TRIGGERING FLOW ANALYSIS AT INTERMEDIARY DEVICES

• US 20080175162A1
• Filed: 01/24/2007
• Published: 07/24/2008
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Mostafa, Mohamed S., Wing, Daniel G., Kumar, Rajesh, Biskner, Robert J.
• Granted Patent: US 7,706,278 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/286 Time to live
• CPC Class Codes: H04L 47/32 by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

In one embodiment, a router examines an incoming packet for a flow monitoring request. The router may examine every packet for the flow monitoring request, or preferably may only examine packets including a lifetime value indicating that the packet should be dropped and not forwarded or may only examine packets having a predetermined message format. When the flow monitoring request is included, the router performs detailed flow analysis or other monitoring according to the flow monitoring request.

Claims

1. An apparatus, comprising:

one or more processors; and

a memory coupled to the one or more processors comprising instructions executable by the processors, the processors operable when executing the instructions to;

decrement lifetime values of incoming packets before performing a forwarding function;

identify one or more of the incoming packets containing decremented lifetime values indicating an exceeded lifetime;

examine the identified packets having the exceeded lifetime for a monitoring request; and

monitor a call flow according to the monitoring request.

2. The apparatus of claim 1 wherein the unidentified packets are not examined for the monitoring request.

3. The apparatus of claim 1 wherein the identified packets correspond to a traceroute initiated by an endpoint for the call flow.

4. The apparatus of claim 1 wherein the monitoring request is located in a payload of an address request message.

5. The apparatus of claim 1 wherein the processors are further operable to:

extract a call flow identifier from the monitoring request; and

insert the call flow identifier into locally generated monitoring results.

6. The apparatus of claim 1 wherein the processors are further operable to send an error message usable by an endpoint to discover the presence of a router located on the call path.

7. A method comprising:

receiving incoming packets;

identifying one or more of the incoming packets as containing a predetermined message format;

observing whether the identified packets include a trigger for initiating analysis of one or more data streams that terminate on a remote endpoint that generated and inserted the trigger; and

initiating an analysis of the data streams in response to observing the trigger included in the identified packets.

8. The method of claim 7 wherein the identified packets are identified as having exceeded lifetimes and are dropped after receipt without forwarding.

9. The method of claim 7 wherein the predetermined message format corresponds to Simple Traversal of User Datagram Protocol (UDP) Through Network Address Translators (NATs) (STUN).

10. The method of claim 7 further comprising analyzing the data streams only for a duration specified in the identified packets.

11. The method of claim 7 further comprising storing results of the analysis in a non-default location when a Universal Resource Location (URL) is included within an address request payload included in the identified incoming packets.

12. The method of claim 7 wherein the data streams associated with the analysis are selected to correspond with an identifier included in the identified incoming packets.

13. The method of claim 12 wherein the initiated analysis is different than a default packet flow analysis performed on the data streams before the initiated analysis begins.

14. An apparatus, comprising:

means for generating a plurality of packets formatted to elicit one or more on-path intermediary devices to drop the packets and report an error before the packets reach a destination address included in the packets; and

means for including a monitoring request in the packets, the monitoring request formatted to trigger the on-path intermediary devices to initiate monitoring of a call flow terminating on a remote endpoint having the destination address.

15. The apparatus of claim 14 wherein the packets include a request for the remote endpoint to send back a Simple Traversal of User Datagram Protocol (UDP) Through Network Address Translators (NATs) (STUN) response.

16. The apparatus of claim 14 further comprising means for formatting the monitoring request to specify an inter-arrival jitter analysis.

17. The apparatus of claim 14 wherein the packets comprise a portion of a traceroute.

18. The apparatus of claim 17 wherein the traceroute is a Real Time Protocol (RTP) traceroute.

19. The apparatus of claim 14 wherein each of the packets are formatted to achieve a different amount of network hops before being dropped.

20. The apparatus of claim 14 wherein each of the packets are formatted to initiate monitoring on a different respective one of the on-path intermediary devices that drops the packet.