Ruru: live, end-to-end TCP latency monitoring

'Ruru' is a TCP latency monitoring application that helps understanding wide area TCP traffic in real time. It utilises Intel DPDK for high speed packet processing (up to 40Gbit/s) and a Node.JS web frontend to present results. 

Ruru is a collaboration between us and REANNZ, New Zealand's Advanced Research and Education Network.

Ruru live

Ruru live map


The system componses of three parts:

  • DPDK-latency backend (written in C / multi-threaded): This software measures the elapsed time between SYN, SYN-ACK and the first ACK TCP packets for all TCP streams. It sends the measurement information (source IP, destination IP, latency (in microsecond)) on a ZMQ sockets.
  • Analytics (written in C / multi-threaded): This component retrieves AS / geotag / proxy information for all IPs (using databases) in the measurement data received from the DPDK backend and generates basic statistics. It pushes information in JSON format on ZMQ sockets.
  • Frontend: It is a Node.js built with React and Deck.Gl. It uses to communicate with the browser.

Communication between components uses sockets (zmq and websockets). The high-level architecture is shown below.


Publications and links

Ruru has been published in:

  • Cziva, Richard (University of Glasgow), Lorier, Chris (REANNZ) and Pezaros, D. Pezaros  (University of Glasgow) Ruru: High-speed, Flow-level Latency Measurement and Visualization of Live Internet Traffic. (2017) In: ACM SIGCOMM 2017, Los Angeles, CA, USA, 21-25 Aug 2017 (second place on ACM SRC competition)

Source code:

Ruru has been presented / mentioned in: