Methods and apparatus for analyzing and management of application traffic on networks

• US 20070011317A1
• Filed: 06/30/2006
• Published: 01/11/2007
• Est. Priority Date: 07/08/2005
• Status: Active Grant

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: Fluke Corporation (Fortive Corp.)
• Inventors: Kobryn, Jeff, Brandyburg, Gordon, Tucker, Matthew, Laver, Kent, Kannan, Naresh, Menzies, James, Nisbet, Thomas
• Granted Patent: US 7,804,787 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

An apparatus and method are provided for analyzing traffic on a network by monitoring packets sent between devices on the network and identifying applications occurring between devices on the network based on information derived from monitoring the packets. Techniques are provided to examine header information of the packets, such as information in the header of Internet Protocol (IP) packets, to identify applications that are occurring on the network. In some cases, information about the packet beyond the header information is examined to match a packet to a particular application. Using these techniques, a list is built of all of the applications occurring between devices on the network. Parameters may be generated to track one or more of the response time, latency and traffic volume associated with a particular device on the network.

Claims

1. A method for analyzing traffic on a network, comprising:

a. monitoring packets on the network; and

b. identifying applications occurring between devices on the network based on information derived from said monitoring.

2. The method of claim 1, wherein (a) monitoring comprises extracting header information of the packets, said header information comprising one or more of a source address, source port, destination address and destination port.

3. The method of claim 2, wherein (b) identifying comprises identifying an application occurring on the network based on said header information of the packets.

4. The method of claim 3, wherein (b) identifying comprises assigning a packet to an application flow that comprises exchanges of packets between devices on the network associated with an instance of an application.

5. The method of claim 3, wherein (b) identifying comprises comparing port numbers contained in the header information for the packet with stored information that associates port numbers with a corresponding application.

6. The method of claim 3, and further comprising storing a list of a plurality of applications determined to be occurring on the network based on said (b) identifying.

7. The method of claim 6, wherein (b) identifying comprises assigning a packet to an application already contained in said list when there is a match between one or more of the elements of the header information of the packet with similar such information for an application in said list, and adding a new application to said list when there is not a match between one or more elements of the header information of the packet with similar such information of an application already in said list.

8. The method of claim 6, and further comprising examining the header information of a packet to determine whether it identifies a port hop, and further comprising modifying information in said list to identify the new port associated with an application if a port hop is identified in the packet.

9. The method of claim 8, wherein (b) identifying comprises assigning further packets to a particular application contained in said list when it is determined that said further packets are associated with said particular application even though their header information indicates a different port or address.

10. The method of claim 3, wherein (b) identifying comprises comparing one or more elements of the header information of the packet with stored information that associates ranges of addresses and ports with specific applications.

11. The method of claim 10, wherein (b) identifying further comprises comparing content of a packet, beyond the header information, when it is determined that one or more elements of the packet fall within ranges of addresses and ports for a specific application in said stored information to determine whether the said specific application is occurring on the network.

12. The method of claim 10, wherein (b) identifying further comprises examining content of a packet, beyond the header information, to determine whether said specific application is occurring on the network.

13. The method of claim 3, wherein (b) identifying further comprises examining content of a packet, beyond the header information, to identify an application occurring on the network.

14. The method of claim 3, and further comprising storing data describing a hierarchy of applications and sub-applications and data describing standard port numbers for each of the plurality of applications and sub-applications in said hierarchy.

15. The method of claim 14, wherein (b) identifying comprises examining content of a packet, beyond the header information, to determine whether the packet is associated with a sub-application with respect to an application in said hierarchy.

16. The method of claim 1, and further comprising analyzing performance of the network based on accumulated data pertaining to applications that are determined to be occurring on the network.

17. The method of claim 16, wherein said analyzing comprises generating a list of applications determined to be occurring over time on the network, wherein said list associates applications with local and remote host devices transmitting the packets associated with the application flow.

18. The method of claim 16, wherein said analyzing comprises determining the throughput associated with each of the applications.

19. The method of claim 16, wherein said analyzing further comprises determining one or more of the traffic volume, latency and response time of devices acting as application servers on the network.

20. The method of claim 16, wherein said analyzing comprises categorizing the applications into classes including legitimate business applications and non-business legitimate applications.

21. The method of claim 16, and further comprising displaying a list of applications determined to be occurring on the network based on said application flows.

