Patent ID: 7636346
Filing Date: 2009-12-22
Classification: H04L

Abstract:
1. A method for estimating the actual discrepancy (ddT) between a first timer and a second timer used in a TCP (Transmission Control Protocol) packet reconstruction system for capturing and analyzing TCP packets, the TCP packets transmitted from a first device to a second device in a first direction on a first channel and from the second device to the first device in a second direction on a second channel, a first part of the TCP packets captured by a first packet capturing device on the first channel and time stamped by the first timer and a second part of the TCP packets captured by a second packet capturing device on the second channel and time stamped by the second timer, a minimum ddT (min_ddT) initialized as −dT and a maximum ddT (max_ddT) initialized as dT, dT being a maximum estimated time discrepancy between the first and second timers, the method comprising recursively performing: selecting a TCP packet from the first part of the TCP packets; extracting a timestamp (T), a sequential number (Seq), and an acknowledgement number (Ack) from the selected TCP packet, the timestamp (T) being the timestamp imposed by the first timer on the selected packet, the sequential number (Seq) indicating a sequential number of a first data in the selected packet, and Ack indicating a sequential number of a last successfully received continuous data in the selected packet; setting ALastTime as T, ALastSeq as Seq, and ALastAck as Ack, ALastTime indicating a timestamp of a last seen packet in the first direction, ALastSeq being a sequential number of the last seen packet in the first direction, and ALastAck being an acknowledgement number of the last seen packet in the first direction; determining whether Seq is not more than BLastAck, BLastAck being an acknowledgement number of a last seen packet in the second direction; responsive to determining that Seq is not more than BLastAck, modifying max_ddT as: max_ddT=min (max_ddT, BLastTime-T+2d), d being a maximum time between capturing of the packets by the first and second packet capturing devices and time stamping of the captured packets by the first and second timers; determining whether Ack is not less than BLastSeq, BLastSeq being a sequential number of a last seen packet in the second direction; and responsive to determining that Ack is not less than BLastAck, modifying min_ddT as: min_ddT=max (min_ddT BLastTime-T−2d).