Data source statistics modeling based on measured packet traffic: A case study of protocol algorithm and analytical transformation approach

For determination of data sources statistics based on measured packet network traffic many methods and special — consequently expensive — instruments exist. In the searching for alternative, cheaper and simpler solutions, we studied two methods based on packet network traffic measurement by simple sniffers and transforation of captured packet traffic into data sources statistics. We studied two types of algorithms. First group is based on mimic of defragmentation procedure, where algorithms are similar to well known defragmentation protocols. The second group is based on mimic of fragmentation procedure, where we developed new algorithms for identification of probability density function of data sources and new methods for estimation of their parameters. Since we discovered that the estimation heavily depends on measurement of statistical deviations between theoretical and empirical packet size histograms, we have modified χ
²
test by weight function, which considers the packet length on deviation measure. With this we have achieved better convergency of the developed algorithm. In research we have considered TCP/IP protocol stack and fragmentation/ defragmentation procedures according to RFC 793. Theoretical results are confirmed by numerus experimental tests. The main research and development results are summarized and analyzed.