TCP Flow Identification by Sequence and Acknowledgement Number
Yan-Bing Peng, Jian Ping Gong, Wei Yue Ding · Journal of Southeast University · 2005
To reduce the TCP flow processing cost, some bit patterns selected from the TCP/IP packet can be used as TCP flow identification. Based on the entropy and randomness analysis of the distribution of sequence number (SN) and acknowledgement number (AN) in the first packet of a TCP flow, this paper proposes a new uniform TCP flow identification by sequence and acknowledgement number (FIDSAN) to the heavy-tailed IP or TCP traffic. The experimental results suggest that some bits in the TCP sequence number and acknowledgment number can be selected out as flow ID with acceptable confliction probability. The bit length of flow ID selected under given confliction probability can be conducted from an equation deduced from the observing window and flow ID range. FIDSAN has low computation cost in the comparison with the traditional methods, such as 5-tuple, CRC, and Checksum etc.