Fig. 4

Estimation of the connection length from H1 to Hn + 1. The timestamp gap between a send packet and its matched echo packet collected at H1 (the sensor) can be used to indicate the length of the connection chain from H1 to Hn + 1. The timestamp gap between a send packet and its matched echo packet collected at H₁ (the sensor) is denoted as RT T_e = te − ts. It is apparently not correct to use the timestamp gap between a send and its matched echo to represent the length of the connection from H₁ to H₂. What Yung’s approach used is the timestamp gap between a send packet and its ACK packet collected at H₁. We denote this gap as RT T_a = t_a-t_s. The ratio RT T_a/RT T_e can approximately tell how long the connection from H₁ to H_n + 1 is