System and method for aligning data frames in time

• US 20050050098A1
• Filed: 09/03/2003
• Published: 03/03/2005
• Est. Priority Date: 09/03/2003
• Status: Abandoned Application

• Current Assignee: Paul Barnett
• Original Assignee: Paul Barnett
• Inventors: Barnett, Paul
• Application Number:
  US10/654,817
• Publication Number:
  US 20050050098A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps

Abstract

A method and apparatus for merging data acquired by two or more capture devices from two or more points in a computer system, duplicate frames are analyzed to determine the time difference between the timestamp of a first capture device and the timestamp of a second capture device. The invention compares the frames for duplicates. If the duplicate frames are the first set of duplicate frames discovered, then all previous timestamps and all subsequent timestamps from the second capture device are adjusted by the calculated time difference. If duplicate frames are again discovered, the time difference is recalculated and all subsequent frames from the second capture device are adjusted by the calculated time difference. After all the frames have been analyzed and the timestamps adjusted, the frames are merged together and put into chronological order to simulate a single capture of data encompassing all of the points where the data was collected.

Claims

1. A system for merging files comprising:

a first file containing at least one first frame with a first timestamp and a first parameter;

a second file containing at least one second frame with a second timestamp and a second parameter;

a processor programmed to complete the following steps;

read the first frame parameter of the first frame;

read the second frame parameter of the second frame;

compare the first frame parameter with the second frame parameter for duplication;

upon duplication, calculate a difference between the first timestamp and the second timestamp;

in the absence of duplication, modify at least one second frame of the second file by the difference and merge the modified second frame into the first file.

2. The system of claim 1 wherein the processor is programmed to delete the second frame after the step of modifying.

3. The system of claim 1 wherein the first file contains a plurality of first frames, each with an associated timestamp and wherein the processor is programmed to complete the following steps:

read each of the first frames; and

chronologically arrange the first frames according to the timestamps.

4. The system of claim 3 wherein the first file contains at least one duplicate set of frames comprising the additional steps of:

Locating the duplicate set of frames; and

deleting one of the duplicate frames.

5. The system of claim 4 wherein the step of deleting further comprises deleting the duplicate with the latest time stamp.

6. The system of claim 1 wherein the second file contains a plurality of second frames, each with an associated timestamp and wherein the processor is programmed to complete the following steps:

read each of the second frames;

chronologically arrange the second frames according to the timestamps.

7. The system of claim 6 wherein the second file contains at least one duplicate set of frames comprising the additional steps of:

locating the duplicate set of frames; and

deleting one of the duplicate frames.

8. The system of claim 7 wherein the step of deleting further comprises deleting the duplicate with the latest time stamp.

9. A method for merging frames collected by two capture devices connected to a computer system comprising the steps of:

a. collecting frames with the first capture device;

b. timestamping each frame collected by the first capture device;

c. storing each frame collected by the first capture device in a first capture file;

d. collecting frames with the second capture device;

e. timestamping each frame collected by the second capture device;

f. storing each frame collected by the second capture device in a second capture file;

g. reading a target frame from the second capture file;

h. comparing the target frame from the second capture file to the frames stored in the first capture file to determine if the frames are duplicate frames;

i. conditioned upon the target frame being a duplicate frame, determining the difference between the timestamps of the duplicate frames, setting a variable equal to the difference;

j. conditioned upon the target frame not being a duplicate, adjusting the timestamp of the target frame by the variable and appending the frame from the second capture file to the first capture file;

k. repeating steps g through k until all the frames from the second capture file have been read; and

l. arranging the frames located in the first capture file in chronological order.

10. The method of claim 9 further comprising the steps of:

determining a first frame identifier set for at least one frame in the first capture file;

determining a second frame identifier set for at least one frame in the second capture file;

comparing the first frame identifier set and the second frame identifier set to determine equality;

upon equality concluding that the frames are duplicates; and

upon non-equality concluding the frames are not duplicates.

11. The method of claim 10 wherein the first frame identifier set is stored in the first capture file and the second frame identifier set is stored in the second capture file.

12. The method of claim 9 wherein the first capture file is located on the first capture device and the second capture file is located on the second capture device.

13. The method of claim 9 wherein the first capture file and second capture file are located on an analysis device.

14. The method of claim 9 wherein step “

c”

further comprises the steps of;

arranging the frames in the first capture device in chronological order according to the timestamp;

comparing the frames in the first capture device to determine if frames are duplicates; and

upon determining frames are duplicates, discarding a duplicate frame.

