{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T04:40:08Z","timestamp":1750308008070,"version":"3.41.0"},"reference-count":30,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2006,7,5]],"date-time":"2006-07-05T00:00:00Z","timestamp":1152057600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGCOMM Comput. Commun. Rev."],"published-print":{"date-parts":[[2006,7,5]]},"abstract":"<jats:p>In this paper we describe a new tool being made available to the networking research community for passive analysis of TCP segment traces. The purpose of the tool is to provide more complete and accurate classification of out-of-sequence segments than those provided by prior tools. One of the crucial factors that limits the accuracy of prior tools is that these do not incorporate variations across TCP implementations (for different operating systems) that have different parameters (e.g., timer granularity, minimum RTO, duplicate ACK thresholds, etc.) or algorithms that influence what can be inferred about out-of-sequence segments. Our tool explicitly accounts for implementation-specific details in four prominent TCP stacks (Windows, Linux, FreeBSD\/Mac OS-X, and Solaris). We validate our tool through several controlled experiments with instances of all four OS-specific implementations used in the analysis. We then run this tool on packet traces of 52 million Internet TCP connections collected from 5 different locations and present the results. We also include comparisons with results from running selected prior tools on the same traces.<\/jats:p>","DOI":"10.1145\/1140086.1140093","type":"journal-article","created":{"date-parts":[[2006,7,24]],"date-time":"2006-07-24T17:00:26Z","timestamp":1153760426000},"page":"51-64","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":17,"title":["A passive state-machine approach for accurate analysis of TCP out-of-sequence segments"],"prefix":"10.1145","volume":"36","author":[{"given":"Sushant","family":"Rewaskar","sequence":"first","affiliation":[{"name":"University of North Carolina at Chapel Hill"}]},{"given":"Jasleen","family":"Kaur","sequence":"additional","affiliation":[{"name":"University of North Carolina at Chapel Hill"}]},{"given":"F. Donelson","family":"Smith","sequence":"additional","affiliation":[{"name":"University of North Carolina at Chapel Hill"}]}],"member":"320","published-online":{"date-parts":[[2006,7,5]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"URL http:\/\/www.cs.unc.edu\/~jasleen\/research\/.  URL http:\/\/www.cs.unc.edu\/~jasleen\/research\/."},{"key":"e_1_2_1_2_1","unstructured":"The dag project univ. of waikato URL http:\/\/dag.cs.waikato.ac.nz\/.  The dag project univ. of waikato URL http:\/\/dag.cs.waikato.ac.nz\/."},{"key":"e_1_2_1_3_1","unstructured":"tcptrace. URL http:\/\/jarok.cs.ohiou.edu\/software\/tcptrace\/tcptrace.html.  tcptrace. URL http:\/\/jarok.cs.ohiou.edu\/software\/tcptrace\/tcptrace.html."},{"key":"e_1_2_1_4_1","unstructured":"URL http:\/\/pma.nlanr.net\/special\/leip1.html.  URL http:\/\/pma.nlanr.net\/special\/leip1.html."},{"key":"e_1_2_1_5_1","unstructured":"URL http:\/\/pma.nlanr.net\/traces\/long\/ipls1.html.  URL http:\/\/pma.nlanr.net\/traces\/long\/ipls1.html."},{"key":"e_1_2_1_6_1","unstructured":"URL http:\/\/tracer.csl.sony.co.jp\/mawi\/.  URL http:\/\/tracer.csl.sony.co.jp\/mawi\/."},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/948205.948241"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/974036.974038"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/316188.316230"},{"key":"e_1_2_1_10_1","doi-asserted-by":"crossref","unstructured":"M. Allman V. Paxson and W. Stevens. RFC 2581: TCP congestion control 1999.   M. Allman V. Paxson and W. Stevens. RFC 2581: TCP congestion control 1999.","DOI":"10.17487\/rfc2581"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/637201.637216"},{"key":"e_1_2_1_12_1","doi-asserted-by":"crossref","unstructured":"E. Blanton M. Allman K. Fall and L. Wang. RFC 3517: A conservative selective acknowledgment (SACK)-based loss recovery algorithm for TCP April 2003.   E. Blanton M. Allman K. Fall and L. Wang. RFC 3517: A conservative selective acknowledgment (SACK)-based loss recovery algorithm for TCP April 2003.","DOI":"10.17487\/rfc3517"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/166237.166265"},{"key":"e_1_2_1_14_1","first-page":"1742","volume-title":"INFOCOM (3)","author":"Cardwell N.","year":"2000"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/235160.235162"},{"key":"e_1_2_1_16_1","doi-asserted-by":"crossref","unstructured":"S. Floyd T. Henderson and A. Gurtov. RFC 2582: The newreno modification to TCP's fast recovery algorithm 2004.   S. Floyd T. Henderson and A. Gurtov. RFC 2582: The newreno modification to TCP's fast recovery algorithm 2004.","DOI":"10.17487\/rfc3782"},{"key":"e_1_2_1_17_1","unstructured":"V. Jacobson C. leres and S. McCanne. tcpdump: URL http:\/\/www.tcpdump.org.  V. Jacobson C. leres and S. McCanne. tcpdump: URL http:\/\/www.tcpdump.org."},{"volume-title":"Proceedings of IEEE INFOCOM","year":"2003","author":"Jaiswal S.","key":"e_1_2_1_18_1"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2004.1354571"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028820"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/505688.505692"},{"volume-title":"RFC 2018: TCP selective acknowledgement options","year":"1996","author":"Mathis M.","key":"e_1_2_1_23_1"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/285237.285291"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/383059.383083"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.5555\/287428"},{"key":"e_1_2_1_27_1","doi-asserted-by":"crossref","unstructured":"V. Paxson and M. Allman. RFC 2988: Computing TCP's retransmission timer November 2000.   V. Paxson and M. Allman. RFC 2988: Computing TCP's retransmission timer November 2000.","DOI":"10.17487\/rfc2988"},{"volume-title":"USENIX Symposium on Internet Technologies and Systems","year":"1999","author":"Savage S.","key":"e_1_2_1_29_1"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/1080091.1080111"},{"volume-title":"Inc.","year":"1993","author":"Stevens W.R.","key":"e_1_2_1_31_1"},{"key":"e_1_2_1_32_1","unstructured":"M. Zalewski. Passive OS fingerprinting tool: URL http:\/\/lcamtuf.coredump.cx\/p0f.shtml. 2006.  M. Zalewski. Passive OS fingerprinting tool: URL http:\/\/lcamtuf.coredump.cx\/p0f.shtml. 2006."}],"container-title":["ACM SIGCOMM Computer Communication Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1140086.1140093","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1140086.1140093","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T15:06:32Z","timestamp":1750259192000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1140086.1140093"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2006,7,5]]},"references-count":30,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2006,7,5]]}},"alternative-id":["10.1145\/1140086.1140093"],"URL":"https:\/\/doi.org\/10.1145\/1140086.1140093","relation":{},"ISSN":["0146-4833"],"issn-type":[{"type":"print","value":"0146-4833"}],"subject":[],"published":{"date-parts":[[2006,7,5]]},"assertion":[{"value":"2006-07-05","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}