)y2(`)]

− 1

N

NX`=1

E[y1(`)y2(k)] +1

N2

NXi=1

NXj=1

E[(y1(i)y2(j)].

Noting that

E[y1(k)y2(`)] =

µ1µ2 k 6= `

ρ + µ1µ2 k = `

and substituting into the expression above, shows that theexpectation of each term is (1− 1/N)ρ. Therefore, since theterms are identically distributed we have

E[bρ] =1

N − 1

NXk=1

E[(y1(k)− y1)(y2(k)− y2)]

=1

N − 1N(1− 1/N)ρ = ρ. 2

We now turn our attention to the accuracy of the estima-tor bρ. The accuracy depends, of course, on the variability ofthe estimator. The larger the standard deviation of bρ, theless confidence we have in the estimated value of the delayvariance on the shared path. We examine two issues. First,we provide an expression for the true standard deviation ofbρ. This expression reveals the various sources of error inthe estimation process. Second, we provide a data-basedestimator of the standard deviation which can be used toobtain a confidence measure in practice. Calculations forthese expressions are somewhat involved, and due to spacelimitations we simply state the results here.

The variance of bρ is given by

E[(bρ− ρ)2] = E[bρ2]− ρ2,

so let us focus on calculating E[bρ2].

E[bρ2] =1

(N − 1)2

NXi=1

NXj=1

E[(y1(i)− y1)(y2(i)−

y2)(y1(j)− y1)(y2(j)− y2)]

=1

(N − 1)2

Xi,j

E[y1(i)y2(i)y1(j)y2(j)] + O(N−1)

where ym = ym−µm, m = 1, 2, as in the proof of Proposition1, and the O(N−1) term comes from the fact bρ employs theempirical means rather than the true means. When i 6= j in

the sum above, then the expectation of the correspondingterm is simply ρ2. Otherwise, when i = j, the expectationis a fourth order cross moment. These moments dependnot only on the delay variability on the shared path, butalso on the unshared paths. Thus, the “noise” (e.g., delayvariability) on unshared paths also impacts the performanceof the estimator. From here we can write

E[bρ2] =1

(N − 1)2[N(N − 1)ρ2 +

NE[y1(i)y2(i)y1(j)y2(j)] + O(N−1)

=N

(N − 1)ρ2 + O(N−1)

where we have absorbed the fourth order moment term withthe other O(N−1) error terms from above. It follows thatthe variance of bρ is

E[(bρ− ρ)2] =1

N − 1ρ2 + O(N−1),

Thus, we see that the variance of bρ decays like N−1, andit follows that the standard deviation drops off like N−1/2.This insures that by using enough probes our estimator bρshould be quite accurate. But, how many probes is“enough”?Unfortunately, as pointed out above, the variance of bρ de-pends on many unknown quantities, including delay vari-abilities on the unshared paths, and so it is not possible toanalytically answer this question in practice.

However, we can employ a data-based measure of confi-dence. This is accomplished using the following estimatorfor the standard deviation of bρ:

bσ ≡ 1

N(N − 1)

NXi=1

[bρ− (y1(i)− y1)(y2(i)− y2)]2

!1/2

.

It can be shown that

E[bσ2] = E[(bρ− ρ)2] + O(N−2),

which indicates that the estimator of the standard deviationconverges to the true standard deviation as the number ofprobes increases (recall that E[(bρ−ρ)2] = O(N−1)). Armedwith the standard deviation bσ, one can assess the accuracyof the delay variance estimate bρ. For example, if bρ is anorder of magnitude larger than bσ, then one can be quiteconfident in the estimated delay variance. We have not yetimplemented this automatic confidence estimator in our ex-perimental work reported here, but plan to incorporate itinto the final version of our Network Radar tool.

4. EXPERIMENTAL RESULTS

4.1 Experiment SetupThe experimental validation is carried out in the Wiscon-

sin Advanced Internet Laboratory (WAIL) [16]. The setupconsists of 4 Cisco commercial routers (3600 series) and 9PCs (Redhat Linux). The bandwidth on all connections is100Mb/s. The setup is illustrated in Fig. 2. Boxes 0, 1 and2 denote the nodes of interests as in Fig. 1. Background(non-probe) traffic is generated using Harpoon [17], a flowlevel traffic generator at boxes denoted by xT. Propagationdelays on links are emulated using a special configurationof the Click modular router [18]. During each experiment,background traffic is generated using input distributions de-rived from NetFlow logs captured at the border router at

4.5 5 5.5 6 6.5 7 7.5 8

4.5

5

5.5

6

6.5

7

7.5

8

σs (10� 5) sec)

sqrt(

cov(

y 1, y2))

(10�

5 sec

)

-

-

Figure 3: Plot of the square-root of the covariance es-

timate,pbρ, against that of the directly measured delay

standard deviation on the shared link.

