Network Performance Analysis using RTT under Different Traffic Conditions


Network Performance Analysis using RTT under Different Traffic Conditions

INTRODUCTION

Round Trip Time (RTT) is a fundamental network parameter that measures the time taken for a packet to travel from the sender to the receiver and back. It plays a crucial role in evaluating network performance, delay, and congestion.

In modern networks, increasing traffic load can significantly impact latency and stability. This experiment focuses on analyzing RTT under different traffic conditions—low, medium, and high—using Wireshark. The study also explores related metrics such as jitter, retransmissions, and TCP window size to understand network behavior under varying load conditions.


OBJECTIVE

  • To measure Round Trip Time (RTT) using Wireshark.
  • To analyze network performance under low, medium, and high traffic conditions.
  • To study the impact of congestion on delay and network stability.
  • To observe variation in delay (jitter) with increasing traffic.
  • To correlate RTT with load, retransmissions, and TCP window size.
  • To understand how network performance changes under different traffic levels.

    • TOOLS USED

  • Wireshark – Used for capturing and analyzing network packets and measuring RTT.
  • hping3 – Used for generating controlled network traffic under different load conditions.
  • Operating System – Windows with Windows Subsystem for Linux (WSL) used to run Linux-based networking tools like hping3.


    • ARCHITECTURE OF WORK

     METHODOLOGY

  • Wireshark was launched and the active network interface was selected.
  • Packet capture was initiated to monitor network traffic.
  • RTT values were filtered using the display filter:
  • tcp.analysis.ack_rtt
  • Network traffic was generated using hping3:
    • Low traffic → small number of packets
    • Medium traffic → moderate number of packets
    • High traffic → large number of packets
  • Wireshark I/O Graph tool was used for analysis:
  • Statistics → I/O Graph
  • Multiple graphs were generated to analyze network behavior:
    • Average RTT
    • Maximum RTT
    • Minimum RTT
    • Jitter (MAX – MIN)
    • Load vs RTT
    • RTT vs Retransmissions
    • RTT vs TCP Window Size

    • Packet Capture Details

    All captures were performed using Wireshark. Traffic was generated using hping3 under three conditions. The raw .pcap files are available on GitHub for reference and reproduction.

    Traffic Condition Packets Captured Duration Packets / Second PCAP File
    Low Traffic 1,300 packets 20 seconds 65 packets/sec View 2.pcap ↗
    Medium Traffic 9,000 packets 9 seconds 1,000 packets/sec View 3.pcap ↗
    High Traffic 4,700 packets 10 seconds 470 packets/sec View 4.pcap ↗

    * Packets/sec is calculated from total packets divided by capture duration. Medium traffic shows the highest packet rate, reflecting aggressive hping3 flooding.

                

    GRAPH CONFIGURATION AND ANALYSIS

        Average RTT vs Time

            Filter: tcp.analysis.ack_rtt
            Calculation: AVG
            Y Field: tcp.analysis.ack_rtt
            To observe the overall latency trend of the network over time.
            Average RTT represents the mean delay of all packets within a time interval. It smooths out individual fluctuations and provides a stable view of network performance.
          

        Maximum RTT vs Time

            Filter: tcp.analysis.ack_rtt
            Calculation: MAX
            Y Field: tcp.analysis.ack_rtt
            To detect worst-case delay and latency spikes.
            Maximum RTT shows the highest delay experienced in each time interval. It helps identify sudden congestion and temporary network instability.


        Minimum RTT vs Time

            Filter: tcp.analysis.ack_rtt
            Calculation: MIN
            Y Field: tcp.analysis.ack_rtt
            To estimate baseline or physical network delay.
            Minimum RTT represents the lowest delay observed, approximating the propagation delay without congestion effects.

        RTT Jitter (MAX–MIN)

            Filter: tcp.analysis.ack_rtt
            Trace 1: MAX RTT
            Trace 2: MIN RTT
            To measure variation in delay (jitter).
            Jitter is the difference between maximum and minimum RTT. A larger gap indicates unstable latency and higher network variability.

