System for identifying and locating network problems

• US 20040225916A1
• Filed: 04/09/2004
• Published: 11/11/2004
• Est. Priority Date: 04/14/2003
• Status: Active Grant

• Current Assignee: Telchemy Incorporated
• Original Assignee: Telchemy Incorporated
• Inventors: Clark, Alan D.
• Granted Patent: US 7,808,915 B2
• Time in Patent Office: Days
• US Class Current: 714/25
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/0677 Localisation of faults
• CPC Class Codes: H04L 41/5087 wherein the managed service relates to voice services management of VoIP services H04M7/0081
• CPC Class Codes: H04L 41/509 wherein the managed service relates to media content delivery, e.g. audio, video or TV
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/087 Jitter
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00

Abstract

A network monitoring system for packet based multimedia signal transmission systems which identifies network problems that may affect multimedia performance and provides guidance as to the location of such problems within the network.

Claims

1. A method for identifying problems in a network environment, comprising the steps of:

a. during more than one interval determining the level of one or more-impairments;

b. grouping said levels of one or more impairments into one or more event groups;

c. comparing said one or more event groups with one or more problem signatures; and

d. categorizing at least one of said one or more event groups as being associated with a network problem having one of said one or more problem signatures.

2. A method as defined in claim 1, further comprising the steps of:

a. determining the source of more than one call;

b. grouping said more than one calls into one or more call groups based on the source of said more than one calls;

c. for each call group determining the number of calls having said network problem; and

d. estimating the location of said network problem based on the number of calls having said network problem.

3. A method as defined in claim 2, wherein determining the source of more than one call includes determining the source internet protocol address of said more than one call.

4. A method as defined in claim 2, wherein estimating the location of said network problem includes:

a. determining the percentage of calls within said call group having said network problem; and

b. estimating that the location of said network problem, is equal to the source associated with said call group if the percentage of calls is high.

5. A method as defined in claim 1, wherein said one or more impairments is selected from the group consisting of delay, packet loss, jitter, distortion, absolute packet delay variation, relative packet to packet delay variation, short term delay variation, short term average delay, timing drift, packet loss, and proportion of out-of-sequence packets.

6. A method as defined in claim 1, wherein said network problem is selected from the group consisting of local area network congestion, access link congestion, route change, access link failure, route flapping, load sharing, and route diversity.

7. A method as defined in claim 5, wherein said network problem is selected from the group consisting of local area network congestion, access link congestion, route change, access link failure, route flapping, load sharing, and route diversity.

8. A method as defined in claim 7, further comprising the steps of:

a. determining the source of more than one call;

b. grouping said more than one calls into one or more call groups based on the source of said more than one calls;

c. for each call group determining the number of calls having said network problem; and

d. estimating the location of said network problem based on the number of calls having said network problem.

9. A method as defined in claim 8, wherein determining the source of more than one call includes determining the source internet protocol address of said more than one call.

10. A method as defined in claim 8, wherein estimating the location of said network problem includes:

a. determining the percentage of calls within said call group having said network problem; and

b. estimating that the location of said network problem is equal to the source associated with said call group if the percentage of calls is high.

11. A method as defined in claim 7, further comprising the step of producing an array of said levels of one or more impairments from measurements taken at one location within the network.

12. A method as defined in claim 11, further comprising the steps of:

a. determining the source of more than one call;

b. grouping said more than one calls into one or more call groups based on the source of said more than one calls;

c. for each call group determining the number of calls having said network problem; and

d. estimating the location of said network problem based on the number of calls having said network problem.

13. A method as defined in claim 12, wherein determining the source of more than one call includes determining the source internet protocol address of said more than one call.

14. A method as defined in claim 12, wherein estimating the location of said network problem includes:

a. determining the percentage of calls within said call group having said network problem; and

b. estimating that the location of said network problem is equal to the source associated with said call group if the percentage of calls is high.

15. A method as defined in claim 7, wherein determining the level of one or more impairments includes:

a. applying a local timestamp to a packet corresponding to the actual arrival time of said packet;

b. extracting a sending timestamp from said packet;

c. extracting a sending sequence number from said packet;

d. estimating an expected arrival time for said packet; and

e. subtracting the actual arrival time of said packet from the expected arrival time of said packet.

16. A method as defined in claim 15, wherein determining the level of one or more impairments further includes computing an average of said subtracted value over a short period of time.

17. A method as defined in claim 15, wherein said one or more problem signatures includes:

a. a high value of short term delay variation without an increase in delay;

b. an increase in delay accompanied by an increase in short term delay variation followed by a decrease in delay;

or

c. an increase or decrease in delay accompanied by a substantially constant level of short term delay variation.

18. A method as defined in claim 15, wherein comparing said one or more event groups with one or more problem signatures includes:

a. comparing a change in delay during an interval with a threshold;

b. determining the level of said short term delay variation during said interval; and

c. determining whether a preceding interval contains a delay impairment.

