Nonintrusive TCP connection admission control for bandwidth management of an Internet access link

We describe our approach to monitoring and managing the bandwidth of an Internet edge link with a view toward certain quality of service objectives for the services it carries. Such a link could be, for example, a campus's Internet access link or a small ISP's backbone access link. We use SNMP polls and packet snooping to obtain traffic statistics, and TCP admission control for bandwidth management. Our implementation is completely nonintrusive: we use Ethernet packet capture in the promiscuous mode for traffic analysis, and IP masquerading for blocking new TCP connections. This approach has been implemented by us in a software system for traffic management. We first justify our approach with a simple analytical model. We give an overview of our software implementation, and discuss some implementation issues. Then we provide measurement results that show the effectiveness of the techniques.