Method and system for network monitoring using signature packets

• US 10,129,115 B2
• Filed: 09/21/2015
• Issued: 11/13/2018
• Est. Priority Date: 02/15/2012
• Status: Active Grant

• Current Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Original Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Inventors: Stevens, Michael, D'Eletto, Robert
• Primary Examiner(s): Riad, Amine
• Application Number:
  US14/860,054
• Publication Number:
  US 20160013996A1
• Time in Patent Office: 1,149 Days
• CPC Class Codes: G06F 11/3065 Monitoring arrangements determined by the means or processing involved in reporting the monitored data error or fault reporting or logging G06F11/0766
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method of monitoring a network with a test device connected to the network includes monitoring a plurality of packets which pass through the test device, comparing a predefined field of each of the plurality of packets to a predefined pattern so as to identify signature packets, evaluating whether the signature packets satisfy a predefined condition, and, if the predefined condition is satisfied, sending a notification to a user. A system implementing the method is provided.

Claims

1. A device comprising:

a memory configured to store instructions; and

a processor configured to execute the instructions to;

receive a packet that includes one or more Quality of Service (QoS) fields;

compare a value associated with the packet to stored values to identify signature information;

determine, using a rule and based on comparing the value associated with the packet to the stored values, whether the signature information satisfies a particular condition,

the rule corresponding to a signature associated with the signature information, and

the particular condition including one of;

a period of time, associated with receiving the packet and another packet, satisfying a threshold time value, or

a quantity of the one or more QoS fields, associated with the packet, having a respective value that matches; and

selectively transmit, based on determining whether the signature information satisfies the particular condition, a notification that indicates a potential problem affecting one or more real time network services.

2. The device of claim 1, where the packet is transmitted from a source device and intended for a destination device,

the device being different than the source device and different than the destination device.

3. The device of claim 1, where the processor is further configured to:

transmit, when the period of time associated with receiving the packet and the other packet does not satisfy the threshold time value, the notification.

4. The device of claim 1, where the processor is further configured to:

transmit, when the respective values do not match, the notification.

5. The device of claim 1, where the processor is further configured to:

transmit the signature information to a source device.

6. The device of claim 1, where the device monitors a plurality of packets, transmitted from a source device to a destination device, using passive monitoring and active testing.

7. The device of claim 1, where the one or more Quality of Service (QoS) fields include at least one of a Virtual Local Area Network (VLAN) field, an Internet Protocol (IP) field, or a Multiprotocol Label Switching (MPLS) field.

8. A method comprising:

receiving, by a device and from a sensor device, a packet that includes one or more Quality of Service (QoS) fields;

comparing, by the device, a value associated with the packet to stored values to identify signature information;

determining, by the device, using a rule, and based on comparing the value associated with the packet to the stored values, whether the signature information satisfies a particular condition,

the rule corresponding to a signature associated with the signature information, and

the particular condition including at least one of;

a period of time, associated with receiving the packet and another packet, satisfying a threshold time value,

a quantity of the one or more QoS fields, associated with the packet, having a respective value that matches, or

a difference between a first quantity of packets, identified by the sensor device, and a second quantity of packets, identified by another sensor device, satisfying a threshold value; and

selectively transmitting, by the device and based on determining whether the signature information satisfies the particular condition, a notification that includes a potential problem affecting one or more real time networks.

9. The method of claim 8, further comprising:

transmitting, when the period of time associated with receiving the packet and the other packet does not satisfy the threshold time value, the notification.

10. The method of claim 8, further comprising:

transmitting, when the respective values do not match, the notification.

11. The method of claim 8, where

the first quantity of packets and the second quantity of packets each include a respective timestamp, and

the method further includes:

determining, based on the respective timestamp, whether a delay satisfies another threshold value,

the delay being based on when the sensor device receives the packet and when the other sensor device receives the other packet; and

transmitting, when the delay does not satisfy the other threshold value, the notification.

12. The method of claim 8, further comprising:

transmitting, when the difference between the first quantity of packets and the second quantity of packets does not satisfy the threshold value, the notification.

13. The method of claim 8, further comprising:

counting the first quantity of packets; and

counting the second quantity of packets.

14. The method of claim 8, where the one or more Quality of Service (QoS) fields include at least one of a Virtual Local Area Network (VLAN) field, an Internet Protocol (IP) field, or a Multiprotocol Label Switching (MPLS) field.

15. A device comprising:

a memory configured to store instructions; and

a processor configured to execute the instructions to;

receive, from a sensor device, a packet that includes one or more Quality of Service (QoS) fields;

compare a value associated with the packet to stored values to identify signature information;

determine, using a rule and based on comparing the value associated with the packet to the stored values, whether the signature information satisfies a particular condition,

the rule corresponding to a signature associated with the signature information, and

the particular condition including at least one of;

a period of time, associated with receiving the packet and another packet, satisfying a threshold time value,

a quantity of the one or more QoS fields, associated with the packet, having a respective value that matches, or

a difference between a first quantity of packets, identified by the sensor device, and a second quantity of packets, identified by another sensor device, satisfying a threshold value; and

selectively transmit, based on determining whether the signature information satisfies the particular condition, a notification that indicates a potential problem affecting one or more real time network services.

16. The device of claim 15, where the processor is further configured to:

transmit, when the difference between the first quantity of packets and the second quantity of packets does not satisfy the threshold value, the notification.

17. The device of claim 15, where the processor is further configured to:

transmit, when the period of time associated with receiving the packet and the other packet does not satisfy the threshold time value, the notification.

18. The device of claim 15, where the processor is further configured to:

transmit, when the respective values do not match, the notification.

19. The device of claim 15, where

the first quantity of packets and the second quantity of packets each include a respective timestamp, and

the processor is further configured to:

determine, based on the respective timestamp, whether a delay satisfies another threshold value,

the delay being associated based on when the sensor device receives the packet and when the other sensor device receives the other packet; and

transmit, when the delay does not satisfy the other threshold value, the notification.

20. The device of claim 15, where the one or more Quality of Service (QoS) fields include at least one of a Virtual Local Area Network (VLAN) field, an Internet Protocol (IP) field, or a Multiprotocol Label Switching (MPLS) field.