# US 2021/0243093 A1 · Round trip time (rtt) measurement based upon sequence number

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0243093 A1
- Document ID: US20210243093A1
- Status: Published application
- Kind: A1
- Application number: 17/238,193
- Filed: 2021-04-22
- Published: 2021-08-05
- Earliest claimed: 2015-06-05
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Mohammadreza Alizadeh Attar; Navindra Yadav; Abhishek Ranjan Singh; Vimalkumar Jeyakumar; Shashidhar Gandham; Roberto Fernando Spadaro
- Web page: https://patentgrep.com/patent/US20210243093A1

## CPC

- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 3/0482: Interaction with lists of selectable items, e.g. menus
- G06F 3/04842: Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence)
- G06F 3/04847: Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
- G06F 16/122: {using management policies (point-in-time backing up or restoration of persistent data G06F11/1446; file migration policies for HSM systems G06F16/185)}
- G06F 16/137: {Hash-based (content-based indexing of textual data G06F16/31)}
- G06F 16/162: {Delete operations (erasing in storage systems G06F3/0652)}
- G06F 16/17: Details of further file system functions
- G06F 16/173: {Customisation support for file systems, e.g. localisation, multi-language support, personalisation}
- G06F 16/174: Redundancy elimination performed by the file system (error detection or correction of the data by redundancy in operations G06F11/14)
- G06F 16/1744: {using compression, e.g. sparse files}
- G06F 16/1748: {De-duplication implemented within the file system, e.g. based on file segments (de-duplication techniques in storage systems for the management of data blocks G06F3/0641)}
- G06F 16/2322: {using timestamps}
- G06F 16/235: {Update request formulation}
- G06F 16/2365: {Ensuring data consistency and integrity}
- G06F 16/24578: {using ranking}
- G06F 16/248: Presentation of query results
- G06F 16/285: {Clustering or classification}
- G06F 16/288: {Entity relationship models}
- G06F 16/29: Geographical information databases
- G06F 16/9535: Search customisation based on user profiles and personalisation
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06N 20/00: Machine learning
- G06N 99/00: Subject matter not provided for in other groups of this subclass
- G06T 11/26: Drawing of charts or graphs
- H04J 3/0661: {using timestamps}
- H04J 3/14: Monitoring arrangements {(for SDH/SONET rings H04J3/085)}
- H04L 1/242: {by comparing a transmitted test signal with a locally generated replica}
- H04L 7/10: Arrangements for initial synchronisation
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 41/046: comprising network management agents or mobile agents therefor
- H04L 41/0668: by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
- H04L 41/0803: Configuration setting
- H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play
- H04L 41/0816: the condition being an adaptation, e.g. in response to network events
- H04L 41/0893: Assignment of logical groups to network elements
- H04L 41/0894: Policy-based network configuration management
- H04L 41/12: Discovery or management of network topologies
- H04L 41/16: using machine learning or artificial intelligence
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities
- H04L 43/02: Capturing of monitoring data
- H04L 43/026: using flow identification
- H04L 43/04: Processing captured monitoring data, e.g. for logfile generation
- H04L 43/045: for graphical visualisation of monitoring data
- H04L 43/062: related to network traffic
- H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L 43/0805: by checking availability
- H04L 43/0811: by checking connectivity
- H04L 43/0829: Packet loss
- H04L 43/0841: {Round trip packet loss}
- H04L 43/0858: {One way delays}
- H04L 43/0864: Round trip delays
- H04L 43/0876: Network utilisation, e.g. volume of load or congestion level
- H04L 43/0882: Utilisation of link capacity
- H04L 43/0888: Throughput
- H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route
- H04L 43/106: using time related information in packets, e.g. by adding timestamps
- H04L 43/12: Network monitoring probes
- H04L 43/16: Threshold monitoring
- H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
- H04L 45/306: {Route determination based on the nature of the carried application}
- H04L 45/38: {Flow based routing}
- H04L 45/46: {Cluster building}
- H04L 45/507: {Label distribution}
- H04L 45/66: {Layer 2 routing, e.g. in Ethernet based MAN's}
- H04L 45/74: Address processing for routing
- H04L 47/11: Identifying congestion
- H04L 47/20: Traffic policing
- H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ]
- H04L 47/2483: involving identification of individual flows
- H04L 47/28: in relation to timing considerations
- H04L 47/31: by tagging of packets, e.g. using discard eligibility [DE] bits
- H04L 47/32: by discarding or delaying data units, e.g. packets or frames
- H04L 61/5007: Internet protocol [IP] addresses
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/0263: {Rule management}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 63/1458: {Denial of Service}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 63/16: {Implementing security features at a particular protocol layer}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/01: Protocols
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L 67/1001: for accessing one among a plurality of replicated servers
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services
- H04L 67/75: Indicating network or usage conditions on the user display
- H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L 69/22: Parsing or analysis of headers
- H04W 72/54: based on quality criteria
- H04W 84/18: Self-organising networks, e.g. ad-hoc networks or sensor networks
- G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2009/45591: {Monitoring or debugging support}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- G06F 2221/033: Test or assess software
- G06F 2221/2101: Auditing as a secondary aspect
- G06F 2221/2105: Dual mode as a secondary aspect
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- G06F 2221/2115: Third party
- G06F 2221/2145: Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
- H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- H04J: MULTIPLEX COMMUNICATION (transmission in general H04B; peculiar to transmission of digital information H04L5/00; systems for the simultaneous or sequential transmission of more than one television signal H04N7/08; in exchanges H04Q11/00; stereophonic systems H04S)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Systems, methods, and computer-readable media are provided for determining a packet's round trip time (RTT) in a network. A system can receive information of a packet sent by a component of the network and further determine an expected acknowledgement (ACK) sequence number associated with the packet based upon received information of the packet. The system can receive information of a subsequent packet received by the component and determine an ACK sequence number and a receiving time of the subsequent packet. In response to determining that the ACK sequence number of the subsequent TCP packet matches the expected ACK sequence number, the system can determine a round trip time (RTT) of the packet based upon the received information of the packet and the received information of the subsequent packet.

