Automated capturing and characterization of network traffic using feedback

• US 20050021715A1
• Filed: 04/22/2004
• Published: 01/27/2005
• Est. Priority Date: 05/21/2003
• Status: Active Grant

• Current Assignee: Keysight Technologies Singapore Sales Pte Ltd (Keysight Technologies, Inc.)
• Original Assignee: Ixia (Keysight Technologies, Inc.)
• Inventors: Dugatkin, Diego, Hannel, Clifford
• Granted Patent: US 7,627,669 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/50 Testing arrangements

Abstract

Automated capturing and characterization of network traffic using feedback is described. A method may include capturing network traffic, compiling network traffic data based on the network traffic, analyzing the network traffic data, and automatically providing instructions based on the analyzing to control the capturing and the compiling. A system on which the method may execute may include one or more chassis or computing devices having one or more network cards. The chassis and/or the computing devices may be connected to one or more networks, and may be connected to one another. A system that implements the method may include collectors, characterization units, and a feedback controller.

Claims

1. A system to capture and analyze network traffic, the system comprising:

a plurality of collectors to capture network traffic and to compile network traffic data

a plurality of characterization units to analyze the network traffic to create a network traffic characterization

a feedback controller coupled with the collectors and the characterization units to control the network traffic captured by the collectors based on the network traffic data and the network traffic characterization.

2. The system of claim 1 wherein the feedback controller is configured to successively refine the functioning of the collectors and the characterization units by sending instructions to the collectors and the characterization units.

3. The system of claim 2 wherein the instructions are based on the network traffic data and the network traffic characterization.

4. The system of claim 1 wherein the collectors are configured to filter the network traffic.

5. The system of claim 4 wherein the collectors include filters that are at least one of user defined and system defined.

6. The system of claim 1 wherein the network traffic data includes at least one of protocol distribution data, length distribution data, transaction distribution data, header information, and payload data.

7. The system of claim 1 wherein the collectors each include at least one data collection unit for each of a plurality of communications protocols supported by the system.

8. The system of claim 1 wherein the system supports a plurality of communications protocols.

9. The system of claim 8 wherein the plurality of communication protocols includes at least a User Datagram Protocol (UDP), a Transmission Control Protocol (TCP), and a Hypertext Transfer Protocol (HTTP).

10. The system of claim 1 further comprising a traffic generator to generate network traffic based on network traffic characterizations received from the characterization units.

11. The system of claim 1 further comprising a manager to provide a user interface to allow a user to at least one of

view the network traffic data

provide instructions to the collectors

provide commands to the characterization units.

12. The system of claim 1 coupled with a network testing system.

13. The system of claim 1 coupled to a production network.

14. The system of claim 1 coupled to a test network.

15. A method of capturing and analyzing network traffic comprising:

capturing network traffic

compiling network traffic data based on the capturing

analyzing the network traffic data

automatically providing instructions to control the capturing and the compiling, the instructions based on the analyzing.

16. The method of claim 15 wherein the providing comprises successively refining the capturing and the compiling based on the analyzing.

17. The method of claim 15 wherein the capturing is based on filters.

18. The method of claim 17 wherein the filters are at least one of user defined and system defined.

19. The method of claim 17 wherein the providing comprises

preparing amended filters based on the instructions such that the capturing and the compiling are based on the amended filters.

20. The method of claim 15 further comprising:

providing instructions to control the analyzing, the instructions based on the analyzing.

21. The method of claim 15 wherein the network traffic data includes at least one of protocol distribution data, length distribution data, transaction distribution data, header information, and payload data.

22. The method of claim 15 wherein the network traffic is comprised of a plurality of data units adhering to a plurality of communications protocols.

23. The method of claim 22 wherein the plurality of communication protocols includes at least a User Datagram Protocol (UDP), a Transmission Control Protocol (TCP), and a Hypertext Transfer Protocol (HTTP).

24. A method to capture and analyze network traffic comprising:

capturing network traffic based on a first set of filters

compiling network traffic data based on the network traffic

computing basic statistics based on the network traffic data

sorting the network traffic data to determine network traffic distribution data

automatically preparing amended filters based on the network traffic data, the basic statistics and the network traffic distribution data

capturing network traffic based on the amended filters.

25. The method of claim 24 further comprising:

performing analysis of the network traffic data to produce a network traffic characterization

preparing refined analysis instructions based on the network traffic characterization

performing analysis of the network traffic data based on the refined analysis instructions.

26. The method of claim 25 further comprising:

preparing refined filters based on at least the network traffic characterization

performing analysis of the network traffic data based on the refined filters.

27. The method of claim 24 wherein the network traffic data includes at least one of protocol distribution data, length distribution data, transaction distribution data, header information, and payload data.

28. The method of claim 24 further comprising

providing a user interface to a user

receiving user defined filters

capturing network traffic based on the user defined filters.

29. The method of claim 28 further comprising

receiving a network traffic analysis specification from the user

30. The method of claim 24 wherein the network traffic includes a plurality of data units adhering to a plurality of communications protocols.

31. The method of claim 30 wherein the plurality of communications protocols includes at least a User Datagram Protocol (UDP), a Transmission Control Protocol (TCP), and a Hypertext Transfer Protocol (HTTP).

32. A machine readable medium having instructions stored thereon which when executed cause a processor to perform operations comprising:

capturing network traffic

compiling network traffic data based on the capturing

analyzing the network traffic data

automatically providing instructions to control the capturing and the compiling, the instructions based on the analyzing.

33. The machine readable medium of claim 32 wherein the providing comprises successively refining the capturing and the compiling based on the analyzing.

34. The machine readable medium of claim 32 wherein the capturing is based on filters.

35. The machine readable medium of claim 34 wherein the filters are at least one of user defined and system defined.

36. The machine readable medium of claim 34 wherein the providing comprises

preparing amended filters based on the instructions such that the capturing and the compiling are based on the amended filters.

37. The machine readable medium of claim 32 further comprising:

providing instructions to control the analyzing, the instructions based on the analyzing.

38. The machine readable medium of claim 32 wherein the network traffic data includes at least one of protocol distribution data, length distribution data, transaction distribution data, header information, and payload data.

39. The machine readable medium of claim 32 wherein the network traffic is comprised of a plurality of data units adhering to a plurality of communications protocols.

40. The method of claim 39 wherein the plurality of communication protocols includes at least a User Datagram Protocol (UDP), a Transmission Control Protocol (TCP), and a Hypertext Transfer Protocol (HTTP).

41. The machine readable medium of claim 32 coupled with a network testing system.

42. The machine readable medium of claim 41 wherein the network testing system is coupled to a production network.

43. The machine readable medium of claim 42 wherein the network testing system is coupled to a test network.