Multi-Segment Network Application Monitoring and Correlation Architecture

• US 20100091676A1
• Filed: 10/06/2009
• Published: 04/15/2010
• Est. Priority Date: 01/10/2002
• Status: Active Grant

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: NetScout Systems Incorporated
• Inventors: Liubinskas, Tauras, Moran, Mike, Goral, Jack
• Granted Patent: US 8,185,651 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/2433 Allocation of priorities to traffic types
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2458 Modification of priorities while in transit
• CPC Class Codes: H04L 47/29 using a combination of thresholds
• CPC Class Codes: H04L 47/326 with random discard, e.g. random early discard [RED]
• CPC Class Codes: H04L 47/745 Reaction in network
• CPC Class Codes: H04L 47/762 triggered by the network
• CPC Class Codes: H04L 49/90 Buffering arrangements

Abstract

A system, method and computer program product are provided for network and network application monitoring. Accordingly, one or more media modules are each coupled to an associated network segment. In the case of network application monitoring, each media module is coupled to a network segment on which a network application is running. Each media module monitors and collects data relating to traffic on the associated network segment corresponding to the network application, wherein each media module is tailored for network analysis. An application server module is coupled to the at least one media module and receives the data and analyzes the data for helping to improve the performance of the network and/or network application.

Claims

1. A network monitoring system, comprising:

a flow processor coupled to the media module, the flow processor classifying the collected data as a priority flow or a non-priority flow and collecting data associated with traffic on a network segment;

a capture buffer coupled to the flow processor, the capture buffer including a priority queue and a non-priority queue;

an allocation module coupled to the flow processor and the capture buffer, responsive to the flow processor classifying the collected data as a priority flow, the buffer allocation module storing the collected data in the priority queue and responsive to the flow processor classifying the collected data as a non-priority flow, the allocation module storing the collected data in the non-priority buffer, wherein the allocation module dynamically modifies a size of the priority queue responsive to classification of collected data as a priority flow by the flow processor.

2. The network monitoring system of claim 1, wherein the allocation module dynamically decreases a size of the non-priority queue and increases a size of the priority queue responsive to classification of collected data as a priority flow.

3. The network monitoring system of claim 1, wherein the buffer allocation module determines a number of priority flows and increases a size of the priority queue as the number of priority flows increases.

4. The network monitoring system of claim 3, wherein the allocation module reallocates space from the non-priority queue to the priority queue to increase the size of the priority buffer.

5. The network monitoring system of claim 1, wherein the allocation module dynamically decreases a size of the priority queue and increases a size of the non-priority queue responsive to classification of collected data as a non-priority flow.

6. The network monitoring system of claim 5, wherein the allocation module reallocates space from the priority queue to the non-priority queue to increase the size of the non-priority buffer.

7. The network monitoring system of claim 1, wherein the flow processor monitors the average size of the priority queue and, responsive to the average size of the priority queue exceeding a threshold reclassifying data in the priority queue as a non-priority flow.

8. The network monitoring system of claim 1, wherein the flow processor includes a priority filter including one or more data attributes associated with the priority flow.

9. The network monitoring system of claim 1, further comprising an expert system coupled to the flow processor and the capture buffer, the expert system regulating data transmission from the capture buffer responsive to classification by the flow processor.

10. The network monitoring system of claim 9, wherein regulating data transmission from the capture buffer responsive to classification by the flow processor comprises:

transmitting data from the priority queue before transmitting data from the non-priority queue.

11. The network monitoring system of claim 1, wherein the flow processor classifies the collected data as the priority flow responsive to the flow processor determining the collected data is associated with a priority application type.

12. The network monitoring system of claim 1, wherein the flow processor classifies the collected data as a priority flow or a non-priority flow by analyzing fields included in one or more packets included in the collected data.

13. The network monitoring system of claim 12, wherein the fields included in one or more packets comprise:

a prepended descriptor, a data link control header, a level 3 header or one or more higher-level headers

14. The network monitoring system of claim 1, wherein the flow processor further modifies a data filter associated with the flow processor responsive to classifying the collected data as a priority flow or a non-priority flow and collecting data associated with traffic on a network segment.

15. The network monitoring system of claim 1, wherein the allocation module further associates a timestamp indicating when the collected data was received by the flow processor with the collected data.

16. The network monitoring system of claim 15, wherein the allocation module receives the timestamp from a system external to the network monitoring system.

17. A method for monitoring network traffic comprising:

capturing data from a network segment;

partitioning a buffer into a priority queue and a non-priority queue;

associating the captured data with a priority flow or a non-priority flow;

responsive to associating the captured data with a priority flow, storing the captured data in the priority buffer and dynamically modifying a storage capacity of the priority buffer;

responsive to associating the captured data with a non-priority flow, storing the captured data in the non-priority queue and dynamically modifying a storage capacity of the non-priority buffer.

