The Sting prototype

Our current implementation is based on raw sockets and packet filters running on FreeBSD 3.x and Digital Unix 3.2. As a work-around to the SYN/RST problem mentioned previously, we use the standard Unix connect() service to create the connection, and then hijack the session in progress using the packet filter and raw socket mechanisms. Unfortunately, this solution is not always sufficient as the host system can also become confused by acknowledgments for packets it has never sent. In our current implementation we have been forced to change one line in the kernel to control such unwanted interactions.¹ We are currently unsure if a completely portable user-level implementation is possible on today's Unix systems.

  

Figure: Sample output from the sting tool. By default, sting sends 100 probe packets according to a uniform inter-arrival distribution with a mean of 100ms.

Figure 5 shows the output presented by sting. From the command line the user can select the inter-arrival distribution between probe packets (periodic, uniform, or exponential), the distribution mean, the number of total packets sent, as well as the target host and port. Our implementation verifies that the wire time distribution conforms to the expected distribution according to the tests provided in [PAMM98].

We have tested our implementation in several ways. First, we have synthetically dropped packets in the tool and using an emulated network [Riz97] and verified that sting reports the correct loss rate. Second, we have compared the results of sting to results obtained from ping. Using the derivation for ping's loss rate presented in section 2 we have verified that the the results returned by each tool are compatible. Finally, we have tested sting with a large number of different host operating systems, including Windows 95, Windows NT, Solaris, Linux, FreeBSD, NetBSD, AIX, IRIX, Digital Unix, and MacOS. While we occasionally encounter problems with very poor TCP implementations (e.g. laser printers) and Network Address Translation boxes, the tool is generally quite stable.