15. The method of claim 9 comprising the additional step of sending a ping to force the duplicate frames

16. A method for merging data frames collected by a first capture device and a second capture device, both connected to a computer system, comprising the steps of:

a. collecting data frames transmitted across the system by the first and second capture devices;

b. timestamping each frame collected by the first capture device;

c. timestamping each frame collected by the second capture device;

d. storing each frame collected by the first capture device in a first capture file;

e. arranging the frames in the first capture file in chronological order;

f. storing each frame collected by the second capture device in a second capture file;

g. arranging the second frames in the second capture file in chronological order;

h. reading a target frame from the second capture file;

i. comparing the target frame from the second capture file to the frames stored in the first capture file to determine if the frames are a set of duplicate frames;

j. conditioned upon the target frame from the second capture file being a duplicate of a frame from the first capture file,

i. determining the difference between the timestamps of the set of duplicate frames;

ii. setting a variable equal to the difference between the timestamps;

iii. determining if the set of duplicate frames are a first set of duplicate frames; and

iv. conditioned upon the set of duplicate frames being the first set of duplicate frames, adjusting the timestamp of frames in a temporary database and appending the frames in the temporary database to the first capture file;

k. conditioned upon the target frame from the second capture file not being a duplicate of a frame from the first capture file,

i. determining if the first set of duplicate frames has been discovered;

ii. conditioned upon the first set of duplicate frames not being discovered;

appending the target frame from the second capture file to the temporary database; and

iii. conditioned upon the first set of duplicate frames being discovered, adjusting the timestamp of the target frame from the second capture file by the variable and appending the target frame from the second capture file to the first capture file; and

l. repeating steps j through m until all the frames from the second capture file have been read; and

m. arranging the frames located in the first capture file in chronological order.

17. A method for merging data frames collected by a first, second and third capture device and connected to a computer system comprising the steps of:

a. collecting data frames by the first, second, and third capture devices;

b. timestamping each frame collected by the first capture device;

c. storing each frame collected by the first capture device in a first capture file;

d. timestamping each frame collected by the second capture device;

e. storing each frame collected by the second capture device in a second capture file;

f timestamping each frame collected by the third capture device;

g. storing each frame collected by the third capture device in a third capture file;

h. reading a frame from the second capture file;

i. comparing the frame from the second capture file to the frames stored in the first capture file to determine if the frames are a set of duplicate frames;

j. conditioned upon the frame being a duplicate, determining the difference between the timestamps of the duplicate frames and setting a variable equal to the difference;

k. conditioned upon the frame from the second capture file not being a duplicate adjusting the timestamp of the frame from the second capture file by the variable and appending the frame from the second capture file to the first capture file;

l. reading a target frame from the third capture file;

m. repeating steps “

h”

through “

k”

until all the frames from the second capture file have been read;

n. comparing the frame from the third capture file to the frames in the first capture file to determine if the frames are duplicates;

o. conditioned upon the frame being a duplicate, determining the difference between the timestamps of the duplicate frames and setting a second variable equal to the difference;

p. conditioned upon the frame from the third capture file not being a duplicate, adjusting the timestamp of the frame from the third capture file by the second variable and appending the frame from the third capture file to the first capture file;

q. repeating steps “

m”

through “

p”

until all the frames from the third capture file have been read; and

r. arranging the frames located in the first capture file in chronological order.

18. An apparatus for analyzing the performance of a system, wherein two or more capture devices are in communication with the system and wherein the two or more capture devices collect data which consists of frames from the system, and wherein the collected frames are timestamped as the frames are collected by each capture device, the apparatus comprising:

a computer for uploading the data collected by the capture devices, programmed to execute the following steps;

a. store each frame collected by a first capture device in a first capture file;

b. store each frame collected by a second capture device in a second capture file;

c. read a target frame from the second capture file;

d. compare the target frame from the second capture file to the frames stored in the first capture file to determine if the frames are a set of duplicates;

e. conditioned upon the target frame being a duplicate frame, determine the difference between the timestamps of the duplicate frames, set a variable equal to the difference;

f. conditioned upon the target frame not being a duplicate, adjust the timestamp of the target frame by the variable and append the frame from the second capture file to the first capture file;

g. repeat steps “

c”

through “

f”

until all the frames from the second capture file have been read; and

h. arrange the frames located in the first capture file in chronological order.

19. The program of claim 18, wherein in step “

d”

comprises the additional steps of;

determine a first frame identifier set for each frame in the first capture file;

determine a second frame identifier set for the frame from the second capture file;

compare the first frame identifier set and the second frame identifier set to determine equality;

upon equality concluding the frames are duplicates; and

upon non-equality concluding the frames are not duplicates.

