There are numerous reasons that packet round-trip time between a pair of endpoints may change during normal operation. For example, the packets may encounter congestion at one of the routers. As another example, packets may be routed differently (but are not meaningfully diverted) as part of the telecommunications network that makes up the IP-based network changes. For example, a telecommunications link may fail or become congested and the packets are automatically routed onto a backup telecommunications link. This happens regularly in large scale IP-based networks such as the Internet where the network is functioning properly so that the packets are automatically rerouted and delivered to their destination endpoint. The effect upon packet transmission times is called “jitter,” and is characterized by some packets taking longer amounts of time and some packets taking shorter amounts of time to traverse between two endpoints. Embodiments disclosed herein may distinguish between alternatively routed and surreptitiously diverted packets using the discrimination techniques described below.

As another example, a packet round trip time may change due to an endpoint changing physical location. For example, the location of one of the endpoints may change when the endpoint is connected to the IP-based network using a different wireless access point or cellular tower. The packets thus take a different routing, and may traverse between endpoints more slowly or more quickly than previously measured. Embodiments disclosed herein may distinguish between alternatively routed and surreptitiously diverted packets using the discrimination techniques described below.