Distributed packet capture and aggregation

• US 20030142666A1
• Filed: 01/25/2002
• Published: 07/31/2003
• Est. Priority Date: 01/25/2002
• Status: Active Grant

• Current Assignee: Architecture Technology Corporation
• Original Assignee: Architecture Technology Corporation
• Inventors: Bonney, Jordan C., Burnett, Benjamin L., Charan, Deborah K.
• Granted Patent: US 7,203,173 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0847 Transmission error
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/50 Testing arrangements

Abstract

A system is described for monitoring and testing enterprise networks that tend to have a number of geographically dispersed devices and interconnected sub-networks. The system includes a plurality of distributed agents to capture packets from a network. The system further includes an aggregation module coupled to the network to receive and aggregate the captured packets. During the aggregation process, the aggregation module identifies duplicate packets that were captured by different agents as an originating packet traverses the network. A display is coupled to the aggregation module, presents the non-duplicate network packets, giving a user a clear illustration of network activity. For the duplicate packets, the aggregation module presents a representative packet, such as the originating packet, that may be expanded by the user to view the details of the duplicate packets.

Claims

1. A method comprising:

capturing network packets using a plurality of distributed agents;

identifying duplicate network packets that were captured by different agents; and

displaying a subset of the network packets based on the identification.

2. The method of claim 1, wherein displaying a subset of the network packets comprises:

displaying the non-duplicate network packets; and

displaying a representative packet for the duplicate packets.

3. The method of claim 1, wherein displaying a representative packet comprises:

comparing timestamps of the duplicate packets, and

displaying one of the packets based on the comparison.

4. The method of claim 1, wherein displaying a subset of the network packets further comprises:

filtering the non-duplicate packets; and

displaying the duplicate packets.

5. A method comprising:

capturing network packets using a plurality of distributed agents;

communicating the captured network data to an aggregator; and

aggregating the captured network packets into sets of network packets based on source information and destination information for the network packets.

6. The method of claim 5, wherein aggregating the captured network packets comprises:

sorting the network packets based on timestamps of the network packets;

assigning the network packets having equal source information and equal destination information to a common set; and

identifying within the sets duplicate packets that were captured by different agents.

7. The method of claim 6, further comprising displaying a subset of the network packets based on the identification.

8. The method of claim 6, wherein identifying duplicate packets comprises:

identifying network packets having equal sequence numbers and acknowledgement numbers; and

performing a byte-by-byte comparison for payloads of the identified packets.

9. The method of claim 5, wherein the source information comprises one of a media access control (MAC) address and a Data Link Control (DLC) address for a source network device.

10. The method of claim 5, wherein the destination information comprises one of a media access control (MAC) address and a Data Link Control (DLC) address for a destination network device.

11. The method of claim 6, further comprising displaying non-duplicate data packets of one of the sets.

12. The method of claim 11, wherein displaying non-duplicative packets comprises displaying a representative packet for the duplicate packets.

13. The method of claim 11, wherein displaying a representative packet comprises:

comparing timestamps of the duplicate packets, and

displaying one of the packets based on the comparison.

14. A method comprising:

capturing network packets using a plurality of distributed agents;

communicating the captured network data to an aggregator;

aggregating the captured network packets into sets of network packets based on source information and destination information for the network packets; and

graphically illustrating the set of aggregated network packets.

15. The method of claim 14, further comprising:

selecting one of the sets of aggregated network packets in response to user input; and

displaying the packets of the selected set.

16. The method of claim 15, wherein displaying the packets of the selected set comprises:

identifying within the sets duplicate packets that were captured by different agents; and

displaying non-duplicate data packets of the selected set.

17. The method of claim 16, further comprising displaying a representative packet for the duplicate packets.

18. The method of claim 17, wherein displaying a representative packet comprises:

comparing timestamps of the duplicate packets, and

displaying one of the packets based on the comparison.

19. The method of claim 17, further comprising displaying the remainder of the duplicate packets in response to user input.

20. The method of claim 17, further comprising:

displaying an expandable graphical icon proximate the representative packet; and

displaying the remainder of the duplicate packets based on user input selecting the expandable graphical icon.

21. The method of claim 14, wherein capturing network packets comprises communicating start and stop commands from the aggregator to the agents.

22. A system comprising:

a plurality of distributed agents to capture packets from a network;

an aggregation module coupled to the network to receive the captured packets,

wherein the aggregation module identifies duplicate packets that were captured by different agents; and

a display coupled to the aggregation module, wherein the aggregation module presents the non-duplicate network packets on the display.

23. The system of claim 22, wherein the aggregation module presents a representative packet for the duplicate packets on the display.

24. The system of claim 23, wherein the agents assign the captured packets timestamps, and further wherein the aggregation module compares the timestamps of the duplicate packets and selects one of the duplicate packets for display as the representative packet.

25. The system of claim 23, wherein the aggregation module displays the remainder of the duplicate packets in response to user input selecting the representative packet.

26. The system of claim 22, wherein the aggregation module identifies duplicate packets by identifying packets having equal sequence numbers and acknowledgement numbers, and by performing a byte-by-byte comparison for payloads of the identified packets.

27. The system of claim 22, wherein the aggregation module assigns the captured packets into sets of packets based on source information and destination information for the packets.

28. The system of claim 22, wherein the agents assign the captured packets timestamps and the aggregation module sorts the packets based on timestamps, and further wherein the aggregation module assigns the packets having equal source information and equal destination information to a common set of packets.

29. The system of claim 28, wherein the source information comprises one of a media access control (MAC) address and a Data Link Control (DLC) address for a source network device.

30. The system of claim 28, wherein the destination information comprises one of a media access control (MAC) address and a Data Link Control (DLC) address for a destination network device.

31. The system of claim 22, further comprising a controller that maintains a communication link with each of the agents, wherein the controller issues commands to the agents via the communication link to initiate and terminate data capture by the agents.

32. A medium comprising instructions to cause a processor to:

direct a plurality of distributed agents to capture packets from a network;

receive the captured packets;

identify one or more sets of duplicate network packets that were captured by different agents;

display the non-duplicate network packets; and

display one of the a representative packet for each set of duplicate packets.

33. The medium of claim 32, further comprising instructions to cause the processor to:

compare timestamps of the duplicate packets, and

display one of the packets based on the comparison.

34. The medium of claim 32, further comprising instructions to cause the processor to:

identify network packets having equal sequence numbers and acknowledgement numbers; and

perform a byte-by-byte comparison for payloads of the identified packets.

35. The medium of claim 32, further comprising instructions to cause the processor to aggregate the captured network packets into sets of network packets based on source information and destination information for the network packets.

36. The medium of claim 35, further comprising instructions to cause the processor to sort the network packets based on timestamps of the network packets, assign the network packets having equal source information and equal destination information to a common set, and identify within the sets duplicate packets that were captured by different agents.

37. The medium of claim 35, further comprising instructions to cause the processor to graphically illustrate the set of aggregated network packets.

38. The medium of claim 37, further comprising instructions to cause the processor to select one of the sets of aggregated network packets in response to user input;

and display the packets of the selected set.