A machine learning approach to TCP state monitoring from passive measurements

Many applications in the Internet use the reliable end-to-end Transmission Control Protocol (TCP) as a transport protocol due to practical considerations. There are many different TCP variants in use, and each variant uses a specific end-to-end congestion control algorithm to avoid congestion, while also attempting to share the underlying network capacity equally among the competing users. This paper shows how an intermediate node (e.g., a network operator) can identify the transmission state of the TCP client associated with a TCP flow by passively monitoring the TCP traffic. We demonstrate how the intermediate node can predict the Congestion Window (cwnd) size of the TCP client. The method can also be extended to predict other TCP transmission states of the client. We use a generic machine learning-based prediction approach for inferring cwnd within a flow from a passive traffic collected at an intermediate node. Our experimental results indicate the effectiveness of our prediction model with reasonably good accuracy across different scenarios and multiple TCP variants.