Technique for monitoring data traffic

• US 10,015,688 B2
• Filed: 12/17/2012
• Issued: 07/03/2018
• Est. Priority Date: 12/17/2012
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Heikkila, Gunnar, Racz, Andras, Veres, Andras
• Primary Examiner(s): Sheikh, Ayaz R
• Assistant Examiner(s): Hampton, Tarell A
• Application Number:
  US14/652,354
• Publication Number:
  US 20150350938A1
• Time in Patent Office: 2,024 Days
• Field of Search: None
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic

Abstract

A technique that assists in identifying services for monitoring data traffic in a communication network is provided. The communication network includes a terminal configured to transceive data traffic and a component configured to measure data traffic. As to a method aspect of the technique, the terminal associates one or more communication services that are executed or executable at the terminal with one or more communication endpoints. The terminal further sends a service identification report indicative of the association to the component.

Claims

1. A method of identifying services for monitoring data traffic in a communication network including a terminal configured to transceive data traffic and a component configured to measure data traffic, the method comprising the steps performed by at least one hardware processor of the component of:

receiving, from the terminal, a service identification report indicative of an association of one or more communication services executed or executable at the terminal with one or more communication endpoints, the service identification report including at least one timestamp;

receiving, from the terminal, a service packet report including packet timestamps indicative of at least one of incoming time and outgoing time of data packets at the terminal for one of the communication services, wherein at least one of the service identification report, the service packet report and a separate time reference report is received from the terminal and includes a sending time, and wherein at least one of the at least one timestamp included in the service identification report and the packet timestamps included in the service packet report are adjusted based on a time difference between a receipt time at the component and the sending time reported by the terminal;

associating measured data traffic to one or more of the communication services based on the service identification report;

performing a statistical analysis of the measured traffic;

differentiating a plurality of classes of communication services based on the statistical analysis; and

performing an action based on the differentiating.

2. The method of claim 1, wherein at least one of a source socket, a destination socket, a socket pair and a communication protocol is derived from the measured data traffic and compared to the service identification report to identify the associated one or more communication services.

3. The method of claim 1, wherein at least one of outgoing time and incoming time, at the component, of data packets associated with the communication service are correlated to the reported packet timestamps.

4. A device for identifying services for monitoring data traffic in a communication network including a terminal configured to transceive data traffic and a component configured to measure data traffic, the device comprising:

a processor; and

a memory comprising instructions which when executed by the processor causes the processor to;

receive, from the terminal, a service identification report indicative of an association of one or more communication services executed or executable at the terminal with one or more communication endpoints, the service identification report including at least one timestamp;

receive, from the terminal, a service packet report including packet timestamps indicative of at least one of incoming time and outgoing time of data packets at the terminal for one of the communication services, wherein at least one of the service identification report, the service packet report and a separate time reference report is received from the terminal and includes a sending time, and wherein at least one of at least one timestamp included in the service identification report and the packet timestamps included in the service packet report are adjusted based on a time difference between a receipt time at the component and the sending time reported by the terminal;

associate measured data traffic to one or more of the communication services based on the service identification report;

perform a statistical analysis of the measured traffic;

differentiate a plurality of classes of communication services based on the statistical analysis; and

perform an action based on the differentiating.

5. The device of claim 4, wherein the device is installed at the component.

6. The device of claim 4, wherein the device comprises a network node and to perform the action based on the differentiating, the processor is configured to tailor a network capacity to the differentiation of the plurality of classes of communication services.

7. The device of claim 4, wherein the device comprises a network node and to perform the action based on the differentiating, the processor is configured to identify, for a user, communication services causing a monthly data quota of the user to be rapidly consumed.

8. The device of claim 4, wherein the device comprises a network node and to perform the action based on the differentiating, the processor is configured to discover a process executed at a terminal that uses the network above a threshold level to enable a user to determine whether to reconfigure or uninstall an application using the process.