[Bro-Dev] TCP RTT estimation

[Vern Paxson]

> Sorry, my description was not clear enough. Following is an RTT what we
> want to measure.
> 
> [Sender]        [Monitor]-------------(a)------>[Receiver]
> [Sender]<-------[Monitor]<--------ack-of-(a)----[Receiver]
> [Sender]------->[Monitor]

How will you identify the correct segment for this last component?  That's
where it gets quite hard.  You need to understand the precise congestion
control algorithm that the Sender implements, along with dealing with
headaches like the second component (ack-of-(a)) being lost between the
Monitor and the Sender, or the Sender imposing a sender-side buffering
limitation or inheriting an initial ssthresh.  (A bunch of this is discussed
in my tcpanaly paper from an eon ago.)  It really is quite hard, though
it's easier if you can confine yourself to simpler instances such as
only measuring RTT prior to a loss occurring.

		Vern