Know Thy Lag: In-Network Game Detection and Latency Measurement

Abstract

Online gaming generated $178 billion globally in 2020, with the popular shooter, action-adventure, role-playing, and sporting titles commanding hundreds of millions of players worldwide. Most online games require only a few hundred kbps of bandwidth, but are very sensitive to latency. Internet Service Providers (ISPs) keen to reduce “lag” by tuning their peering relationships and routing paths to game servers are hamstrung by lack of visibility on: (a) gaming patterns, which can change day-to-day as games rise and fall in popularity; and (b) locations of gaming servers, which can change from hour-to-hour across countries and cloud providers depending on player locations and matchmaking. In this paper, we develop methods that give ISPs visibility into online gaming activity and associated server latency. As our first contribution, we analyze packet traces of ten popular games and develop a method to automatically generate signatures and accurately detect game sessions by extracting key attributes from network traffic. Field deployment in a university campus identifies 31 k game sessions representing 9,000 gaming hours over a month. As our second contribution, we perform BGP route and Geolocation lookups, coupled with active ICMP and TCP latency measurements, to map the AS-path and latency to the 4,500+ game servers identified. We show that the game servers span 31 Autonomous Systems, distributed across 14 countries and 165 routing prefixes, and routing decisions can significantly impact latencies for gamers in the same city. Our study gives ISPs much-needed visibility so they can optimize their peering relationships and routing paths to better serve their gaming customers.

Appendices

A Fortnite Services

Table 3. Fortnite Services, their name prefixes (suffix=ol.epicgames.com) and purpose.

B Fortnite Game Signature Generation

Fig. 8.

An illustrative example of signature generation using Fortnite traffic traces.

As shown in Fig. 8 above, each row corresponds to attributes extracted from the first few packets of Fortnite gaming flows from our dataset. The attributes include protocol, transport layer port numbers, packet sizes and payload bytes. In one flow (identified by the standard five-tuple), protocol and server port remain the same but the packet sizes and content vary as more packets arrive. For this illustration, the table shows 5 packet sizes in each direction and (stripped) payload content of the first packet.

Some attribute values (shown in red) are fixed/constant across all the flows (called static signatures) and other (shown in green) fall within a close range of values (called dynamic signatures). These signatures are same across the flows implying that they can detect a Fortnite game session. Using the static and dynamic signatures, a signature JSON is built as shown in the next section which is then used as an input to the game classifier algorithmic model.

C Example Game Signatures

Figure 9 shows example signatures generated from our dataset. We can see that while all attributes have a key and a value, only ports has a range since it is a dynamic signature. We note that the complexity of signatures varies: some are primarily based on packet size (Rocket League) while others require payload bytes too (Fortnite and Call of Duty MW); some are based on attributes of first two packets (Fortnite and Rocket League) while others require more data (Call of Duty MW). These signatures need to be combined to predict the actual game being played as they may have some common attributes for e.g., both Fortnite and Call of Duty MW have the first upload packet length as 29 and thus require further inspection to classify the game. The classifier model takes into account all attributes and looks at the minimum number of packets to rapidly detect the game.

Fig. 9.

Signature of three representative game titles.