Network analysis system and method

• US 20060168205A1
• Filed: 01/24/2006
• Published: 07/27/2006
• Est. Priority Date: 01/24/2005
• Status: Active Grant

• Current Assignee: Daintree Networks Pty Ltd. (GE Aerospace)
• Original Assignee: Daintree Networks Pty Ltd. (GE Aerospace)
• Inventors: Barron, Gregory Joseph, Choong, Jason Yew Choo, Cobb, Peter Graeme, Wood, William Raymond
• Granted Patent: US 7,962,606 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 1/1835 Buffer management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/34 Signalling channels for network management communication
• CPC Class Codes: H04L 41/344 Out-of-band transfers
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 40/00 Communication routing or communication path finding
• CPC Class Codes: H04W 80/02 Data link layer protocols

Abstract

A system for analyzing a packet-based network includes a correlator processor that is configured to receive packet records corresponding to packets communicated over a network and store the packet records in a data store. The correlator processor is also configured to generate correlated packet records from the packet records stored in the data store, the correlated packet records representative of the order in which the packets were transmitted in the network.

Claims

1. A packet-based network analysis system, comprising:

a correlator processor configured to;

receive packet records corresponding to packets communicated over a network and store the packet records in a data store;

determine if a received packet record corresponds to a retransmitted packet or a duplicate packet by comparing the received packet record to the packet records stored in the data store;

if the received packet record corresponds to a retransmitted packet based on the comparison of the received packet record to a packet record stored in the data store, then discard the received packet record and classify the packet record stored in the data store as a retransmitted packet record;

if the received packet record corresponds to a duplicate packet based on a comparison of the received packet record to a packet record stored in the data store, then timestamp synchronize the packet record stored in the data store and the received packet record and discard the received packet record; and

generate correlated packet records from the packet records stored in the data store, the correlated packet records representative of the order in which the packets were transmitted in the network.

2. The packet-based network analysis system of claim 1, further comprising:

a capture device configured to monitor packets communicated over the network and create the corresponding packet records.

3. The packet-based network analysis system of claim 2, wherein:

the capture device is configured to create corresponding packet records by including a subset of a packet in each corresponding packet record.

4. The packet-based network analysis system of claim 1, wherein:

the correlator processor is configured to compare the received packet record to the packet records stored in the data store by comparing packet data in the received packet record to packet data of the packet records stored in the data store.

5. The packet-based network analysis system of claim 4, wherein:

the correlator processor is configured to compare packet data in the received packet record to packet data of the packet records stored in the data store by generating cyclic redundancy checksums for the packets.

6. The packet-based network analysis system of claim 1, further comprising:

a plurality of capture devices configured to monitor packets communicated over the network and create the corresponding packet records, and wherein each capture device includes a capture clock and each capture device is further configured to include a timestamp in each packet record corresponding to the capture clock time the capture device detects the start of frame of a packet.

7. The packet-based network analysis system of claim 6, wherein:

the correlator is configured to timestamp synchronize the packet records stored in the data store and the received packet records by designating a first capture device as a master capture device and time synchronize packet records received from other capture devices to the master capture device.

8. The packet-based network analysis system of claim 7, wherein:

the correlator is configured to calculate a first timing offset of a duplicate packet record representative of the time difference between which a corresponding packet was received by the master capture device and received by a second capture device and to apply the first timing offset for all subsequent packet records received by the second capture device.

9. The packet-based network analysis system of claim 8, wherein:

the correlator is configured to calculate a second timing offset of a duplicate packet record representative of the time difference between which a corresponding packet was received by the second capture device and received by a third capture device.

10. The packet-based network analysis system of claim 9, wherein:

the correlator is further configured to apply the first and second timing offsets for all subsequent packet records received by the third capture device.

11. The packet-based network analysis system of claim 10, wherein:

timing offsets are calculated for every duplicate packet received.

12. The packet-based network analysis system of claim 1, wherein:

the network comprises a ZigBee network.

13. The packet-based network analysis system of claim 1, wherein:

the correlated packet records that are representative of the order in which the packets were transmitted in the network comprise hop data and timing data representative of the packet path and packet transmission times in the network for each corresponding packet.

14. The packet-based network analysis system of claim 13, wherein:

each correlated packet record comprises hop data and timing data for only one hop of a corresponding packet path in the network.

15. A correlator processor for analyzing packet transmissions in a packet-based network, the correlator processor comprising:

a data store;

a communication subsystem; and

a processing subsystem in data communication with the communication subsystem and the data store;

wherein the correlator processor is configured to;

receive packet records corresponding to packets communicated over a network and store the packet records in a data store; and

generate correlated packet records from the packet records stored in the data store, the correlated packet records comprising hop data and timing data representative of the packet path and packet transmission times in the network for each corresponding packet, the correlated packet records filtered of duplicate packet records for duplicate packet transmissions and duplicate packet retransmissions.

16. The correlator processor of claim 15, wherein:

the correlator processor is configured to;

determine if a received packet record corresponds to a retransmitted packet or a duplicate packet by comparing the received packet record to the packet records stored in the data store;

if the received packet record corresponds to a retransmitted packet based on the comparison of the received packet record to a packet record stored in the data store, then store the received packet records and classify the received packet record and the stored packet record as retransmitted packet records;

if the received packet record corresponds to a duplicate packet based on a comparison of the received packet record to a packet record stored in the data store, then determine if the duplicate packet record corresponds to a retransmitted packet record;

if the duplicate packet record does not correspond to a retransmitted packet record, then timestamp synchronize the packet record stored in the data store and the received packet record and discard the received packet record; and

if the duplicate packet record does correspond to a retransmitted packet record, then discard the received packet record;

thereby filtering the packet records for duplicate packet transmissions and duplicate packet retransmissions.

17. A method for analyzing a packet-based network, comprising:

receiving packet records corresponding to packets communicated over the network and storing the packet records;

determining if a received packet record corresponds to a retransmitted packet or a duplicate packet by comparing the received packet record to the stored packet records;

filtering the packet records for duplicate packet transmissions and duplicate packet retransmissions based on the determination of a received packet record corresponding to a retransmitted packet or a duplicate packet; and

generating correlated packet records from the stored packet records, the correlated packet records representative of the order in which the packets were transmitted in the network.

18. The method of claim 17, wherein:

filtering the packet records for duplicate packet transmissions and packet retransmissions based on the determination of a received packet record corresponding to a retransmitted packet or a duplicate packet comprises;

discarding a received packet record and classifying a stored packet record as a retransmitted packet record if the received packet record corresponds to a retransmitted packet; and

timestamp synchronizing a stored packet record and a received packet record and discarding the received packet record if the received packet record corresponds to a duplicate packet.

19. The method of claim 18, wherein:

the correlated packet records comprise hop data and timing data representative of the packet path and packet transmission times in the network for each corresponding packet.

20. A system for analyzing a packet-based network, comprising:

means for receiving packet records corresponding to packets communicated over the network and storing the packet records;

means for determining if a received packet record corresponds to a retransmitted packet or a duplicate packet by comparing the received packet record to the stored packet records;

means for filtering the packet records for duplicate packet transmissions and packet retransmissions based on the determination of a received packet record corresponding to a retransmitted packet or a duplicate packet; and

means for generating correlated packet records from the stored packet records, the correlated packet records representative of the order in which the packets were transmitted in the network.