Method for discovery and troubleshooting of network application usage and performance issues

• US 20060075094A1
• Filed: 12/01/2004
• Published: 04/06/2006
• Est. Priority Date: 09/10/2004
• Status: Active Grant

• Current Assignee: Riverbed Technology, LLC (Riverbed Technology Incorporated)
• Original Assignee: Riverbed Technology Incorporated
• Inventors: Wen, Han, Ahmed, Masood, Zioulas, George, Guarini, Stephen, Seilnacht, Erik
• Granted Patent: US 8,745,198 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

During monitoring of IP network traffic, network application monitoring metrics are extracted, aggregated into logical group types and subsequently analyzed by identifying group sets of the logical group types, correlating anomalous conditions across the logically grouped and aggregated metrics, and isolating the anomalous conditions to one or more related members of the logical group types. The metrics may include usage metrics, network performance metrics and application performance metrics.

Claims

1. A method comprising extracting, during monitoring of network traffic made up of Internet protocol (IP) packets, network application monitoring metrics;

aggregating the metrics into logical group types; and

analyzing logically grouped and aggregated metrics by identifying group sets of the logical group types, correlating anomalous conditions across the logically grouped and aggregated metrics, and isolating the anomalous conditions to one or more related members of the logical group types.

2. The method of claim 1, wherein metrics comprise one or more of usage metrics, network performance metrics and application performance metrics.

3. The method of claim 2, wherein the usage metrics comprise one or more of:

Goodput, Payload, Throughput and Transaction Throughput.

4. The method of claim 2, wherein the network performance metrics comprise one or more of:

Packet Loss, Retransmission Delay, Retransmission Rate and Round Trip Time.

5. The method of claim 2, wherein the application performance metrics comprise one or more of:

Application Response Rate, Application Response Time, Client Reset Rate, Connection Duration, Connection Established Rate, Connection Request Rate, Connection Setup Time, Connections Failed Rate, Data Transfer Time, Server Reset Rate and Time to First Byte.

6. The method of claim 1, wherein analyzing logically grouped and aggregated metrics includes displaying a graphical representation of metric information in response to user selection of a quick launch element of a graphical user interface.

7. The method of claim 1, wherein isolating the anomalous conditions to one or more related members of the logical group types comprises decomposing metric information by respective related member, presenting metric information of related members for operator review, and revealing those related members contributing to identified anomalous conditions.

8. The method of claim 1, wherein decomposing metric information by related members comprises establishing a hierarchical relationship between respective ones of the logical group types and its related members.

9. The method of claim 8, wherein establishing a hierarchical relationship between respective ones of the logical group types and its related members comprises establishing a relationship between a business group and users that are members or constituents of the business group.

10. The method of claim 1, wherein analyzing logically grouped and aggregated metrics comprises presenting, for a selected set of groups, metric data within one or more presentation formats (tables, charts) in response to a quick launch cursor control operation (e.g., a toolbar button selection, a double-click, or right-click).

11. The method of claim 10, wherein the one or more presentation formats comprise tables and charts.

12. The method of claim 10, wherein the quick launch cursor control operation comprises one of a toolbar button selection, a double-click, or right-click.

13. The method of claim 1, wherein analyzing logically grouped and aggregated metrics comprises providing a view of any of the network application monitoring metrics within a selected presentation format in response to a user input.

14. The method of claim 1, wherein analyzing logically grouped and aggregated metrics comprises switching views between selected ones of the network application monitoring metrics within a selected presentation format in response to a user input.

15. The method of claim 1, wherein analyzing logically grouped and aggregated metrics comprises presenting views of any selected ones of the network application monitoring metrics within a presentation format appropriate to information required by an operator.

16. The method of claim 15, wherein the presentation format provides summary information for the selected ones of the metrics and groups.

17. The method of claim 16 wherein the summary information comprises one or more of:

an average, a minimum, a maximum, an N^th percentile or a standard deviation.

18. The method of claim 15, wherein the presentation format comprises one of:

a time series chart, a scatter plot, a distribution, a cumulative chart or a pie chart.

19. The method of claim 1, wherein analyzing logically grouped and aggregated metrics comprises presenting selected ones of the network application monitoring metrics in time periods where the network application monitoring metrics and groups satisfy specified conditions.

20. The method of claim 1, wherein analyzing logically grouped and aggregated metrics comprises presenting results thereof using one or more visual indicators to highlight anomalous conditions.

21. The method of claim 1, wherein the logical group types comprise users and business groups.

22. The method of claim 21, wherein the group sets of the logical group types comprise one or more of:

any group type, a specific group type, a specified list of groups of a specified group type, or top groups of a given group type as ranked in terms of a specified one of the metrics.

23. The method of claim 1, wherein the related members comprises one or more of:

connected groups and constituents.

24. The method of claim 23, wherein the group type comprises a user and related members of a connected group of the user group type comprise one or more of:

another user, a user by application, a business group, or a business group by application.

25. The method of claim 23, wherein the group type comprises a user and related members of a constituent of the user group type comprise an application.

26. The method of claim 23, wherein the group type comprises a business group and related members of a connected group of the business group comprise one or more of:

a business group, a business group by application, a user, a user by application, a user by business group, or a user by business group by application.

27. The method of claim 23, wherein the group type comprises a business group and related members of a constituent of the business group comprise one or more of:

an application, a user or a user by application.