19. A method as defined in claim 18, wherein categorizing at least one of said one or more event groups includes:

a. when said change in delay exceeds said threshold and said preceding interval contains said delay impairment, categorizing said event group as said access link congestion.

20. A method as defined in claim 18, wherein categorizing at least one of said one or more event groups includes:

a. when said change in delay does not exceed said threshold, said preceding interval contains a delay impairment, and said level of short term delay variation is low, categorizing said event group as said route change.

21. A method as defined in claim 18, wherein categorizing at least one of said one or more event groups includes:

a. when said change in delay does not exceed said threshold, said preceding interval does not contain a delay impairment, and said level of short term delay variation has increased, categorizing said event group as said local area network congestion.

22. A method as defined in claim 7, wherein determining the level of one or more impairments includes:

a. determining the delay of a first packet;

b. determining the delay of a subsequent packet; and

c. subtracting the delay of said subsequent packet from the delay of said first packet.

23. A method as defined in claim 22, wherein determining the level of one or more impairments further includes computing an average of said subtracted value over a short period of time.

24. A method as defined in claim 22, wherein said one or more problem signatures includes:

a. a high value of short term delay variation without an increase in delay;

b. an increase in delay accompanied by an increase in short term delay variation followed by a decrease in delay;

or

c. an increase or decrease in delay accompanied by a substantially constant level of short term delay variation.

25. A method as defined in claim 22, wherein comparing said one or more event groups with one or more problem signatures includes:

a. comparing a change in delay during an interval with a threshold;

b. determining the level of said short term delay variation during said interval; and

c. determining whether a preceding interval contains a delay impairment.

26. A method as defined in claim 25, wherein categorizing at least one of said one or more event groups includes:

a. when said change in delay exceeds said threshold and said preceding interval contains said delay impairment, categorizing said event group as said access link congestion.

27. A method as defined in claim 25, wherein categorizing at least one of said one or more event groups includes:

a. when said change in delay does not exceed said threshold, said preceding interval contains a delay impairment, and said level of short term delay variation is low, categorizing said event group as said route change.

28. A method as defined in claim 25, wherein categorizing at least one of said one or more event groups includes:

a. when said change in delay does not exceed said threshold, said preceding interval does not contain a delay impairment, and said level of short term delay variation has increased, categorizing said event group as said local area network congestion.

29. A method as defined in claim 7, wherein determining the level of one or more impairments includes:

a. identifying a first packet having a minimum delay,

b. subtracting the delay of a second packet from the delay of said packet,

c. dividing said subtracted value by the time interval between said first and second packets to estimate the rate of change of clock speed; and

d. incorporating said estimated rate of change of clock speed into an average rate of change if said estimated rate of change of clock speed exceeds a threshold.

30. A method as defined in claim 7, wherein determining the level of one or more impairments includes calculating the number of packets lost as a percentage of the sum of packets lost plus packets received.

31. A method as defined in claim 7, wherein determining the level of one or more impairments includes determining the number of packets received out of sequence as a percentage of total number of packets received.

32. A method as defined in claim 7, wherein said one or more problem signatures includes:

a. a high value of short term delay variation without an increase in delay;

b. an increase in delay accompanied by an increase in short term delay variation followed by a decrease in delay;

or

c. an increase or decrease in delay accompanied by a substantially constant level of short term delay variation.

33. A method as defined in claim 32, further comprising the steps of:

a. determining the source of more than one call;

b. grouping said more than one calls into one or more call groups based on the source of said more than one calls;

c. for each call group determining the number of calls having said network problem; and

d. estimating the location of said network problem based on the number of calls having said network problem.

34. A method as defined in claim 33, wherein determining the source of more than one call includes determining the source internet protocol address of said more than one call.

35. A method as defined in claim 33, wherein estimating the location of said network problem includes:

a. determining the percentage of calls within said call group having said network problem; and

b. estimating that the location of said network problem is equal to the source associated with said call group if the percentage of calls is high.

36. A method as defined in claim 7, wherein comparing said one or more event groups with one or more problem signatures includes:

a. comparing a change in delay during an interval with a threshold;

b. determining the level of said short term delay variation during said interval; and

c. determining whether a preceding interval contains a delay impairment.

37. A method as defined in claim 36, wherein categorizing at least one of said one or more event groups includes:

a. when said change in delay exceeds said threshold and said preceding interval contains said delay impairment, categorizing said event group as said access link congestion.

38. A method as defined in claim 36, wherein categorizing at least one of said one or more event groups includes:

a. when said change in delay does not exceed said threshold, said preceding interval contains a delay impairment, and said level of short term delay variation is low, categorizing said event group as said route change.

39. A method as defined in claim 36, wherein categorizing at least one of said one or more event groups includes:

a. when said change in delay does not exceed said threshold, said preceding interval does not contain a delay impairment, and said level of short term delay variation has increased, categorizing said event group as said local area network congestion.