TimeWeaver: Opportunistic One Way Delay Measurement via NTP

TL;DR

TimeWeaver is a passive measurement tool that leverages NTP traffic to accurately estimate one-way delays across the Internet, enabling applications like geolocation and network management.

Contribution

It introduces a novel passive measurement approach using NTP traffic and develops TimeWeaver, an analysis tool that assesses and improves OWD measurement accuracy.

Findings

TimeWeaver achieves less than 2% average error in OWD estimates.

NTP traffic can be effectively used for continuous OWD measurement.

Application of hierarchical OWD estimation benefits network analysis.

Abstract

One-way delay (OWD) between end hosts has important implications for Internet applications, protocols, and measurement-based analyses. We describe a new approach for identifying OWDs via passive measurement of Network Time Protocol (NTP) traffic. NTP traffic offers the opportunity to measure OWDs accurately and continuously from hosts throughout the Internet. Based on detailed examina- tion of NTP implementations and in-situ behavior, we develop an analysis tool that we call TimeWeaver, which enables assessment of precision and accuracy of OWD measurements from NTP. We apply TimeWeaver to a ~1TB corpus of NTP traffic collected from 19 servers located in the US and report on the characteristics of hosts and their associated OWDs, which we classify in a precision/accuracy hierarchy. To demonstrate the utility of these measurements, we apply iterative hard-threshold singular value decomposition to estimate OWDs between arbitrary hosts from the high- est tier in the hierarchy. We show that this approach results in highly accurate estimates of OWDs, with average error rates on the order of less than 2%. Finally, we outline a number of applications---in particular, IP geolocation, network operations and management---for hosts in lower tiers of the precision hierarchy that can benefit from TimeWeaver, offering directions for future work.