22. The method of claim 21, wherein said displaying further comprises displaying said list of applications grouped by host device.

23. The method of claim 21, wherein said displaying comprises displaying only those applications associated with a particular host device.

24. The method of claim 21, wherein said displaying comprises displaying said list of applications grouped by server device.

25. A computer readable medium storing instructions, that when executed by a computer, cause the computer to perform functions of:

a. monitoring packets on the network; and

b. identifying applications occurring between devices on the network based on information derived from said monitoring.

26. The computer readable medium of claim 25, wherein said instructions for (a) monitoring comprise instructions for extracting header information of the packets, said header information comprising one or more of a source address, source port, destination address and destination port.

27. The computer readable medium of claim 26, wherein said instructions for (b) identifying comprise instructions for identifying an application occurring on the network based on said header information of the packets.

28. The computer readable medium of claim 27, wherein said instructions for (b) identifying comprise instructions for assigning a packet to an application flow that comprises exchanges of packets between devices on the network associated with an instance of an application.

29. The computer readable medium of claim 27, wherein said instructions for (b) identifying comprise instructions for comparing port numbers contained in the header information for the packet with stored information that associates port numbers with a corresponding application.

30. The computer readable medium of claim 27, and further comprising instructions, that when executed, cause the computer to store a list of a plurality of applications determined to be occurring on the network based on said (b) identifying.

31. The computer readable medium of claim 30, wherein the instructions for (b) identifying comprise instructions for assigning a packet to an application already contained in said list when there is a match between one or more of the elements of the header information of the packet with similar such information for an application in said list, and further comprising instructions, that when executed by the computer, add a new application to said list when there is not a match between one or more elements of the header information of the packet with similar such information of an application already in said list.

32. The computer readable medium of claim 30, and further comprising instructions that, when executed by the computer, cause the computer to examine the header information of a packet to determine whether it identifies a port hop, and modifying information in said list to identify the new port associated with an application if a port hop is identified in the packet.

33. The computer readable medium of claim 27, wherein the instructions for (b) identifying comprise instructions for comparing one or more elements of the header information of the packet with stored information that associates ranges of addresses and ports with specific applications.

34. The computer readable medium of claim 27, wherein the instructions for (b) identifying further comprise instructions for examining content of a packet, beyond the header information, to determine whether said specific application is occurring on the network.

35. The computer readable medium of claim 27, and further comprising instructions that, when executed by the computer, cause the computer to store data describing a hierarchy of applications and sub-applications and data describing standard port numbers for each of the plurality of applications and sub-applications in said hierarchy.

36. The computer readable medium of claim 25, and further comprising instructions that, when executed by the computer, cause the computer to analyze performance of the network based on accumulated data pertaining to applications that are determined to be occurring on the network.

37. The computer readable medium of claim 36, wherein the instructions for analyzing comprise instructions for generating a list of applications determined to be occurring over time on the network, wherein said list associates applications with local and remote host devices transmitting the packets associated with the application flow.

38. The computer readable medium of claim 37, wherein the instructions for analyzing comprise instructions for determining the throughput associated with each of the applications.

39. The computer readable medium of claim 38, wherein the instructions for said displaying comprise instructions for displaying said list of applications grouped by host device.

40. The computer readable medium of claim 38, wherein the instructions for displaying comprise instructions for displaying only those applications associated with a particular host device.

41. A system for monitoring a network, comprising:

a. at least one network monitoring device connected in the network so as to monitor packets on the network; and

b. a computer coupled to said at least one network monitoring device that identifies applications occurring between devices on the network based on information derived from said at least one network monitoring device.

42. The system of claim 41, wherein said at least one network monitoring device extracts header information of the packets, said header information comprising one or more of a source address, source port, destination address and destination port.

43. The system of claim 42, wherein said computer identifies an application occurring on the network based on said header information of the packets.

44. The system of claim 43, wherein said computer compares port numbers contained in the header information for the packet with stored information that associates port numbers with a corresponding application.

45. The system of claim 43, wherein said computer stores a list of a plurality of applications determined to be occurring on the network.

46. The system of claim 43, wherein said computer compares one or more elements of the header information of the packet with stored information that associates ranges of addresses and ports with specific applications.

47. The system of claim 43, wherein said computer compares content of a packet, beyond the header information, to determine whether a specific application is occurring on the network.