System, Method and Apparatus for Troubleshooting an IP Network

• US 20080016515A1
• Filed: 07/11/2007
• Published: 01/17/2008
• Est. Priority Date: 07/12/2006
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Sipera Systems Inc (Avaya Incorporated)
• Inventors: Naim, Ghassan, Kurapati, Srikrishna
• Granted Patent: US 8,862,718 B2
• Time in Patent Office: Days
• US Class Current: 719/313
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present invention provides a system, method and apparatus for troubleshooting one or more communications between a first device and a second device. A monitoring device disposed between the first device and the second device receives a message associated with the communication(s), analyzes the received message and stores the analyzed message whenever the analyzed message satisfies one or more troubleshooting criteria. The one or more troubleshooting criteria may include one or more data element criteria, one or more event-based criteria, one or more time-based criteria, one or more logical operators or a combination thereof. The method can be implemented using a computer program embodied on a computer readable medium having one or more code segments to perform the method steps.

Claims

1. A method for troubleshooting one or more communications between a first device and a second device, comprising the steps of:

receiving a message associated with the communication(s) at a monitoring device disposed between the first device and the second device;

analyzing the received message; and

storing the analyzed message whenever the analyzed message satisfies one or more troubleshooting criteria.

2. The method as recited in claim 1, further comprising the step of receiving the one or more troubleshooting criteria.

3. The method as recited in claim 1, wherein the one or more troubleshooting criteria comprise one or more data element criteria, one or more event-based criteria, one or more time-based criteria, one or more logical operators or a combination thereof.

4. The method as recited in claim 1, wherein:

the one or more data elements comprise an international mobile subscriber identity, an unlicensed mobile access classmark, a cell identity, a location area identity, a routing area identity, an access point identity, an Internet Protocol (IP) subnet mask, an IPsec tunnel identity IP address, a secure gateway identity IP address, an unlicensed network controller identity IP address, a media gateway identity IP address, a general packet radio service gateway identity IP address, a border router IP address, a user equipment uniform resource identifier, a transport layer security tunnel identity IP address, a packet data gateway identity IP address, a proxy call session control function identity IP address, a protocol type or all messages;

the one or more event-based criteria comprise an IPsec failure, one or more registration failure criteria, a general packet radio service attach failure, a packet data protocol context failure, a transport layer security failure;

or

the one or more time-based criteria comprise a start time, an end time, or a duration.

5. The method as recited in claim 1, further comprising the steps of:

creating a troubleshooting session containing the one or more troubleshooting criteria;

sending the troubleshooting session to the monitoring device; and

receiving one or more log files containing the stored messages corresponding to the troubleshooting session.

6. The method as recited in claim 1, further comprising the steps of:

decrypting the received message using a security key whenever the received message is encrypted;

or

storing the analyzed message in a buffer whenever the analyzed message does not satisfy any of the troubleshooting criteria.

7. The method as recited in claim 6, further comprising the steps of:

establishing a secure communication channel between the monitoring device and a security device;

receiving the security key from the security device via the secure communication channel; and

storing the security key.

8. The method as recited in claim 7, further comprising the step of receiving a new security key whenever the security key associated with the communication(s) between the first device and the second device is changed.

9. The method as recited in claim 8, wherein the security key is changed on a per session or per call basis.

10. The method as recited in claim 1, wherein the monitoring device is communicably connected between the first device and the second device, or is communicably connected to a tap communicably connected between the first device and the second device.

11. The method as recited in claim 1, wherein:

the monitoring device comprises an application level security node or an Internet Protocol Communication Security device;

the first device or the second device comprises a border router, a packet data gateway, a secure gateway, a signaling gateway, a network trusted entity, a device that creates a security key, a remote device, an application server, a home subscriber server, an interrogating call session control function, a service call session control function, a subscriber location function, a breakout gateway function controller, a media gateway control function, a media resource function controller, a proxy call session control function, a policy decision function, an access-authorization-accounting server, a gateway general packet radio service support node, an unlicensed network controller, a media gateway, a general packet radio service gateway or other communications device;

the remote device comprises an end user device, a mobile handset, a computer, a portable computer, a personal data assistant, a multimedia device or a combination thereof, or

the message(s) comprise one or more data packets, voice packets, multimedia packets or a combination thereof.

12. A method for troubleshooting one or more communications between a first device and a second device, comprising the steps of:

receiving a message associated with the communication(s) at a monitoring device disposed between the first device and the second device;

decoding the received message;

analyzing the decoded message;

storing the analyzed message in a history buffer whenever the analyzed message does not satisfy one or more troubleshooting criteria;

storing the analyzed message in an existing log file whenever the analyzed message satisfies the troubleshooting criteria and the analyzed message is part of one or more active troubleshooting sessions; and

creating a new log file and storing the analyzed message in the new log file whenever the analyzed message satisfies the troubleshooting criteria and the analyzed message is not part of the active troubleshooting sessions.

13. The method as recited in claim 12, further comprising the step of extracting one or more messages stored in the history buffer and storing the extracted messages in the new log file after the new log file is created.

14. The method as recited in claim 13, wherein the extracted messages relate to a specified message or a specified communication session or a combination thereof.