## Claims

### Claim 1

A method comprising:
determining an expected acknowledgement (ACK) sequence number associated with a packet sent by a device in a network;
determining an ACK sequence number of a different packet received by the device;
determining that the ACK sequence number of the different packet does not match the expected ACK sequence number; and
ignoring the different packet when the ACK sequence number of the different packet does not match the expected ACK sequence number.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
generating a warning when the ACK sequence number of the different packet does not match the expected ACK sequence number, the warning being separate from the packet and the different packet.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
determining an additional expected ACK sequence number associated with an additional packet sent by the device;
determining that an additional ACK sequence number of a different additional packet received by the device matches the additional expected ACK sequence number associated with the additional packet; and
determining a round trip time (RTT) of the additional packet based on first information of the additional packet and second information of the different packet.

### Claim 4 (depends on 3)

The method of claim 3, further comprising:
receiving third information corresponding to a transmission control protocol (TCP) handshake performed within a specific time period and associated with a TCP connection; and
based on the third information corresponding to the TCP handshake, determining a number of at least one of re-transmission packets and new packets transmitted during the specific time period.

### Claim 5 (depends on 1)

The method of claim 1, wherein the expected ACK sequence number is determined based on a third ACK sequence number of the packet and a size of the packet.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
determining a sending time, a packet sequence number and a packet size of the packet based on packet information sensed by at least one sensor of a plurality of sensors in the network, the packet information corresponding to the packet.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
determining a receive time of a subsequent packet received by the device; and
determining a round trip time (RTT) of the packet based on the sending time of the packet and the receive time of the subsequent packet.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
determine a respective ACK sequence number of a following packet based on first packet information of the following packet; and
in response to a determination that the respective ACK sequence number of the following packet matches a second expected ACK sequence number, determining a round trip time (RTT) of the packet based on second packet information of the packet and the first packet information of the following packet.

### Claim 9 (depends on 1)

The method of claim 1, further comprising:
determining a congestion level of the network based at least on a round trip time (RTT) of the packet.

### Claim 10 (depends on 1)

The method of claim 1, further comprising:
determining a number of non-duplicative packets; and
determining a packet loss rate of the network during a time period based at least on the number of non-duplicative packets.

### Claim 11

A system comprising:
one or more processors; and
a computer-readable storage medium storing instructions which, when executed by the one or more processors, cause the system to:
determine an expected acknowledgement (ACK) sequence number associated with a packet sent by a component in a network;
determine an ACK sequence number of a different packet received by the component;
determine that the ACK sequence number of the different packet does not match the expected ACK sequence number; and
ignore the different packet when the ACK sequence number of the different packet does not match the expected ACK sequence number.

### Claim 12 (depends on 11)

The system of claim 11, wherein the instructions, when executed by the one or more processors, cause the system to:
select a range of packet sequence numbers;
determine a packet sequence number of the packet based on packet information of the packet; and
determine that the packet sequence number of the packet is within the range of packet sequence numbers.

### Claim 13 (depends on 11)

The system of claim 11, wherein the instructions, when executed by the one or more processors, cause the system to:
generate a warning when the ACK sequence number of the different packet does not match the expected ACK sequence number, the warning being separate from the packet and the different packet.

### Claim 14 (depends on 11)

The system of claim 11, wherein the instructions, when executed by the one or more processors, cause the system to:
determine an additional expected ACK sequence number associated with an additional packet sent by the component;
determine that an additional ACK sequence number of a different additional packet received by the component matches the additional expected ACK sequence number associated with the additional packet; and
determine a round trip time (RTT) of the additional packet based on first information of the additional packet and second information of the different additional packet.

### Claim 15 (depends on 14)

The system of claim 14, wherein the instructions, when executed by the one or more processors, cause the system to:
receive third information corresponding to a transmission control protocol (TCP) handshake performed within a specific time period and associated with a TCP connection; and
based on the third information corresponding to the TCP handshake, determine a number of at least one of re-transmission packets and new packets transmitted during the specific time period.

### Claim 16 (depends on 11)

The system of claim 11, wherein the expected ACK sequence number is determined based on an additional ACK sequence number of the packet and a size of the packet.

### Claim 17 (depends on 11)

The system of claim 11, wherein the instructions, when executed by the one or more processors, cause the system to:
determine a sending time, a packet sequence number and a packet size of the packet based on packet information sensed by at least one sensor of a plurality of sensors in the network, the packet information corresponding to the packet;
determine a receive time of a further packet received by the component; and
determine a round trip time (RTT) of the packet based on the sending time of the packet and the receive time of the further packet.

### Claim 18 (depends on 11)

The system of claim 11, wherein the instructions, when executed by the one or more processors, cause the system to:
determine a number of non-duplicative packets; and
determine a packet loss rate of the network during a time period based at least on the number of non-duplicative packets.

### Claim 19 (depends on 11)

The system of claim 11, wherein the expected ACK sequence number is determined without the different packet.

### Claim 20

A non-transitory computer-readable medium having stored thereon instructions which, when executed by one or more processors, cause the one or more processors to:
determine an expected acknowledgement (ACK) sequence number associated with a packet sent by a component in a network;
determine an ACK sequence number of a different packet received by the component;
determine that the ACK sequence number of the different packet does not match the expected ACK sequence number; and
ignore the different packet when the ACK sequence number of the different packet does not match the expected ACK sequence number.