        Load vs RTT

            Filter: tcp
            Trace 1 (RTT):
                Calc: AVG
                Y Field: tcp.analysis.ack_rtt
            Trace 2 (Load):
                Calc: SUM
                Y Field: tcp.len
                Unit: Bits/sec
            To analyze the relationship between traffic load and delay.
            This graph shows how increasing traffic load affects RTT. A rise in both indicates congestion due to queuing delay.


        RTT vs Retransmissions

            Trace 1 (RTT):
                Filter: tcp.analysis.ack_rtt
                Calc: AVG
            Trace 2 (Retransmissions):
                Filter: tcp.analysis.retransmission
                Calc: COUN
            To correlate delay with packet loss.
            Retransmissions occur when packets are lost or delayed. A rise in retransmissions with RTT indicates congestion and reduced reliability.


        RTT vs TCP Window Size

            Filter: tcp
            Trace 1 (RTT):
                Calc: AVG
                Y Field: tcp.analysis.ack_rtt
            Trace 2 (Window Size):
                Calc: AVG
                Y Field: tcp.window_size_value
            To study TCP congestion control behavior.
            TCP adjusts its window size based on network conditions. When RTT increases, the window size decreases to reduce congestion.


    RESULTS AND ANALYSIS

    Average RTT

    Low Traffic

              

     

      • The average RTT remains mostly low and stable, indicating minimal network delay under light load.
      • Occasional small spikes are observed, but they are temporary and quickly recover, showing no sustained congestion.
      • The overall trend suggests that the network is operating efficiently with negligible queuing delay.
      • This confirms that under normal traffic conditions, latency is consistent and predictable.

    Medium Traffic

                 

      • The average RTT shows higher values and frequent fluctuations compared to low traffic, indicating increasing network load.
      • Repeated spikes suggest intermittent congestion and variable queuing delays.
      • The RTT does not remain stable, showing that the network is starting to experience performance degradation.
      • Overall, latency becomes less predictable, indicating moderate congestion conditions.

    High Traffic

                 

      • The average RTT is significantly higher and shows continuous fluctuations, indicating heavy network load.
      • Frequent large spikes suggest persistent congestion and high queuing delay.
      • The latency remains consistently elevated, showing that the network is overloaded and unstable.
      • Overall, delay becomes high and unpredictable, confirming severe congestion under heavy traffic conditions.

    Maximum RTT

    Low Traffic

                 

      • The maximum RTT is generally low but shows occasional spikes, indicating rare delay variations.
      • These spikes are short-lived, suggesting temporary and minor congestion events.
      • Most of the time, the network experiences minimal worst-case delay, showing stable performance.
      • Overall, low traffic conditions result in rare and non-persistent latency peaks.

    Medium Traffic

                 

      • The maximum RTT shows frequent and higher spikes compared to low traffic, indicating increased worst-case delays.
      • These spikes occur more often, suggesting intermittent congestion and variable queuing delays.
      • The network experiences noticeable instability in peak latency, though not continuously severe.
      • Overall, medium traffic leads to regular delay spikes, indicating growing congestion effects.

    High Traffic

                 

      • The maximum RTT is consistently high with frequent sharp spikes, indicating severe worst-case delays.
      • Continuous fluctuations show persistent congestion and heavy queuing effects in the network.
      • The spikes are more frequent and higher compared to medium traffic, reflecting unstable latency conditions.
      • Overall, heavy traffic leads to significant and repeated delay peaks, confirming strong congestion impact.

    Minimum RTT

    Low Traffic

                 

      • The minimum RTT remains very low and nearly constant, indicating stable baseline network delay.
      • Occasional slight increases are minimal, showing negligible impact of congestion.
      • This reflects that the physical path delay is consistent and unaffected by traffic.
      • Overall, under low traffic, the network maintains a stable and reliable baseline latency.

