Real-time network performance monitoring system and related methods

• US 20040054680A1
• Filed: 06/13/2003
• Published: 03/18/2004
• Est. Priority Date: 06/13/2002
• Status: Active Grant

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: NetScout Systems Incorporated
• Inventors: Nadkarni, Rajeev, Singhal, Ashwani, Kelley, Bruce, Sweet, Bruce, Singhal, Anil
• Granted Patent: US 7,711,751 B2
• Time in Patent Office: Days
• US Class Current: 707/100
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/02 Capturing of monitoring data
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: Y10S 707/922 Communications

Abstract

Network performance data is collected, recorded, and normalized. In one embodiment, a set of first performance data collected by an agent in response to network transactions initiated by the agent and a second set of performance data resulting from passively monitoring traffic on the network are received. The first and second sets of performance data are normalized to create a set of constantly formatted network performance data capable of convenient analysis.

Claims

1. A method of collecting, recording, and normalizing network performance information, the method comprising:

receiving a first set of performance data collected by an agent in response to network transactions initiated by the agent;

receiving a second set of performance data resulting from passively monitoring network traffic; and

normalizing the first set of performance data and the set of second performance data to create normalized network performance data having a single format.

2. The method of claim 1 wherein the step of receiving the first set of performance data comprises receiving performance data from one of (i) an agent directly, and (ii) an agent indirectly via a probe.

3. The method of claim 1 wherein the step of receiving the first set of performance data comprises receiving performance data from one of (i) an adapter directly, and (ii) an agent indirectly via a probe.

4. The method of claim 1 wherein the first set of performance data comprises data related to a response time of a network resource.

5. The method of claim 1 wherein the first set of performance data further comprises data related to the availability of the network resource.

6. The method of claim 1 wherein the method steps are performed by a probe.

7. The method of claim 6 wherein the probe is resident at a network interface.

8. The method of claim 7 wherein the network interface is an interface between a computer and a network interface point.

9. The method of claim 8 wherein the network interface point is a switch.

10. The method of claim 8 wherein the network interface point is a router.

11. The method of claim 7 wherein the network interface is an interface between a service provider network and a local site network.

12. The method of claim 1 further comprising the step of storing the normalized network performance data on a server.

13. The method of claim 12 wherein the step of storing the data further comprises storing the normalized network performance data in a schema according to a common data model.

14. A system for collecting, recording, and normalizing network performance information, the system comprising:

at least one agent operably connected to a computer network, the agent generating a first set of performance data; and

at least one probe in communication with the agent, the probe comprising a (i) monitor for passively monitoring the network traffic to thereby collect a second set of performance data, and (ii) a normalizer for normalizing the first set of performance data and the second set of performance data to generate a set of normalized network performance data having a single format.

15. The system of claim 14 further comprising a server in communication with the at least one device for receiving and storing the normalized network performance data in a schema according to a common model.

16. The system of claim 15 wherein the device is a probe.

17. The system of claim 15 wherein the probe is further comprised of an adapter for adapting data received from a plurality of network devices into a single format.

18. A memory comprising network performance data stored according to a common data model that includes a first set of performance data collected from monitoring synthetic network transactions and second set of performance data collected by passively monitoring a computer network.

19. A method of actively generating and passively collecting data on a network, the method comprising:

generating, by a probe in communication with the network, a synthetic network transaction;

collecting data related to the synthetic network transaction;

passively collecting, by the probe, performance data related to network transactions; and

normalizing the synthetic transaction data and the passive network transaction data to generate a set of normalized network transaction data.

20. The method of claim 19 wherein the step of collecting data related to the synthetic network transaction comprises collecting data related to a response time of a network resource.

21. The method of claim 20 wherein the step of collecting data related to the synthetic network transaction further comprises collection data related to the availability of a network resource.

22. The method of claim 19 further comprising the step of storing the normalized network transaction data.

23. The method of claim 22 wherein the step of storing the normalized network transaction data comprises storing the normalized network transaction data on a server.

24. The method of claim 23 wherein the step of storing the normalized network transaction data on a server comprises storing the normalized network transaction data in a schema according to a common data model.

