TimeAudit: Blind dissection and analysis of transaction delays in enterprise networks

Transaction delay is in many cases the most important performance metric of networked applications because it is a manifestation of both network and end host (client or server) performance and it often directly reflects the user experience. We introduce TimeAudit, a tool for enterprise network administrators that analyzes transaction delays from TCP/IP packet header traces. TimeAudit computes the transaction delays and dissects them into client, server, and network related parts, and in this way enables drilling down to the origins of the application-level performance of services. Furthermore, it applies statistical analysis to reveal patterns and anomalies from the delay data. TimeAudit relies solely on the behavior of TCP and, unlike SNMP-based management tools, for instance, it does the analysis “blindly” requiring no explicit knowledge of the applications whose traffic it analyzes. We apply it to a traffic trace captured at an enterprise network of 345 hosts and 56 servers. This exercise demonstrates that it is able to pinpointing performance trouble spots so that the enterprise network admin could take further action.