    Medium Traffic

                 

      • The minimum RTT remains relatively low but shows more variation compared to low traffic.
      • Small fluctuations indicate that even the baseline delay is slightly affected by increasing load.
      • However, values do not rise significantly, meaning the core path delay is still mostly stable.
      • Overall, medium traffic introduces minor instability but does not heavily impact baseline latency.

    High Traffic

                 

      • The minimum RTT is higher and more variable compared to low and medium traffic, indicating impact on baseline delay.
      • Frequent fluctuations suggest that even the best-case delay is affected by heavy load and congestion.
      • Occasional sharp drops and rises indicate instability in routing or transmission conditions.
      • Overall, heavy traffic causes noticeable degradation in baseline latency, reducing network stability.

    RTT Jitter 

    Low Traffic

                 

      • The gap between maximum and minimum RTT is very small for most of the time, indicating low jitter.
      • Occasional slight separations appear, but they are brief and not significant.
      • This shows that packet delay is highly consistent and stable under low traffic conditions.
      • Overall, the network exhibits minimal latency variation and high stability.

    Medium Traffic

                 

      • The gap between maximum and minimum RTT is noticeably larger and more frequent, indicating increased jitter.
      • This shows that packet delay is varying more due to moderate congestion and queuing effects.
      • Fluctuations are irregular, making latency less consistent compared to low traffic.
      • Overall, medium traffic results in moderate instability in network delay.

    High Traffic

                 

      • The gap between maximum and minimum RTT is very large and consistently present, indicating high jitter.
      • Frequent and sharp variations show that packet delay is highly unstable due to severe congestion.
      • The wide separation between curves reflects significant inconsistency in latency.
      • Overall, heavy traffic results in poor network stability with unpredictable delay variations.

    Average RTT vs Load

    Low Traffic

                

      • The network load remains very low and mostly flat, while RTT stays low with minor variations, indicating no congestion.
      • Occasional small load spikes do not significantly impact RTT, showing the network has sufficient capacity.
      • There is no strong correlation between load and RTT in this case, as delay does not increase with traffic.
      • Overall, the network operates in a non-congested state where additional load does not affect latency.

    Medium Traffic

                 

      • The network load remains consistently moderate, while RTT shows noticeable fluctuations, indicating growing congestion effects.
      • There is a partial positive correlation: when load stays high, RTT tends to fluctuate at higher values.
      • However, RTT does not increase smoothly with load, showing that congestion is intermittent rather than continuous.
      • Overall, the network is operating near capacity, where increased load begins to impact latency but not in a strictly linear manner.

    High Traffic

                 

      • The load remains consistently high, and RTT also stays elevated with strong fluctuations, indicating sustained congestion.
      • There is a clear positive correlation: high load corresponds to higher RTT due to increased queuing delay.
      • Even small variations in load cause noticeable RTT changes, showing the network is operating near or beyond capacity.
      • Overall, this confirms that under heavy traffic, increased load directly leads to higher and unstable latency.

    Average RTT vs Retransmissions

    Low Traffic

                 

      • No retransmissions are observed (value = 0), indicating no packet loss or timeout events in the network.
      • RTT remains low and stable, confirming smooth and reliable packet delivery.
      • Since retransmissions are absent, there is no correlation between RTT and packet loss in this case.
      • Overall, the network operates in a healthy, congestion-free state with high reliability under low traffic.

    Medium Traffic

                 

      • No retransmissions are observed (value = 0), indicating no packet loss despite increased traffic.
      • RTT shows moderate fluctuations, but these are due to queuing delay, not retransmission events.
      • Since retransmissions are absent, there is no direct relationship between RTT spikes and packet loss.
      • Overall, the network experiences congestion in terms of delay, but maintains reliable packet delivery under medium traffic.

    High Traffic

                 

      • Retransmissions are clearly present and occur in bursts, indicating packet loss under heavy traffic.
      • These retransmission spikes generally align with higher RTT values, showing a relationship between delay and packet loss.
      • Increased RTT suggests severe congestion, which leads to timeouts or dropped packets, triggering retransmissions.
      • Overall, there is a strong correlation between high latency and retransmissions, confirming network overload and reduced reliability.

