Detecting TCP Packet Reordering in the Data Plane

Network administrators are often interested in detecting TCP-level packet reordering to diagnose performance problems and neutralize attacks. However, packet reordering is expensive to measure, because each packet must be processed relative to the TCP sequence number of its predecessor in the same flow. Due to the volume of traffic, the detection of packet reordering should take place in the data plane of the network devices as the packets fly by. However, restrictions on the memory size and the number of memory accesses per packet make it impossible to design an efficient algorithm for pinpointing the flows with heavy packet reordering. In practice, packet reordering is typically a property of a network path, due to a congested or flaky link. Flows traversing the same path are correlated in their out-of-orderness, and aggregating out-of-order statistics at the IP prefix level would provide useful diagnostic information. In this paper, we present efficient algorithms for identifying IP prefixes with heavy packet reordering under memory restrictions. First, we analyze as much of the traffic as possible by going after the largest flows. Next, we sample as many flows as possible, regardless of their sizes. To achieve the best of both worlds, we also combine these two methods. In all algorithms, we resolve the challenging interplay between measuring at the flow level and aggregating at the prefix level by allocating memory using prefix information. Our simulation experiments using packet traces from a campus network show that our algorithms are effective at identifying IP prefixes with heavy packet reordering using moderate memory resources.