TCP oriented analysis of web servers

[Marc Slemko <ma...@worldgate.com>]

Does anyone know of any good papers that go into an analysis of web
traffic on a particular server in terms of examining the TCP packets, and
additionally corrolating them with operating system events and getting a
picture of how things work?

Stevens vol 3 does it a bit in the HTTP chapter, but it skips over a lot
of things that would be cool.

I have been starting to play around a little and you can get some cool
results.  I am amazed at how clean the distribution of SYNs seems to be.

http://www.worldgate.com/~marcs/interarrival.gif shows a plot of
cumulative SYNs received versus the time between arrivals for a
low-traffic server.  It thins out a bit at the tail because of
insufficient data points, but you can almost perfectly fit it to a curve. 
It appears like you may be able to do statistical analysis and capacity
planning for web traffic better than I had anticipated. 

This doesn't cover requests served, etc, but that would be easy.  

Re: TCP oriented analysis of web servers

[Dean Gaudet <dg...@arctic.org>]

I haven't read it entirely, but
<http://www.research.digital.com/wrl/techreports/abstracts/95.4.html>
might be of interest.  And there's also
<http://www.w3.org/Protocols/HTTP/Performance/Pipeline.html>.  But these
are related to specifics of how persistant connections and pipelining are
a Good Thing.

If you're doing TCP analysis it's really worth while learning about "tcp
traces".  See <http://jarok.cs.ohiou.edu/software/tcptrace/tcptrace.html>. 
I used traces while doing the pipelining tuning, they provide a really
keen insight into what TCP is doing when you hand things off to it. You'll
want to read Tim Shepard's thesis, it describes how to use the traces.

Dean

On Thu, 6 Nov 1997, Marc Slemko wrote:

> Does anyone know of any good papers that go into an analysis of web
> traffic on a particular server in terms of examining the TCP packets, and
> additionally corrolating them with operating system events and getting a
> picture of how things work?
> 
> Stevens vol 3 does it a bit in the HTTP chapter, but it skips over a lot
> of things that would be cool.
> 
> I have been starting to play around a little and you can get some cool
> results.  I am amazed at how clean the distribution of SYNs seems to be.
> 
> http://www.worldgate.com/~marcs/interarrival.gif shows a plot of
> cumulative SYNs received versus the time between arrivals for a
> low-traffic server.  It thins out a bit at the tail because of
> insufficient data points, but you can almost perfectly fit it to a curve. 
> It appears like you may be able to do statistical analysis and capacity
> planning for web traffic better than I had anticipated. 
> 
> This doesn't cover requests served, etc, but that would be easy.  
> 
>