Methods and computer programs for generating data traffic matrices

• US 20050286434A1
• Filed: 06/25/2004
• Published: 12/29/2005
• Est. Priority Date: 06/25/2004
• Status: Active Grant

• Current Assignee: InMon Corp.
• Original Assignee: InMon Corp.
• Inventors: McKee, Neil, Phaal, Peter
• Granted Patent: US 8,005,009 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 43/022 by sampling

Abstract

A method of monitoring traffic flow within a network of nodes, and a recordable medium containing a computer program with instructions that, when executed, performs such method, is provided. The method comprises assigning sampling points to a node or unique pair of nodes. In one method, the sampling points contained within the assigned subset are determined to be the most likely to monitor data traffic, and preferably all data traffic, associated with the node or node pair. The sampling point subset may automatically be determined and assigned to the node or node pair, and such assignment can be based on historical traffic within the network. The method further comprises collecting diagnostic network traffic data from the sampling points, and obtaining sampled traffic flow counts for a flow associated with a node pair from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes of the node pair. The method further comprises performing a function, such as a combinatory function, on the sampled traffic flow counts to obtain an estimated traffic flow count for the respective flow. If multiple node pairs are monitored, a data traffic matrix containing a plurality of traffic flow counts can be generated.

Claims

1. A method of monitoring traffic within a network of nodes, comprising:

assigning a subset of network traffic sampling points to a unique pair of nodes;

collecting diagnostic network traffic data from the sampling points;

obtaining sampled traffic flow counts for a flow associated with the node pair from the diagnostic traffic data collected from the sampling point subset; and

performing a function on the respective sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

2. The method of claim 1, wherein the flow is a specific traffic flow associated with the node pair.

3. The method of claim 1, wherein the flow is a total traffic flow associated with the node pair.

4. The method of claim 1, further comprising:

assigning a subset of network traffic sampling points to each unique pair of nodes in the network; and

for a flow associated with each node pair in the network, obtaining sampled traffic flow counts from the diagnostic traffic data collected from the sampling point subset assigned to the respective node pair; and

for each flow, performing a function on the respective sampled traffic flow counts to obtain an estimated traffic flow count; and

generating a data traffic matrix containing the estimated traffic flow counts.

5. The method of claim 1, wherein the sampling point subset is assigned to the node pair based on historical traffic data.

6. The method of claim 1, further comprising determining sampling points most likely to monitor all data traffic associated with the node pair, wherein the determined sampling points are included within the sampling point subset.

7. The method of claim 1, wherein the function is a combinatory function.

8. The method of claim 7, wherein each sampling point has a sampling probability, and the combinatory function comprises dividing the sum of the sampled traffic flow counts by the sum of the sampling probabilities.

9. The method of claim 1, wherein the estimated traffic flow count is one of an estimated data packet count, an estimated byte count, and an estimated connection count.

10. The method of claim 1, further comprising deriving a node-specific estimated traffic count for a node of the node pair at least partially from the estimated traffic flow count.

11. A medium carrying a computer program having instructions that, when executed, perform a method of monitoring traffic within a network of nodes, comprising:

assigning a subset of network traffic sampling points to a unique pair of nodes;

collecting diagnostic network traffic data from the sampling points;

obtaining sampled traffic flow counts for a flow associated with the node pair from the diagnostic traffic data collected from the sampling point subset; and

performing a function on the respective sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

12. The medium of claim 11, wherein the flow is a specific traffic flow associated with the node pair.

13. The medium of claim 11, wherein the flow is a total traffic flow associated with the node pair.

14. The medium of claim 11, wherein the method comprises:

assigning a subset of network traffic sampling points to each unique pair of nodes in the network; and

for a flow associated with each node pair in the network, obtaining sampled traffic flow counts from the diagnostic traffic data collected from the sampling point subset assigned to the respective node pair; and

for each flow, performing a function on the respective sampled traffic flow counts to obtain an estimated traffic flow count; and

generating a data traffic matrix containing the estimated traffic flow counts.

