How does Argus measure jitter?

[Carter Bullard]

Hey Nik,
Argus measures inter-packet arrival times for each flow, and reports the mean, max, min and stdDev for each side of the bi-directional flow.  This is packet jitter, and is useful for understanding network bursting, shape and queueing behavior. StdDev is a little easier to work with compared to the variance when N gets to be huge.

This jitter metric is NOT one-way latency variance, which some network engineers call network jitter.  Network jitter is a difficult metric to formulate, as it requires some form of coupling of two end-to-end sensors, usually through timestamp labeling of packets, to generate the one-way estimates.  

However, because each argus record has 4 microSecond timestamps, one for the first and last observed packet in either direction, Argus data can be used to generate sampled network jitter.  This is done through differencing matching flow records from two independant probes that are deployed near or in the end systems of interest.  A good one-way delay measurement requires that the two probes be time synchronized, but formulating a decent estimate of the variance of the delay ( network jitter ) doesn't require synchronization, as long as the two sensors clocks are not drifting.

Argus data can also be used to calculate network transit time (NTT) which is ( RTT - Host Delay ), because argus is a bi-directional flow monitor.  This is also done through differencing matching flow data from two independant probes, deployed in the end systems, in this case time synchronization is not needed.  This generates a very good metric for bi-directional network jitter, as the host component is removed.

Argus is designed specifcially to enable these types of metrics, as the probe is self-synchronizing.  The two independent sensors, looking at the same packet stream, will generate network flow data that is packet aligned.

Hope this helps, if that raises more questions, send more mail !!!

Carter

On Oct 27, 2011, at 4:56 AM, Nik Mitev <nik at mitev.eu> wrote:

> Hi,
> 
> I am looking at the possibility to use our existing Argus installation
> to monitor jitter and packet loss. My concern is that, especially with
> udp traffic, Argus is likely to be effectively guessing the jitter
> amount rather than doing reliable measurements and blurring the
> difference between delay introduced by software at end points and true
> network delay.
> I am hoping that someone will prove me wrong :)
> 
> What formula/algorithm does Argus use for jitter measurement?
> 
> Cheers,
> Nik 
> 
>