{'fraction_non_alphanumeric': 0.019114688128772636, 'fraction_numerical': 0.001006036217303823, 'mean_word_length': 5.337579617834395, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Exposing server performance to network managers through passive network measurements

We describe a novel approach to managing the application-level performance of servers within an enterprise network given only passively-collected TCP/IP headers of packets from a link connecting clients to servers. The analysis is driven by constructing, in real-time, a source-level model of the request-response exchanges between each server and all of its clients. By continuously monitoring traffic, we generate a statistical profile of numerous application-layer measures of server performance. Given these measures, and their distributions over time, a network manager can quickly triage server performance problems in generic terms without any knowledge of the servers operation or a priori interaction with the serverpsilas operators. This approach is illustrated by using a continuous, 2-month dataset taken from a border router on the UNC campus to diagnose an actual problem with a UNC web portal.