University of Wisconsin - Madison, while emulated propa-gation delays on each link are fixed and remain constant.

Each measurement period consist of 1000 packet pairs sentfrom node 0 (the sender) to receiver nodes 1 and 2. The sendrate is fixed at a rate of 10probes/sec (100ms intervals). Atthe end of each measurement period, we collect tcpdump

results at the sender (node 0) and at two monitor devices(S1 and S2) along the path. The monitors, which of courseare not pratical outside of the lab, allow us to verify theperformance of Network Radar. The monitoring systemstake traces of packets traversing the links. The first monitor,S1, records the back-to-back packet spacing entering thebranching router. The second monitor, S2, records outgoingpackets from the branching router 2 with extra cross traffic.

0 200 400 600 800 10009

9.5

10

10.5

11

11.5

12

RTT

(ms)

N

y1y2

Figure 4: An example of RTT, yi, i = {1, 2} measured at

the sender in the testbed.

Figure 3 depicts the square-root of the estimated delaycovariance,

pbρ, against that of the directly measured delaystandard deviation on the shared link over 30 measurements.The value

pbρ is computed from the RTT measurements ofthe time difference between the timestamp of TCP SYNand TCP SYN-ACK segments at the sender. An exampleof RTT measurements in our environment is shown in Fig. 4.Our analysis does not consider packet pairs in which one or

4 4.5 5 5.5 6 6.5 7 7.5 84

4.5

5

5.5

6

6.5

7

7.5

8

σs (10� 5 sec)

σ s (10

�5 s

ec)

-

-

Figure 5: Plot of standard deviation of delay on the

shared link measured from sender to the branching node

destined to receiver 1 against that to receiver 2.

both packets are retransmitted or dropped along the forwardor return paths. We also ignore packets whose measuredround trip time is larger than twice the median RTT oneach path. Round trip time greater than twice the medianare most likely due to artifacts in the experimental environ-ment such as errors in the time-stamping mechanism. The“true” value for the one way delay on the shared path is themeasured time difference of TCP SYN packets at the senderand at the second monitor S2. Ideally, these two quantitiesshould be identical and fall onto the 45◦ line. In practice,however, our estimator slightly over-estimates the true value(over the 45◦ line). This may result because of deviationsfrom the ideal assumptions of our theory, such as packetpairs that are not perfectly back-to-back and errors in thetime stamping mechanism. Nonetheless, the estimator cer-tainly appears to be predictive of the true delay variation,and future work will be aimed at quantifying and improvingits accuracy.

The validity of the back–to–back assumption is examinedin Fig. 5. If the packets are perfectly back–to–back, thenthe delay variance, σ2

s measured from packets to receivers1 and 2 should be the same. The offset from the 45◦ lineindicates that packets are not perfectly back–to–back. Thiscan arise from the spacing induced by cross traffic as wellas from the discrepencies in the time stamping mechanism.The time stamping mechanism in tcpdump as well as thosein the devices are known to be imprecise. We further discussthe time stamping issues in the next section.

Finally, we note that the range of the delay variances inour experiments agrees with theoretical predictions. Therouter queue can be modeled as a M/M/1/K queue. Wevary the network load by varying the traffic generator. Thedelay variance is bounded between 10−9 and 10−8. Thisagrees with our configuration that queue size of Cisco router3600 series is 40 packets. The maximum delay is in the orderof 10−6 when the queue is full and the delay variance for apacket if the queue length is one is in the order of 10−8.

5. DISCUSSION AND CONCLUSIONSUsing the WAIL infrastructure, we showed that Network

Radar is a promising tool for network monitoring. The

tool does not require cooperation at the end hosts. We ad-dress the challenges associated with RTT measurement. Theadded variance due to potential extra delays incurred in theresponse generation times is on the order of 10−12, which isnegligible compared to the maximum theoretical variance ofthe delay variances (≈ 10−6) as well as the the variances ob-served in our experiments (≈ 10−9). Our approach assumesthat the segment of the return paths will not be shared bythe response packets from the receivers. In our scenario,even if the response packets share the portion of the returnpath, the difference in the RTTs of the packets will typicallyspace them well apart on the return path, and thus they willnot incur additional correlation on the return to the sender.