20. The program of claim 19, wherein the first frame identifier set is stored in the first capture file and the second frame identifier set is stored in the second capture file.

21. The program of claim 18, wherein at step “

a”

the program further executes a step to remove any duplicate frames in the first capture file and a step to remove any duplicate frames in the second capture file.

22. The program of claim 18, wherein a third capture device is attached to a system, the third capture device collects data transmitted across the system wherein the collected data consists of frames, and wherein the third capture device timestamps each frame collected by the third capture device and stores each frame collected in a third capture file, the program, after the step of g executes the following steps,

a. reads a frame from the third capture file;

b. compares the frame from the third capture file to the frames in the first capture file to determine if the frames are duplicates;

c. conditioned upon the frame from the third capture file being a duplicate of a frame from the first capture file, determine the difference between the timestamps of the duplicate frames and setting a second variable equal to the difference;

d. conditioned upon the frame from the third capture file not being a duplicate of a frame from the first capture file, adjust the timestamp of the frame from the third capture file by the second variable and adding the frame from the third capture file to the first capture file;

e. repeating step “

i”

through “

1”

until all the frames from the second capture file have been read; and

f. arranging the frames located in the first capture file in chronological order.

23. An apparatus for analyzing the performance of a system, wherein two or more capture devices are in communication with the system, wherein the two or more capture devices collect data which consists of frames from the system and the collected frames are timestamped as the frames are collected by each capture device, the apparatus comprising a computer for uploading the data collected by the capture devices wherein the computer is programmed to execute the following steps:

a. store each frame collected by a first capture device in a first capture file;

b. arrange the first frames in the first capture file in chronological order;

c. store each frame collected by a second capture device in a second capture file;

d. arrange the second frames in the second capture file in chronological order;

e. read a target frame from the second capture file;

f. compare the target frame from the second capture file to the frames stored in the first capture file to determine if the frames are a set of duplicates;

g. conditioned upon the target frame from the second capture file being a duplicate of a frame from the first capture files,

i. determine the difference between the timestamps of the duplicates;

ii. set a variable equal to the difference; and

iii. determine if the set of duplicate frames are the first set of duplicate frames, and;

iv. conditioned upon the set of duplicate set of frames being the first set of duplicate frames, adjusting the timestamp of frames in a temporary database and appending the frames in the temporary database to the first capture file;

h. conditioned upon the target frame from the second capture file not being a duplicate of a frame from the first capture file,

i. determine if the first set of duplicate frames has been discovered;

ii. conditioned upon the first set of duplicate frames not being discovered, append the target frame from the second capture file to a temporary database;

iii. conditioned upon the first set of duplicate frames being discovered, adjust the timestamp of the target frame from the second capture file by the variable and append the target frame from the second capture file to the first capture file;

i. repeat steps “

e”

through “

h”

until all the frames from the second capture file have been read; and

j. arrange the frames located in the first capture file in chronological order.

24. An apparatus for analyzing the performance of a system, wherein two or more capture devices in communication with the system, wherein the two or more capture devices collect data which consists of frames from the system and the collected frames are timestamped as the frames are collected by each capture device, the apparatus comprising:

a computer for uploading the data collected by the capture devices programmed to execute the following steps;

a. store each frame collected by a first capture device in a first capture file;

b. store each frame collected by a second capture device in a second capture file;

c. store each frame collected by a third capture device in a third capture file;

d. read a frame from the second capture file;

e. compare the frame from the second capture file to the frames stored in the first capture file to determine if the frames are a set of duplicates;

f conditioned upon the frame from the second capture file being a duplicate of a frame from the first capture file, determine the difference between the timestamps of the set of duplicates and set a variable equal to the difference;

g. conditioned upon the frame from the second capture file not being a duplicate of a frame from the first capture file, adjust the timestamp of the frame from the second capture file by the variable and add the frame from the second capture file to the first capture file;

h. repeat steps “

d”

through “

g”

until all the frames from the second capture file have been read;

i. read a frame from the third capture file;

j. compare the frame from the third capture file to the frames in the first capture file to determine if the frames are duplicates;

k. conditioned upon the frame from the third capture file being a duplicate of a frame from the first capture file, determine the difference between the timestamps of the duplicate frames and setting a second variable equal to the difference;

l. conditioned upon the frame from the third capture file not being a duplicate of a frame from the first capture file, adjust the timestamp of the frame from the third capture file by the second variable and add the frame from the third capture file to the first capture file;

m. repeating step “

i”

through “

1”

until all the frames from the third capture file have been read; and

n. arranging the frames located in the first capture file in chronological order.