Network expert analysis process

• US 20040054776A1
• Filed: 09/12/2003
• Published: 03/18/2004
• Est. Priority Date: 09/16/2002
• Status: Abandoned Application

• Current Assignee: Finisar Corporation (II-VI Incorporated)
• Original Assignee: Finisar Corporation (II-VI Incorporated)
• Inventors: Mann, Jason David, McDaniel, Timothy Lane, Klotz, Steve
• Application Number:
  US10/661,705
• Publication Number:
  US 20040054776A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/087 Jitter
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 43/18 Protocol analysers

Abstract

Embodiments of the invention provide an expert analysis method for analyzing a network. The method includes capturing at least one bidirectional data trace from the network, determining a network topology, analyzing protocols in conversations between initiators and targets to determine if the protocols are valid using the determined network topology and known protocol standards, and displaying at least one of errors or warnings determined in the protocol and metrics calculated from the analysis of the protocols to a user.

Claims

1. A method for analyzing a network, comprising:

capturing at least one bidirectional data trace from the network;

determining a network topology;

analyzing protocols in conversations between initiators and targets to determine if the protocols are valid using the determined network topology and known protocol standards; and

displaying at least one of errors or warnings determined in the protocol and metrics calculated from the analysis of the protocols to a user.

2. The method of claim 1, wherein analyzing comprises:

applying protocol experts to the data trace;

generating metrics based upon the topology and the analyzed protocols; and

generating and storing device state snapshots.

3. The method of claim 2, wherein generating snapshots comprises generating snapshots for each device on the network at a plurality of predetermined equal intervals across the data trace duration.

4. The method of claim 1, wherein the errors, warnings, and metrics describe the flow of data in the data trace.

5. The method of claim 1, wherein analyzing further comprises filtering invalid data from the data trace prior to analysis.

6. The method of claim 5, wherein filtering comprises:

filtering the data trace for open commands that are not perceived by at least one analyzer positioned in communication with the network and eliminating devices associated with these open commands not received by an analyzer from further analysis;

filtering the data trace for failed open commands and eliminating devices associated with the failed open commands from further analysis;

filtering the trace data for frames to destinations that are not received by the analyzer and eliminating devices associated with these frame from further analysis; and

filtering frames transmitted when a loop is in closed state and eliminating devices associated with transmitting frames when a loop is closed from further analysis.

7. The method of claim 1, wherein analyzing protocols further comprises determining if nested protocols are present and analyzing each of the nested protocols with a protocol specific expert if nested protocols are determined.

8. The method of claim 1, wherein analyzing comprises at least one of determining if conversation rules were complied with, determining if the conversation format was within a predetermined standard for the conversation protocol, determining if a conversation payload was accurately received, and determining if the conversation workload was completed in a reasonable duration.

9. A method for conducting an expert analysis process on a network, comprising:

positioning at least one analyzer in communication with the network, the at least one analyzer being positioned to capture bidirectional conversations between each device on the network;

determining a network topology from at least one data trace captured be the analyzers;

analyzing the data trace to determine if conversation protocol between devices was followed;

calculating at least one user selected network metric; and

displaying determined network errors and calculated metrics to the user via a graphical user interface.

10. The method of claim 9, wherein determining network topology comprises

extrapolating network device presence indicators from left and right channel data from the data trace;

and

determining the network topology from the network device indicators.

11. The method of claim 9, wherein analyzing the data trace comprises:

applying experts to the data trace and determined topology to determine protocol errors;

calculating network performance metrics from the data trace; and

generating device state snapshots for each device in the network at predetermined intervals through the data trace.

12. The method of claim 9, wherein analyzing the data trace further comprises determining valid data from the trace data for analysis.

13. The method of claim 9, wherein analyzing comprises at least one of determining if conversation rules were complied with, determining if the conversation format was within a predetermined standard for the conversation protocol, determining if a conversation payload was accurately received, and determining if the conversation workload was completed in a reasonable duration.

14. The method of claim 9, wherein analyzing further comprises filtering invalid data from the data trace prior to analysis.

15. The method of claim 14, wherein filtering comprises:

filtering the data trace for open-commands that are not perceived by at least one analyzer positioned in communication with the network and eliminating devices associated with these open commands not received by an analyzer from further analysis;

filtering the data trace for failed open commands and eliminating devices associated with the failed open commands from further analysis;

filtering the trace data for frames to destinations that are not received by the analyzer and eliminating devices associated with these frame from further analysis; and

filtering frames transmitted when a loop is in closed state and eliminating devices associated with transmitting frames when a loop is closed from further analysis.

16. An expert analysis method for networks, comprising:

capturing a data trace from a network with an analyzer;

determining a network topology from the data trace;

generating a filtered data trace having only conversations related to valid devices therein;

applying a plurality of experts to the filtered data trace to determine errors in the network operation;

displaying the determined errors to a user via a graphical user interface.

17. The method of claim 16, wherein applying the plurality of experts comprises rebuilding user layer protocols for each frame in the trace data.

18. The method of claim 17, wherein rebuilding comprises stripping a specific protocol layer from the frame, sending the specific protocol layer to a software expert configured to analyze the specific protocol layer, and repeating the stripping and sending steps until each layer of the frame has been analyzed by a software expert.

19. The method of claim 18, wherein the network is an FC network.

20. The method of claim 16, wherein determining the network topology comprises parsing through the data trace looking for indicators of the presence of valid devices on the network, and storing a topology representative of the devices found.