We are aware of the fact that we did not investigate allthe possible errors that could affect the effectiveness of thetool. The sender and the receivers have modest CPU loadin our experiments. In practice, excessive loads could causeadditional delays. The timestamp accuracy in tcpdump on aRedhat linux operating system has 1µs accuracy. It shouldbe enough as variance is in the order of 10−9s2. However, therandom effects in timestamping may be a problem. More-over, tcpdump is system dependent and we have only studiedunder one operating system. The number of probes as wellas the probing rate are important elements in delay variancesestimation. If we increase the number of probes, we can in-crease the accuracy of the estimator. However, the probingrate should not be so excessive that it interferes with thenormal traffic. The probing period should be larger thanthe round trip time, so that the packets are approximatelyindependent across pairs.

0

1 2 3

σ2

σ2

a

b

Figure 6: An example of localizing delay variances.

In conclusion Network Radar is a tool which will enablenetwork tomography to become much more widely used. Inparticular, it could be used in case studies of Internet topol-ogy to annotate graphs with link specific information. Itcould also be used as a diagnostic tool by network adminis-trators to isolate and evaluate individual areas of their ownnetwork and beyond. In a larger network, a simple exten-sion using our approach to localize link delay variance isillustrated in Fig. 6. We can localize the delay variance σ2

b

by computing cov(y1, y2) − cov(y1, y3). In this paper, weillustrated the idea of using round trip time measurementsto estimate performance (specifically delay variance) on theshared link. However, it can be extended for other typeof tomographic studies. In cases where the topology is notknown, the delay variances estimated can also be used toinfer the topology.

6. REFERENCES[1] Y. Tsang, M. Coates, and R. Nowak, “Network delay

tomography,” IEEE Transactions on SignalProcessing, vol. 51, no. 8, pp. 2125–2136, August 2003.

[2] N. Duffield, “Simple network performancetomography,” in ACM SIGCOMM IMC, MiamiBeach, FL, Oct. 2003.

[3] K. Anagnostakis, M. Greenwald, and R. Ryger, “cing:Measuring network-internal delays using only existinginfrastructure,” in Proceedings of IEEE Infocom, SanFrancisco, CA, April 2003.

[4] V. N. Padmanabhan, L. Qiu, and H. Wang,“Server-based inference of Internet link lossiness,” inProceedings of IEEE Infocom, San Francisco, CA,April 2003.

[5] M. Coates, A. Hero, R. Nowak, and B. Yu, “Internettomography,” IEEE Signal Processing Magazine, May2002.

[6] A. Adams, T. Bu, R. Caceres, N. Duffield,T. Friedman, J. Horowitz, F. Lo Presti, S.B. Moon,V. Paxson, and D. Towsley, “The use of end-to-endmulticast measurements for characterizing Internetnetwork behavior,” IEEE Communications Magazine,May 2000.

[7] N. Duffield and F. Lo Presti, “Multicast inference ofpacket delay variance at interior network links,” inProceedings of IEEE INFOCOM 2000, Tel Aviv,Israel, Mar. 2000.

[8] A. Bestavros K. Harfoush and J. Byers, “Robustidentification of shared losses using end-to-end unicastprobes,” in Proc. IEEE Int. Conf. Network Protocols,Osaka, Japan, Nov. 2000.

[9] F. Lo Presti, N.G. Duffield, J. Horowitz, andD. Towsley, “Multicast-based inference ofnetwork-internal delay distributions,” Tech. Rep.,University of Massachusetts, 1999.

[10] K. Lai and M. Baker, “Measuring link bandwidthsusing a deterministic model of packet delay,” in Proc.ACM SIGCOMM 2000, Stockholm, Sweden, Aug.2000.

[11] V. Jacobson, “pathchar,” 1997,ftp://ftp.ee.lbl.gov/pathchar/msri-talk.ps.gz.

[12] M.Mahajan, N. Spring, D. Wetherall, andT. Anderson, “User-level internet path diagnosis,” inProceedings of 19th ACM Symposium on OperatingSystems Principles, Lake George, NY, Oct. 2003.

[13] S. Savage, “Sting: a tcp-based network measurementtool,” in Proceedings of USENIX Symposium onInternet Technologies and Systems, Boulder, CO, Oct1999.

[14] “Synack,” 2004,http://www-iepm.slac.stanford.edu/tools/synack/.

[15] Lawrence Berkeley Laboratories, “tcpdump,”http://www.tcpdump.org.

[16] P. Barford and L. Landweber, “Bench-style networkresearch in an Internet instance laboratory,” ComputerCommunications Review, vol. 33(3), July 2003.

[17] H. Kim J. Sommers and P. Barford, “Harpoon: Aflow-level traffic generator for router and networktests,” in Proceedings of ACM SIGMETRICS ’04,New York, NY, June 2004.

[18] E. Kohler, R. Morris, B. Chen, J. Jannotti, andF. Kaashoek, “The click modular router,” ACMTransactions on Computer Systems, vol. 18(3),August 2000.