Fig. 3From: A research survey in stepping-stone intrusion detectionIllustrations of an uRTT and two packets crossovers along a long connection chain with three hops. This figure provides an example of RTT and uRTT. We focus on the minimum of all uRTTs, some of which are much smaller than the real RTTs. This happened because of the existence of the packet crossovers in a long connection chain. If we compute the uRTT of the second pair of timestamps at Host 4, the uRTT2 is much smaller than RTT or the first uRTT1 in the figure. The reason for this difference is precisely due to the crossover of a response packet (Echo 2) with a request packet (Send 3)Back to article page