Analysis of TCP SYN traffic: an empirical study

Abstract

There are a lot of studies that have measured TCP traffic, but none of them provide the investigation results of TCP SYN packet. In this paper, we show and explain common behavior of TCP SYN packets in traces from a research center using various statistical analysis methods. We selected three parameters to find the behavior of TCP SYN traffic - number of received SYN packets in every 10 ms, SYN PPS (packet per second), and SYN/TCP (ratio between SYN packets and total TCP packets every in 10ms). Our analysis mechanisms are divided into two groups. We started our examination with general statistical tool to provide the knowledge of data distribution. In the second place, we applied change point detection algorithm to our traces to discover the change of state. We summarized our findings in two main categories, qualitative and quantitative. In qualitative findings, we exhibit the characteristics of arising TCP connection and the amount of SYN packet existing in real network and also expose which parameter can explain the characteristics of SYN traffic well. Quantitative findings provide lots of numerical examples to support qualitative findings