[Paper Review] MopEye: Monitoring Per-app Network Performance with Zero Measurement Traffic

Daoyuan Wu, Weichao Li+2 more|arXiv (Cornell University)|Oct 5, 2016

Green IT and Sustainability3 references3 citations

TL;DR

MopEye is a passive-active measurement tool that monitors per-app network performance on unrooted Android smartphones using the VpnService API, enabling zero-injected-traffic RTT measurements with sub-millisecond accuracy. It achieves near-perfect alignment with tcpdump (≤1ms deviation) and outperforms MobiPerf by eliminating high-level API overhead and using low-level socket timestamps.

ABSTRACT

Mobile network performance measurement is important for understanding mobile user experience, problem diagnosis, and service comparison. A number of crowdsourcing measurement apps (e.g., MobiPerf [4, 6] and Netalyzr [5, 7]) have been embarked for the last few years. Unlike existing apps that use active measurement methods, we employ a novel passive-active approach to continuously monitor per-app network performance on unrooted smartphones without injecting additional network traffic. By leveraging the VpnService API on Android, MopEye, our measurement app, intercepts all network traffic and then relays them to their destinations using socket APIs. Therefore, not only MopEye can measure the round-trip time accurately, it can do so without injecting additional traffic. As a result, the bandwidth cost (and monetary cost of data usage) for conducting such a measurement is eliminated, and the measurement can be conducted free of user intervention. Our evaluation shows that MopEye's RTT measurement is very close to result of tcpdump and is more accurate than MobiPerf. We have used MopEye to conduct a one-week measurement revealing multiple interesting findings on different apps' performance.

Motivation & Objective

• To address the lack of continuous, non-intrusive per-app network performance monitoring on unrooted mobile devices.
• To eliminate the need for active probing and additional network traffic in mobile performance measurement.
• To enable accurate RTT measurement without root access or reliance on high-level networking APIs.
• To provide a scalable, user-transparent solution for long-term, large-scale mobile network monitoring.

Proposed method

• Leverages Android’s VpnService API to create a virtual network interface that intercepts all app-initiated and return network traffic.
• Passively captures and parses IP and TCP/UDP headers to map packets to their originating applications.
• Relays intercepted traffic through a user-space TCP stack and socket-based proxy to remote servers, maintaining connection state across two virtual connections.
• Measures RTT using low-level socket connect() calls with nanosecond-precision timestamps, avoiding high-level API overhead.
• Cross-references socket connections and state machines to synchronize traffic forwarding between the app and the remote server.
• Uses socket-based SYN-ACK timing as the primary RTT estimation method, validated as the most stable and accurate for single-round-trip measurement.

Experimental results

Research questions

• RQ1 Can per-app network performance be monitored continuously on unrooted Android devices without injecting additional network traffic?
• RQ2 How does the accuracy of RTT measurement using low-level socket calls compare to traditional tools like tcpdump and MobiPerf?
• RQ3 What is the performance overhead introduced by the measurement tool on normal app traffic?
• RQ4 Why do certain apps exhibit significant RTT degradation on 4G compared to WiFi?
• RQ5 Can DNS misconfigurations and server-side issues be detected and diagnosed through passive measurement?

Key findings

• MopEye’s RTT measurements deviate from tcpdump by at most 1ms, demonstrating sub-millisecond accuracy.
• MopEye outperforms MobiPerf by 12–79ms in RTT deviation, primarily due to lower-level system calls and nanosecond timestamps.
• The average additional delay introduced by MopEye on SYN-ACK packets is 4.15–5.98ms, and on data packets is 1.22–2.18ms, which is negligible compared to typical RTTs.
• Over 4G, Facebook’s mean RTT increased from 26.1ms (WiFi) to 188.4ms due to the absence of local servers in Hong Kong.
• WeChat’s connection failures were traced to DNS misconfiguration (hkminorshort.weixin.qq.com resolving to 1.1.1.1), later confirmed and fixed by Tencent.
• NetEase’s news app failed 18.1% of connections due to extremely high RTTs exceeding MopEye’s three-second timeout threshold.