The interest in data collected passively, measurement and analysis of traffic has increased tremendously and provides us with new ways to understand, operate and improve Networks performance. The heterogeneity of the Internet is constantly increasing, with new access technologies, new client devices and with more and more services and applications. On the other hand, the interest for the research community to measure enterprise performance has grown, due to a complexity that sometimes rivals Internet. This thesis is concerned with TCP traffic which carries the large majority of the Internet's traffic. While analyzing the performance of TCP transfers, we focused on the connections that correspond to valid and complete transfers, from the TCP perspective. The present work deals with various aspects of the challenging task of, revisiting TCP performance, performance study and anomalies detection.We revisit most important works and discuss problems faced when we studied TCP performance. We present an overview of the impact of the application, on the TCP transfers. We compare the performance of Cellular, FTTH (Fiber To The Home) and ADSL (Asymmetric Digital Subscriber Line) accesses. We shows that a study of classical parameters of performance analysis does not lead to a full understanding of client perceived throughput.
Then, we propose and validate a method that drills down into the data transfer of each well-behaved connection. The Data time break-down approach automatically extracts the application, access, server and client behavior impacts.
We focus on the issue of profiling anomalous TCP connections that are defined as functionally correct TCP connection but with abnormal performance. Our method enables to pinpoint the root cause of the performance problem, which can be either losses or some idle times during data preparation or transfer.