15. The medium of claim 11, wherein the sampling point subset is assigned to the node pair based on historical traffic data.

16. The medium of claim 11, further comprising determining sampling points most likely to monitor all data traffic associated with the node pair, wherein the determined sampling points are included within the sampling point subset.

17. The medium of claim 11, wherein the function is a combinatory function.

18. The medium of claim 17, wherein each sampling point has a sampling probability, and the combinatory function comprises dividing the sum of the sampled traffic flow counts by the sum of the sampling probabilities.

19. The medium of claim 11, wherein the estimated traffic flow count is one of an estimated data packet count, an estimated byte count, and an estimated connection count.

20. The medium of claim 11, wherein the method further comprises deriving a node-specific estimated traffic count for a node of the node pair at least partially from the estimated traffic flow count.

21. A method of monitoring traffic within a network of nodes, comprising:

assigning network traffic sampling points to a source node and a destination node;

collecting diagnostic network traffic data from the sampling points;

obtaining sampled traffic flow counts for a flow associated with the source and destination nodes from the diagnostic traffic data collected from the sampling points; and

performing a combinatory function on the sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

22. The method of claim 21, wherein the flow is a specific traffic flow associated with the source node and destination node.

23. The method of claim 21, wherein the flow is a total traffic flow associated with the source node and destination node.

24. The method of claim 21, further comprising:

assigning network traffic sampling points to the nodes;

for a flow associated with each unique pair of nodes, obtaining sampled traffic flow counts from the diagnostic traffic data collected from the sampling points assigned to source and destination nodes of the respective node pair;

for each flow, performing a function on the respective sampled traffic flow counts to obtain an estimated traffic flow count; and

generating a data traffic matrix containing the estimated traffic flow counts.

25. The method of claim 21, wherein the sampling points are assigned to the source and destination nodes as individual nodes.

26. The method of claim 21, wherein the sampling points are assigned to the source and destination nodes as a unique node pair.

27. The method of claim 21, wherein the sampling points are assigned to the source and destination nodes based on historical traffic data.

28. The method of claim 21, further comprising determining sampling points most likely to monitor all data traffic associated with the source and destination nodes, wherein the determined sampling points are the assigned sampling points.

29. The method of claim 21, wherein each sampling point has a sampling probability, and the combinatory function comprises dividing the sum of the sampled traffic flow counts by the sum of the sampling probabilities.

30. The method of claim 21, wherein the estimated traffic flow count is one of an estimated data packet count, an estimated byte count, and an estimated connection count.

31. A medium carrying a computer program having instructions that, when executed, perform a method of monitoring traffic within a network of nodes, comprising:

assigning network traffic sampling points to a source node and a destination node;

collecting diagnostic network traffic data from the sampling points;

obtaining sampled traffic flow counts for a flow associated with the source and destination nodes from the diagnostic traffic data collected from the sampling points; and

performing a combinatory function on the sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

32. The medium of claim 31, wherein the flow is a specific traffic flow associated with the source node and destination node.

33. The medium of claim 31, wherein the flow is a total traffic flow associated with the source node and destination node.

34. The medium of claim 31, wherein the method further comprises:

assigning network traffic sampling points to the nodes;

for a flow associated with each unique pair of nodes, obtaining sampled traffic flow counts from the diagnostic traffic data collected from the sampling points assigned to source and destination nodes of the respective node pair;

for each flow, performing a function on the respective sampled traffic flow counts to obtain an estimated traffic flow count; and

generating a data traffic matrix containing the estimated traffic flow counts.

35. The medium of claim 31, wherein the sampling points are assigned to the source and destination nodes as individual nodes.

36. The medium of claim 31, wherein the sampling points are assigned to the source and destination nodes as a unique node pair.

37. The medium of claim 31, wherein the sampling points are assigned to the source and destination nodes based on historical traffic data.