18. The method of claim 17, wherein dynamically modifying the storage capacity of the priority queue comprises:

reallocating storage capacity from the non-priority queue to the priority queue.

19. The method of claim 17, wherein dynamically modifying the storage capacity of the non-priority queue comprises:

reallocating storage capacity from the priority queue to the non-priority queue.

20. The method of claim 17, wherein dynamically modifying the storage capacity of the priority queue comprises:

determining a current amount of captured data associated with the priority flow;

comparing the current amount of captured data associated with the priority flow to a threshold value; and

responsive to the current amount of captured data associated with the priority flow exceeding the threshold value, increasing the capacity of the priority queue.

21. The method of claim 17, wherein associating the captured data with the priority flow or the non-priority flow comprises:

identifying a packet included in the captured data;

analyzing one or more fields of the packet; and

responsive to the analysis of the one or more fields of the packet, classifying the packet as a priority flow or a non-priority flow.

22. The method of claim 21, wherein the one or more fields of the packet comprise:

a prepended descriptor, a data link control header, a level 3 header or one or more higher-level headers.

23. The method of claim 17, wherein dynamically modifying the storage capacity of the non-priority queue comprises:

determining a current amount of captured data associated with the non-priority flow;

comparing the current amount of captured data associated with the non-priority flow to a threshold value; and

responsive to the current amount of captured data associated with the non-priority flow exceeding the threshold value, increasing the capacity of the non-priority queue.

24. The method of claim 17, wherein dynamically modifying the storage capacity of the priority queue comprises:

determining an average amount of data in the priority queue;

determining a current amount of data in the priority queue; and

responsive to the current amount of data in the priority queue exceeding the average amount of data in the priority queue, reclassifying data in the priority queue as a non-priority flow.

25. The method of claim 17, wherein dynamically modifying the storage capacity of the priority queue comprises:

determining an average amount of data in the priority queue;

comparing the average amount of data in the priority queue to a threshold; and

responsive to the current amount of data in the priority queue exceeding the threshold, reclassifying data in the priority queue as a non-priority flow.

26. The method of claim 17, wherein associating the captured data with the priority flow or the non-priority flow comprises:

determining whether the data includes one or more attributes associated with the priority flow.

27. The method of claim 17, further comprising:

transmitting data from the priority queue before transmitting data from the non-priority queue.

28. The method of claim 17, further comprising:

associating a timestamp with the collected data, wherein the timestamp is received from an external system.

29. A computer program product comprising a computer-readable medium having computer program instructions and data encoded thereon, the computer program instructions for executing the steps of:

capturing data from a network segment;

partitioning a buffer into a priority queue and a non-priority queue;

associating the captured data with a priority flow or a non-priority flow;

responsive to associating the captured data with a priority flow, storing the captured data in the priority buffer and dynamically modifying a storage capacity of the priority buffer;

responsive to associating the captured data with a non-priority flow, storing the captured data in the non-priority queue and dynamically modifying a storage capacity of the non-priority buffer.

30. The computer program product of claim 29, wherein dynamically modifying the storage capacity of the priority queue comprises:

reallocating storage capacity from the non-priority queue to the priority queue.

31. The computer program product of claim 29, wherein dynamically modifying the storage capacity of the non-priority queue comprises:

reallocating storage capacity from the priority queue to the non-priority queue.

32. The computer program product of claim 29, wherein dynamically modifying the storage capacity of the priority queue comprises:

determining a current amount of captured data associated with the priority flow;

comparing the current amount of captured data associated with the priority flow to a threshold value; and

responsive to the current amount of captured data associated with the priority flow exceeding the threshold value, increasing the capacity of the priority queue.

33. The computer program product of claim 29, wherein dynamically modifying the storage capacity of the non-priority queue comprises:

determining a current amount of captured data associated with the non-priority flow;

comparing the current amount of captured data associated with the non-priority flow to a threshold value; and

responsive to the current amount of captured data associated with the non-priority flow exceeding the threshold value, increasing the capacity of the non-priority queue.

34. The computer program product of claim 29, wherein dynamically modifying the storage capacity of the priority queue comprises:

determining an average amount of data in the priority queue;

determining a current amount of data in the priority queue; and

responsive to the current amount of data in the priority queue exceeding the average amount of data in the priority queue, reclassifying data in the priority queue as a non-priority flow.

35. The computer program product of claim 29, wherein dynamically modifying the storage capacity of the priority queue comprises:

determining an average amount of data in the priority queue;

comparing the average amount of data in the priority queue to a threshold; and

responsive to the current amount of data in the priority queue exceeding the threshold, reclassifying data in the priority queue as a non-priority flow.

36. The computer program product of claim 29, wherein associating the captured data with the priority flow or the non-priority flow comprises:

determining whether the data includes one or more attributes associated with the priority flow.

37. The computer program product of claim 29, further comprising:

transmitting data from the priority queue before transmitting data from the non-priority queue.