ksniffer: Determining the Remote Client Perceived Response Time from Live Packet Streams

David P. Olshefski, Jason Nieh, Erich Nahum

Proceedings of the 6th Symposium on Operating Systems Design and Implementation (OSDI 2004), San Francisco, CA, December 6-8, 2004, pp. 333-346


As dependence on the World Wide Web continues to grow, so does the need for businesses to have quantitative measures of the client perceived response times of their Web services. We present ksniffer, a kernel-based traf- fic monitor capable of determining pageview response times as perceived by remote clients, in real-time at giga- bit traffic rates. ksniffer is based on novel, online mech- anisms that take a “look once, then drop” approach to packet analysis to reconstruct TCP connections and learn client pageview activity. These mechanisms are designed to operate accurately with live network traffic even in the presence of packet loss and delay, and can be efficiently implemented in kernel space. This enables ksniffer to perform analysis that exceeds the functionality of cur- rent traffic analyzers while doing so at high bandwidth rates. ksniffer requires only to passively monitor network traffic and can be integrated with systems that perform server management to achieve specified response time goals. Our experimental results demonstrate that ksnif- fer can run on an inexpensive, commodity, Linux-based PC and provide online pageview response time measure- ments, across a wide range of operating conditions, that are within five percent of the response times measured at the client by detailed instrumentation.



Columbia University Department of Computer Science