    RTT vs TCP Window Size

    Low Traffic

      • The TCP window size remains mostly stable with low variation, indicating no need for congestion control adjustments.
      • RTT stays low and steady, showing minimal network delay.
      • There is no significant inverse relationship observed between RTT and window size, as the network is uncongested.
      • Overall, TCP operates in a stable state with consistent window size due to smooth network conditions.

    Medium Traffic

                 

      • The TCP window size shows noticeable adjustments, indicating active congestion control.
      • As RTT fluctuates and occasionally increases, the window size slightly decreases or varies, showing TCP reacting to network conditions.
      • This reflects a partial inverse relationship: higher delay leads to cautious reduction in sending rate.
      • Overall, TCP dynamically adapts to moderate congestion, maintaining balance between throughput and latency.

    High Traffic

                 

      • The TCP window size shows frequent and sharp fluctuations, indicating aggressive congestion control activity.
      • When RTT increases, the window size often drops significantly, showing a clear inverse relationship.
      • This reflects TCP reacting to heavy congestion by reducing the sending rate to avoid packet loss.
      • Overall, under high traffic, TCP continuously adjusts its window size, resulting in unstable throughput and high latency.

    COMPARISON TABLE

     
    Graph Low Traffic Medium Traffic High Traffic
    Average RTT Low and stable, negligible queuing delay Higher values, frequent fluctuations, intermittent congestion Significantly high, continuous fluctuations, network overloaded
    Maximum RTT Occasional short-lived spikes, rare delay variations Frequent higher spikes, growing instability in peak latency Consistently high with sharp spikes, severe worst-case delays
    Minimum RTT Very low and nearly constant, stable baseline Relatively low with slight variations, core path mostly stable Higher and more variable, baseline latency degraded
    RTT Jitter Very small gap, highly consistent delay Noticeably larger gap, moderate instability Very large persistent gap, highly unstable and unpredictable
    RTT vs Load No correlation, network has sufficient capacity Partial positive correlation, intermittent congestion Strong positive correlation, network at or beyond capacity
    RTT vs Retransmissions No retransmissions, zero packet loss No retransmissions, delay present but delivery reliable Retransmissions in bursts, packet loss confirmed
    RTT vs TCP Window Size Stable window size, no congestion control needed Noticeable adjustments, partial inverse relationship Frequent sharp drops, aggressive congestion control active


    OBSERVATIONS

  • Under low traffic conditions, RTT remains low and stable with negligible queuing delay. As traffic increases to medium and high levels, RTT rises significantly and becomes highly unpredictable, confirming that network delay grows directly with load.
  • Jitter, measured as the gap between maximum and minimum RTT, is minimal under low traffic, indicating a stable and consistent network. As traffic increases, this gap widens considerably, reflecting increasing instability and erratic packet delivery timing.
  • No retransmissions were observed under low or medium traffic conditions, meaning the network successfully delivered all packets despite some delay. However, under high traffic, retransmissions appeared in bursts aligned with RTT spikes, confirming that excessive congestion leads to packet loss and reduced reliability.
  • TCP window size remained stable under low traffic, requiring no congestion control adjustments. As RTT increased under medium and high traffic, the window size began to decrease — under high traffic, sharp and frequent drops were observed, reflecting TCP's AIMD mechanism actively cutting the sending rate to manage congestion.
  • Overall network performance degrades progressively with increasing load. What begins as minor RTT fluctuations under medium traffic escalates into sustained high latency, high jitter, packet loss, and unstable throughput under high traffic — demonstrating a clear and consistent relationship between traffic load and network quality.

    • NEW FINDINGS

  • RTT increases significantly as traffic load increases.
  • Network latency remains stable under low traffic but becomes highly variable under high traffic.
  • Jitter increases with traffic, indicating reduced stability in delay.
  • Maximum RTT shows sudden spikes, revealing temporary congestion.
  • Minimum RTT remains relatively stable, representing baseline path delay.
  • Retransmissions occur only under heavy traffic, indicating packet loss due to congestion.
  • TCP window size decreases during high RTT, showing active congestion control.
  • Load and RTT show a direct relationship under high traffic conditions.