38. The medium of claim 31, wherein the method further comprises determining sampling points most likely to monitor all data traffic associated with the source and destination nodes, wherein the determined sampling points are the assigned sampling points.

39. The medium of claim 31, wherein each sampling point has a sampling probability, and the combinatory function comprises dividing the sum of the sampled traffic flow counts by the sum of the sampling probabilities.

40. The medium of claim 31, wherein the estimated traffic flow count is one of an estimated data packet count, an estimated byte count, and an estimated connection count.

41. A method of monitoring traffic within a network of nodes, comprising:

obtaining historical network traffic data over a plurality of network traffic sampling points; and

assigning sampling points to the nodes based on the historical traffic data.

42. The method of claim 41, further comprising

obtaining sampled traffic flow counts for a flow associated with the source and destination nodes of a unique pair of nodes from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes;

and

performing a function on the sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

43. The method of claim 41, wherein the sampling points are assigned to the nodes as individual nodes.

44. The method of claim 41, wherein the sampling points are assigned to the nodes as unique node pairs.

45. The method of claim 41, further comprising determining sampling points most likely to monitor all data traffic associated with a node or unique node pair, wherein the determined sampling points are assigned to the node or node pair.

46. A medium carrying a computer program having instructions that, when executed, perform a method of monitoring traffic within a network of nodes, comprising:

obtaining historical network traffic data over a plurality of network traffic sampling points; and

assigning sampling points to the nodes based on the historical traffic data.

47. The medium of claim 46, wherein the method comprises:

obtaining sampled traffic flow counts for a flow associated with source and destination nodes of a unique pair of nodes from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes; and

performing a function on the sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

48. The medium of claim 46, wherein the sampling points are assigned to the nodes as individual nodes.

49. The medium of claim 46, wherein the sampling points are assigned to the nodes as unique node pairs.

50. The medium of claim 46, wherein the method further comprises determining sampling points most likely to monitor all data traffic associated with a node or unique node pair, wherein the determined sampling points are assigned to the node or node pair.

51. A method of monitoring traffic within a network of nodes, comprising:

automatically determining network traffic sampling points most likely to monitor traffic associated with a source node and a destination node; and

automatically assigning the sampling points to the source and destination nodes.

52. The method of claim 51, further comprising:

obtaining sampled traffic flow counts for a flow associated with the source and destination nodes from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes; and

performing a function on the sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

53. The method of claim 51, wherein a source subset of sampling points is determined to be most likely to monitor traffic associated with the source node, and a destination subset of sampling points is determined to be most likely to monitor traffic associated with the destination node, and the source and destination sampling point subsets are respectively assigned to the source and destination nodes.

54. The method of claim 51, wherein the sampling points are determined to be most likely to monitor traffic associated with the source and destination nodes as a unique node pair, and the sampling points are assigned to the unique node pair.

55. The method of claim 51, wherein the determined sampling points are most likely to monitor all traffic associated with the source and destination nodes.

56. A medium carrying a computer program having instructions that, when executed, perform a method of monitoring traffic within a network of nodes, comprising:

determining network traffic sampling points most likely to monitor traffic associated with a source node and a destination node; and

assigning the sampling points to the source and destination nodes.

57. The medium of claim 56, wherein the method further comprises:

obtaining sampled traffic flow counts for a flow associated with the source and destination nodes from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes; and

performing a function on the sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

58. The medium of claim 56, wherein a source subset of sampling points is determined to be most likely to monitor traffic associated with the source node, and a destination subset of sampling points is determined to be most likely to monitor traffic associated with the destination node, and the source and destination sampling point subsets are respectively assigned to the source and destination nodes.

59. The medium of claim 56, wherein the sampling points are determined to be most likely to monitor traffic associated with the source and destination nodes as a unique node pair, and the sampling points are assigned to the unique node pair.

60. The medium of claim 56, wherein the determined sampling points are most likely to monitor all traffic associated with the source and destination nodes.