Sniffing-based network monitoring

• US 20070230361A1
• Filed: 03/30/2007
• Published: 10/04/2007
• Est. Priority Date: 04/03/2006
• Status: Active Grant

• Current Assignee: Valtrus Innovations Limited (f/k/a Dolya Holdco 9 Limited) (Key Patent Innovations Limited)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Choudhury, Jonmejoy Das
• Granted Patent: US 7,936,694 B2
• Time in Patent Office: Days
• US Class Current: 370/250
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0226 Mapping or translating multiple network management protocols
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/087 Jitter
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/55 Testing of service level quality, e.g. simulating service usage
• CPC Class Codes: H04L 65/1026 at the edge
• CPC Class Codes: H04L 65/103 in the network
• CPC Class Codes: H04L 65/1036 at the edge
• CPC Class Codes: H04L 65/104 in the network
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/80 Responding to QoS

Abstract

A method is provided of monitoring a packet-switched network via which real-time data is transmitted. Data packets containing real-time data are sniffed by a monitor subagent to monitor a quality-of-service parameter. A monitor agent is notified in response to a breach of the threshold of the quality-of-service parameter about the breach. A network node manager is notified about the breach, and a root cause analysis is performed.

Claims

1. A method of monitoring a packet-switched network via which real-time data is transmitted, the method comprising:

sniffing data packets containing real-time data by a monitor subagent to monitor a quality-of-service parameter,

notifying, in response to a threshold breach of the quality-of-service parameter, a monitor agent about the breach,

notifying a network node manager about the breach, and

performing a root cause analysis.

2. The method of claim 1, wherein the monitoring and the root cause analysis are performed to enable SLA management.

3. The method of claim 1, further comprising reporting a root cause to a user.

4. The method of claim 1, wherein the real-time data comprises VoIP-data, encapsulated in RTP and UDP data packets.

5. The method of claim 1, wherein the quality-of-service parameter comprises one of egress delay, ingress delay, jitter, roundtrip delay, packet loss, throughput, instantaneous signal loss, and accumulated content loss.

6. The method of claim 1, wherein notifying a network node manager comprises sending a trap to the network node manager.

7. The method of claim 6, wherein sending a trap comprises sending an SNMP-trap.

8. The method of claim 1, wherein performing a root cause analysis comprises performing a path analysis to find out the path over which real-time data is transmitted.

9. The method of claim 8, wherein the path analysis comprises examining interfaces of network devices lying on the path.

10. The method of claim 8, wherein the root cause analysis is performed in cooperation with the monitor subagent detecting the threshold breach.

11. The method of claim 4, wherein the data packets sniffed are control packets accompanying the RTP payload.

12. The method of claim 1, wherein an alert is triggered in response to breaching a threshold.

13. The method of claim 1, wherein a breach of a quality-of-service parameter is forwarded to a media gateway controller which directs media gateways to renegotiate lower bandwidth communication.

14. The method of claim 1, wherein the sniffing is initiated by means of a media gateway controller.

15. The method of claim 14, wherein the sniffing is initiated by signaling messages issued by the media gateway controller.

16. The method of claim 1, wherein a “

what-if”

analysis is performed based on performance data stored in a data warehouse.

17. A computer system for monitoring a packet-switched network via which real-time data is transmitted, the computer system being programmed to:

sniff data packets containing real-time data by a monitor subagent to monitor a quality-of-service parameter,

notify, in response to a threshold breach of the quality-of-service parameter, a monitor agent about the breach,

notify a network node manager about the breach, and

perform a root cause analysis.

18. A computer program product which is either in the form of a machine-readable medium with program code stored on it, or in the form of a propagated signal comprising a representation of program code,

wherein the program code is arranged to carry out a method, when executed on a computer system, of monitoring a packet-switched network via which real-time data is transmitted, the method comprising:

sniffing data packets containing real-time data by a monitor subagent to monitor a quality-of-service parameter,

notifying, in response to a threshold breach of the quality-of-service parameter, a monitor agent about the breach,

notifying a network node manager about the breach, and

performing a root cause analysis.