15. The method as recited in claim 12, further comprising the steps of determining whether the existing log files exceed one or more capacity levels and performing one or more predetermined actions based on the exceeded capacity level.

16. The method as recited in claim 12, further comprising the steps of:

establishing a secure communication channel between the monitoring device and a security device;

receiving the security key from the security device via the secure communication channel;

storing the security key;

decrypting the received message using a security key whenever the received message is encrypted; and

receiving a new security key and storing the new security key whenever the security key associated with the communication(s) between the first device and the second device is changed.

17. A computer program embodied on a computer readable medium for troubleshooting one or more communications between a first device and a second device, the computer program comprising:

a code segment for receiving a message associated with the communication(s) at a monitoring device disposed between the first device and the second device;

a code segment for analyzing the received message; and

a code segment for storing the analyzed message whenever the analyzed message satisfies one or more troubleshooting criteria.

18. A computer program embodied on a computer readable medium for troubleshooting one or more communications between a first device and a second device, the computer program comprising:

a code segment for receiving a message associated with the communication(s) at a monitoring device disposed between the first device and the second device;

a code segment for decoding the received message;

a code segment for analyzing the decoded message;

a code segment for storing the analyzed message in a history buffer whenever the analyzed message does not satisfy one or more troubleshooting criteria;

a code segment for storing the analyzed message in an existing log file whenever the analyzed message satisfies the troubleshooting criteria and the analyzed message is part of one or more active troubleshooting sessions; and

a code segment for creating a new log file and storing the analyzed message in the new log file whenever the analyzed message satisfies the troubleshooting criteria and the analyzed message is not part of the active troubleshooting sessions.

19. An apparatus for troubleshooting one or more communications between a first device and a second device comprising:

a first interface;

a second interface;

a data storage; and

a processor communicably coupled to the first interface, the second interface and the data storage wherein the processor receives a message associated with the communication(s) via the second interface, analyzes the received message and stores the analyzed message in the data storage whenever the analyzed message satisfies one or more troubleshooting criteria.

20. The apparatus as recited in claim 19, wherein the processor receives the one or more troubleshooting criteria from a control center via a second interface communicably coupled to the processor.

21. The apparatus as recited in claim 19, wherein the one or more troubleshooting criteria comprise one or more data element criteria, one or more event-based criteria, one or more time-based criteria, one or more logical operators or a combination thereof.

22. The apparatus as recited in claim 19, further comprising:

a third interface communicably coupled to the processor; and

the processor receives a security key via the third interface, stores the security key in the data storage and decrypts the received message using the security key whenever the received message is encrypted.

23. An apparatus for troubleshooting one or more communications between a first device and a second device comprising:

a first interface;

a second interface;

a data storage; and

a processor communicably coupled to the first interface, the second interface and the data storage wherein the processor receives a message associated with the communication(s) at a monitoring device disposed between the first device and the second device, decodes the received message, analyzes the decoded message, stores the analyzed message in a history buffer whenever the analyzed message does not satisfy one or more troubleshooting criteria, stores the analyzed message in an existing log file whenever the analyzed message satisfies the troubleshooting criteria and the analyzed message is part of one or more active troubleshooting sessions, and creates a new log file and stores the analyzed message in the new log file whenever the analyzed message satisfies the troubleshooting criteria and the analyzed message is not part of the active troubleshooting sessions.

24. A system comprising:

a network control center;

one or more monitoring devices communicably coupled to the network control center and disposed between a first device and a second device, each monitoring device comprising a first interface, a second interface, a data storage and a processor communicably coupled to the first interface, the second interface and the data storage wherein the processor receives one or more troubleshooting criteria from the network control center via the first interface, receives a message associated with one or more communications between the first device and the second device via the second interface, analyzes the received message and stores the analyzed message in the data storage whenever the analyzed message satisfies the troubleshooting criteria.

25. The system as recited in claim 24, wherein the one or more troubleshooting criteria comprise one or more data element criteria, one or more event-based criteria, one or more time-based criteria, one or more logical operators or a combination thereof

26. The system as recited in claim 24, wherein the monitoring device is communicably connected between the first device and the second device, or is communicably connected to a tap communicably connected between the first device and the second device.

27. The system as recited in claim 24, wherein the monitoring device further comprises:

a third interface communicably coupled to the processor; and

the processor receives a security key via the third interface, stores the security key in the data storage and decrypts the received message using the security key whenever the received message is encrypted.

28. A system comprising:

a network control center;

one or more monitoring devices communicably coupled to the network control center and disposed between a first device and a second device, each monitoring device comprising a first interface, a second interface, a data storage and a processor communicably coupled to the first interface, the second interface and the data storage wherein the processor receives a message associated with the communication(s) at a monitoring device disposed between the first device and the second device, decodes the received message, analyzes the decoded message, stores the analyzed message in a history buffer whenever the analyzed message does not satisfy one or more troubleshooting criteria, stores the analyzed message in an existing log file whenever the analyzed message satisfies the troubleshooting criteria and the analyzed message is part of one or more active troubleshooting sessions, and creates a new log file and stores the analyzed message in the new log file whenever the analyzed message satisfies the troubleshooting criteria and the analyzed message is not part of the active troubleshooting sessions.