25. A network performance data collection device comprising:

a probe comprising at least one network interface card, a monitor for passively monitoring network traffic received via the network interface card, an extractor for extracting a first set of network performance data related to at least one management information base, an agent for actively generating synthetic network transactions and extracting a second set network performance data related to the at least one management information base, and a normalizer for normalizing the first set and second set of network performance data.

26. The device of claim 25 further comprising a storage device for storing the normalized performance data.

27. The device of claim 26 wherein the storage device stores the normalized performance data in a schema according to a common data model.

28. A method of collecting data on a network, the method comprising:

capturing passive data by a probe in communication with the network;

receiving a first indicator from an agent in communication with the probe that a synthetic transaction is beginning;

capturing data related to the synthetic transaction; and

receiving a second indicator from the agent that the synthetic transaction is ending.

29. The method of 28 further comprising the step of normalizing the captured passive data and the captured data related to the synthetic transaction, thereby generating a set of normalized network transaction data.

30. The method of claim 29 further comprising the step of storing the normalized network transaction data.

31. The method of claim 30 wherein the step of storing the normalized network transaction data comprises storing the normalized network transaction data on a server.

32. The method of claim 31 wherein the storing the normalized network transaction data on a server further comprises storing the normalized network transaction data in a database schema according to a common data model.

33. A method of monitoring the performance of a computer network, the method comprising:

receiving network performance information from at least one management information base;

incorporating the received data into a common data model; and

storing the common data model for access by a software application.

34. A method of monitoring the performance of a computer network, the method comprising:

receiving network performance information from a plurality of interfaces;

normalizing the network performance information to conform to a common data model;

aggregating the network performance information received from two or more of the plurality of interfaces; and

providing access to the aggregated network performance information;

35. The method of claim 34, wherein providing access to the aggregated performance information comprises providing access to the aggregated performance information in the common data model.

36. A method of monitoring the performance of a computer network, the method comprising:

receiving network performance information at a plurality of source probes, each source probe receiving network performance information from a plurality of management information bases;

transmitting the network performance data received at each source probe to a single destination probe;

incorporating the network performance data received at the single destination probe into a common data model; and

aggregating the transmitted data at the destination probe into a single data structure.

37. The method of claim 36 further comprising storing the single data structure.

38. The method of claim 37 wherein the step of storing the single data structure comprises storing the single data structure on a server.

39. The method of claim 38 wherein the storing of the single data structure on a server further comprises storing the single data structure in a schema according to a common data model.

40. A system for collecting, recording, and normalizing network performance information, the system comprising:

a plurality of source probes operably connected to a computer, the source probes collecting a first set of performance data from a computer network; and

a destination probe in communication with the source probes, the destination probe comprising a (i) a receiver for receiving the performance data from the source probes, and (ii) an aggregation module for aggregating the performance data into a set of normalized network performance data having a single format.

41. The system of claim 40 further comprising a storage device for storing the normalized network performance data.

42. The system of claim 41 wherein the storage device stores the normalized network performance data in a schema according to a common data model.

43. A method of associating network performance data with an alarm in a computer network, the method comprising:

receiving network performance data;

buffering at least a portion of the network performance data;

analyzing the network performance data to generate a performance metric;

generating an alarm if the value of the performance metric is outside a defined range; and

associating the at least a portion of the buffered data with the alarm.

44. The method of claim 43 wherein the performance metric is the availability of the computer network.

45. The method of claim 43 wherein the performance metric is the throughput of the computer network.

46. The method of claim 43 wherein the performance metric is the speed of the computer network.

47. The method of claim 43 further comprising the step of analyzing the buffered data associated with the alarm to determine the cause of the performance metric being outside the defined range.

48. The method of claim 43 further comprising storing the buffered data in a schema according to a common data model.

49. A demonstrative device for marketing a system for monitoring the performance of a computer network, the device comprising:

a first disk listing on one side thereof a plurality of computer communication applications;

a second disk disposed on the first disk and coaxial therewith, the second disk listing on one side a plurality of computer network communication methods; and

a third disk disposed on the second disk and coaxial therewith, the third disk listing on one side a plurality of computer network performance metrics, rotation of the disks aligning various combinations of applications, methods and metrics.