SYSTEM AND METHOD FOR AGGREGATING AND REPORTING NETWORK TRAFFIC DATA

• US 20090016236A1
• Filed: 05/07/2008
• Published: 01/15/2009
• Est. Priority Date: 07/10/2007
• Status: Active Grant

• Current Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.)
• Original Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.)
• Inventors: Whitaker, Jeff, Alcala, Raoul, Comstedt, Niclas
• Granted Patent: US 9,014,047 B2
• Time in Patent Office: Days
• US Class Current: 370/253
• CPC Class Codes: H04L 12/5602 Bandwidth control in ATM Networks, e.g. leaky bucket
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

A method for analyzing traffic in a communications network includes sampling data packets at a plurality of network interconnection points, wherein sampling the data packets includes generating a plurality of sampled packet data in one or more standardized formats, converting the sampled packet data from the one or more standardized formats into a neutral format, and aggregating the sampled packet data in the neutral format from the plurality of network interconnection points. A system includes a communications node operable to sample data packets flowing through and generate sample packet data in a specified format, a collector node operable to convert the sampled packet data into a neutral format, the collector node further operable to map IP addresses of the sampled packet data to corresponding prefixes in a routing table; and an aggregator node operable to aggregate neutrally formatted sampled packet data from a plurality of collector nodes.

Claims

1. A method for analyzing traffic in a communications network, the method comprising:

sampling data packets at a plurality of network interconnection points,

enriching the sampled packet data by mapping IP addresses of the sampled packet data to corresponding IP prefixes associated with a plurality of networks communicating over the communications network; and

aggregating the enriched sampled packet data to yield aggregated traffic flow measures associated with one or more of the networks.

2. The method of claim 1, wherein the IP prefixes are obtained from a routing table.

3. The method as recited in claim 1 further comprising converting the sampled packet data from one or more standardized formats into a neutral format.

4. The method as recited in claim 1, wherein enriching the sampled packet data comprises mapping IP addresses in the sampled packet data to geographic locations.

5. The method as recited in claim 1, wherein enriching the sampled packet data comprises mapping IP addresses in the sampled packet data to customers.

6. The method as recited in claim 3, wherein the plurality of standardized formats comprises sFlow format, Netflow format and cflowd format.

7. The method as recited in claim 4, wherein the geographic locations comprise one or more of a city, a country, a continent or a region.

8. The method as recited in claim 1 further comprising generating one or more traffic flow reports based on the sampled packet data, wherein the one or more reports are selected from a group comprising:

a peer distribution report including one or more of traffic volume measurements of traffic outbound from a peer network or traffic volume measurements of traffic inbound to a peer network;

a customer distribution report including on or more of traffic volume measurements of traffic outbound from one or more customer networks or traffic volume measurements of traffic inbound to one or more of customer networks;

an autonomous system distribution report including average traffic volume, traffic volume by region, on-net traffic volume, off-net traffic volume, direction of traffic, next hop autonomous systems, and upstream autonomous systems associated with one or more autonomous systems;

an applications report including average traffic volume and region to region traffic volume associated with network applications;

an on-net distribution report includes traffic volume measurements of traffic outbound from a peer network that was also inbound to the peer network;

an off-net distribution report includes traffic volume measurements of traffic outbound from a peer network that was not also inbound to the peer network;

a region distribution report including average traffic volume inbound to or outbound from selected regions; and

a city distribution report including average traffic volume from one or more source cities to one or more destination cities.

9. The method as recited in claim 1, wherein enriching the sample packet data comprises generating one or more sampled packet data summaries at a collector node by mapping the sampled packet data to routing table data from communication nodes associated with the collector node.

10. The method as recited in claim 9, further comprising communicating the one or more sampled packet data summaries from the collector nodes to an aggregator node configured to perform the aggregating.

11. A system for analyzing traffic flow in a communications network, the system comprising:

a communications node including a sampling agent operable to sample data packets flowing through the communications node and generate sample packet data;

a collector node operable to map IP addresses of the sample packet data to IP prefixes in a routing table of the communications node; and

an aggregator node operable to aggregate sampled packet data associated with one or more IP prefixes to yield aggregated traffic flow measures associated with the IP prefixes.

12. The system of claim 11 wherein the IP prefixes are associated with respective autonomous systems, and wherein the collector node is further operable to map sampled packet data to associated autonomous systems.

13. The system of claim 12, wherein the aggregator node is further operable to generate traffic flow measures associated with autonomous systems communicating over the communications network.

14. The system of claim 11, further comprising an autonomous system (AS) registry storing information about autonomous systems including AS identifier and region.

15. The system of claim 11, further comprising a customer attributes data store storing customer AS identifiers.

16. The system of claim 14, wherein the aggregator node is further operable to map AS identifiers from the sampled packet data to regions in the AS registry.

17. The system of claim 11, wherein the aggregator node is further operable to generate traffic flow measurements associated with network applications based on the neutrally formatted sampled packet data.

18. The system of claim 11, wherein the aggregator node is further operable to generate one or more reports relating traffic flow measurements to one or more of a region, an autonomous system, a community, a network application, or a network protocol.

19. The system of claim 17, wherein at least one of the one or more reports includes traffic flow measurements for traffic flowing from a selected community to at least one other community.

20. The system of claim 11, wherein the aggregator node is further operable to generate a traffic flow measurement of outbound traffic from a selected AS to each of a plurality of other AS'"'"'s.

21. The system of claim 11, wherein the aggregator node is further operable to generate a traffic flow measurement of outbound traffic to a selected AS from each of a plurality of other AS'"'"'s.

22. The system of claim 11, wherein the aggregator node is further operable to generate a traffic flow measurement of on-net traffic and a traffic flow measurement of off-net traffic for a selected AS.

23. A method for analyzing communications traffic through a network, the method comprising:

sampling data packets communicated through the network;

categorizing each data packet according one or more network-related attribute categories;

aggregating data packets of each of the attribute categories; and

determining data packet transmission statistics associated with each of the one or more attribute categories based on the aggregation.

24. The method of claim 23 wherein the one or more attribute categories comprise one or more of geographic region, network, community, application, protocol, autonomous system, customer, on-net, or off-net.

25. The method of claim 24 wherein determining data packet transmission statistics comprises determining data packet volume transmitted to or from one or more of a geographic region, a network, a community, an autonomous system, a customer, an on-net provider, or an off-net provider.