    • RECOMMENDATION

  • Avoid excessive traffic load to maintain low latency and stable network performance.
  • Implement traffic management techniques to reduce congestion.
  • Optimize TCP parameters (window size, buffer) for better performance.
  • Use Quality of Service (QoS) mechanisms for real-time applications.
  • Monitor RTT and jitter regularly to detect early signs of congestion.
  • Improve network bandwidth or capacity under heavy load conditions.
  • Reduce packet loss by minimizing buffer overflow and retransmissions.


    • USE OF AI IN DA

  • AI tools were used to assist in understanding network concepts such as RTT, jitter, retransmissions, and TCP window behavior.
  • AI helped in interpreting Wireshark graphs and identifying patterns related to congestion and delay.
  • Assistance was taken to structure the analysis and documentation in a clear and organized manner.
  • AI was used to refine technical explanations and improve clarity of observations.
  • The actual experiment, including packet capture, traffic generation, and graph creation, was performed independently.


    • CONCLUSION

    This experiment demonstrates that network performance is highly sensitive to traffic load, and the effects become clearly visible through RTT analysis across multiple graph parameters.

    Under low traffic conditions, the network operates in a stable and efficient state. RTT remains consistently low with negligible queuing delay, jitter is minimal, no retransmissions occur, and the TCP window size holds steady — indicating that the network has sufficient capacity to handle the load without any performance degradation.

    As traffic increases to medium levels, the network begins to show early signs of stress. RTT rises and starts fluctuating, indicating that queuing delay is building up. Jitter increases, making packet delivery less consistent. Although no retransmissions are observed at this stage, the network is clearly operating near its capacity, and latency becomes less predictable.

    Under heavy traffic conditions, the network experiences severe congestion across all measured parameters. RTT becomes significantly elevated and highly unstable. Jitter reaches its peak, reflecting erratic and unpredictable packet delays. Retransmissions begin to appear in bursts, confirming that packet loss is occurring due to buffer overflow and timeout events. Simultaneously, TCP responds by aggressively reducing its window size through its congestion control mechanism, sacrificing throughput in order to prevent further packet loss.

    Thus, RTT analysis provides a comprehensive and clear understanding of how network behavior evolves under different load conditions — from a stable, low-latency state to a congested, unreliable one — making it one of the most effective metrics for evaluating real-world network performance.


    YOUTUBE VIDEO LINK

    https://youtu.be/EtKuYEumpF0


    GITHUB REPO

    https://github.com/UTKARSHPDUBEY/cn-lab


    ACKNOWLEDGEMENT

    I would like to express my sincere gratitude to the School of Computer Science and Engineering (SCOPE), Vellore Institute of Technology Chennai, for offering both the theory and laboratory courses in Computer Networks during the Winter Semester 2025–2026 with an industry-oriented syllabus that provided the foundation for this work.

    I extend my heartfelt thanks to Dr. T. Subbulakshmi, Professor, SCOPE, VIT Chennai, for her continuous guidance, valuable suggestions, and encouragement throughout this Digital Assignment. Her structured approach toward practical network analysis greatly helped in shaping this work.

    I would also like to acknowledge Gerald Combs, recipient of the ACM Software System Award (2018), for developing Wireshark, an outstanding and industry-standard software tool that made detailed packet capture and traffic analysis possible.

    I would like to thank my peers for their constructive discussions, idea sharing, and technical suggestions during the execution of this assignment.A special note of thanks to my close friends who initially helped me understand the setup of Wireshark capture, traffic generation, and packet analysis, which enabled me to proceed confidently with the detailed experimentation.

    Finally, I acknowledge all the books, technical webpages, online documentation, and reference materials that contributed to the successful completion of this Digital Assignment.


    AUTHOR

    Utkarsh Dubey, II year B.Tech. CSE student, School of Computer Science and Engineering , VIT Chennai


    Comments

    Post a Comment