Network Analysis System and Method

• US 20100135186A1
• Filed: 02/08/2010
• Published: 06/03/2010
• Est. Priority Date: 01/24/2005
• Status: Active Grant

• Current Assignee: Daintree Networks Pty Ltd. (GE Aerospace)
• Original Assignee: Daintree Networks Pty Ltd. (GE Aerospace)
• Inventors: Barron, Gregory Joseph, van Gerrevink, Dean, Choong, Jason Yew Choo, Cobb, Peter Graeme, Wood, William Raymond
• Granted Patent: US 8,370,483 B2
• Time in Patent Office: Days
• US Class Current: 370/253
• CPC Class Codes: H04L 1/1835 Buffer management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/34 Signalling channels for network management communication
• CPC Class Codes: H04L 41/344 Out-of-band transfers
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 40/00 Communication routing or communication path finding
• CPC Class Codes: H04W 80/02 Data link layer protocols

Abstract

A system for analyzing a packet-based network includes a wireless network analysis processing device that is configured to receive correlated packet records representative of the order in which corresponding packets are transmitted in a wireless network. The correlated packet records include media access control (MAC) layer data and network layer data for each corresponding packet. The MAC layer data and network layer data are processed to generate network topology data representative of the network topology, generate packet flow data representative of the flow of packets between devices at the MAC layer and across the network at the network layer, and measurement data relating to the packet flow data.

Claims

1. A packet-based network analysis system for analyzing packet flow among devices in a wireless network, comprising:

a wireless network analysis processing device configured to;

receive a plurality of correlated packet records, the correlated packet records representative of the order in which corresponding packets were transmitted in the network and including media access control (MAC) layer data, application layer data, and network layer data for each corresponding packet;

process the MAC layer data and network layer data to generate network topology data representative of the network topology, generate packet flow data representative of the flow of packets between devices at the MAC layer and across the network at the network layer, and generate measurement data relating to the packet flow data; and

process the APS layer data to generate endpoint data and binding data, the endpoint data identifying source endpoints and destination endpoints identified by the correlated packet records and associating each respective source endpoint and destination endpoint with a corresponding device in the network and a corresponding application layer functionality, and the binding data defining a logical link between a source endpoint and cluster identifier and a destination endpoint.

2. The packet-based network analysis system of claim 1, wherein:

the wireless network analysis processing device is configured to;

identify packet streams based on a source network layer address and a destination network layer address.

3. The packet-based network analysis system of claim 2, wherein:

the wireless network analysis processing device is configured to;

compare a source MAC address and a destination MAC address to the source network layer address and the destination network layer address to generate packet flow data for the packet streams.

4. The packet-based network analysis system of claim 1, wherein:

the packet flow data comprises packet flow records, and the wireless network analysis processing device is configured to;

create a new packet flow record and add packet flow data corresponding to a first hop of a packet in the network if the source MAC address matches the source network address in a corresponding correlated packet record;

add packet flow data corresponding to a last hop of a packet in the network to a packet flow record if the destination MAC address matches the destination network address in a corresponding correlated packet record; and

add packet flow data corresponding to an intermediate hop of a packet in the network to a packet flow record if the destination MAC address does not match the destination network address and the source MAC address does not match the source network address in a corresponding correlated packet record.

5. The packet-based network analysis system of claim 1, wherein the network comprises a ZigBee network.

6. The packet-based network analysis system of claim 1, further comprising:

a correlator processor configured to;

receive packet records corresponding to packets communicated over the network and store the packet records in a data store; and

generate the correlated packet records from the packet records stored in the data store, the correlated packet records comprising hop data and timing data representative of the packet path and packet transmission times in the network for each corresponding packet, the correlated packet records filtered of packet records for duplicate packet transmissions and packet retransmissions.

7. The packet-based network analysis system of claim 6, further comprising:

a plurality of capture devices configured to monitor packets communicated over the network and create the corresponding packet records, and wherein each capture device includes a capture clock and each capture device is further configured to include a timestamp in each packet record corresponding to the capture clock time the capture device detects the start of frame of a packet.

8. The packet-based network analysis system of claim 7, wherein:

the correlator is configured to timestamp synchronize the packet records stored in the data store and received packet records by designating a first capture device as a master capture device and time synchronize packet records received from other capture devices to the master capture device.

9. A packet-based network analysis device for analyzing packet flow among devices in a wireless network, comprising:

a data store;

a communication subsystem; and

a processing subsystem in data communication with the communication subsystem and the data store;

wherein the packet-based network analysis device is configured to;

receive a plurality of correlated packet records, the correlated packet records representative of the order in which corresponding packets were transmitted in the network and including media access control (MAC) layer data, application layer data, network layer data, and packet data for each corresponding packet;

detect new network objects and network topology changes based on the correlated packet records;

extract network object information from the correlated packet records;

generate packet flow data representative of the flow of packets between the network objects; and

generate endpoint data and binding data from the correlated packet records, the endpoint data identifying source endpoints and destination endpoints identified by the correlated packet records and associating each respective source endpoint and destination endpoint with a corresponding network object in the network and a corresponding application layer functionality, and the binding data defining a logical link between a source endpoint and cluster identifier and a destination endpoint.

10. The packet-based network analysis device of claim 9, wherein:

the packet-based network analysis device is configured to;

detect packet exchanges from the correlated packet records corresponding to an association request frame and a reply to the association request frame to detect new network objects and network topology changes.

11. The packet-based network analysis device of claim 10, wherein:

the packet-based network analysis device is configured to;

identify packet streams based on a source network layer address and a destination network layer address; and

compare a source MAC address and a destination MAC address to the source network layer address and the destination network layer address and detect a packet flow path of packets through the network for each stream based on the comparison.

12. The packet-based network analysis device of claim 11, wherein:

the packet-based network analysis device is configured to;

create a new packet flow record and add packet flow data corresponding to a first hop of a packet in the network if the source MAC address matches the source network address in a corresponding correlated packet record;

add packet flow data corresponding to a last hop of a packet in the network to a packet flow record if the destination MAC address matches the destination network address in a corresponding correlated packet record; and

add packet flow data corresponding to an intermediate hop of a packet in the network to a packet flow record if the destination MAC address does not match the destination network address and the source MAC address does not match the source network address in a corresponding correlated packet record.

13. A computer-implemented method for analyzing packet flow among devices in a wireless mesh network, comprising:

receiving a plurality of correlated packet records, the correlated packet records representative of the order in which corresponding packets were transmitted in the network and including media access control (MAC) layer data, application layer data and network layer data for each corresponding packet;

generating network topology data representative of the network topology;

generating packet flow data representative of the flow of packets between devices at the MAC layer and across the network at the network layer;

generating application layer endpoint data identifying source endpoints and destination endpoints identified by the correlated packet records and associating each respective source endpoint and destination endpoint with a corresponding device in the network and a corresponding application layer functionality; and

generating endpoint bindings data defining bindings between the source endpoints and the destination endpoints, each binding being a logical link between a source endpoint and cluster identifier and destination endpoint.

14. The method of claim 13, wherein:

generating network topology data representative of the network topology comprises;

identifying new devices in the network from packets in the correlated packet records related to an association request; and

associating the new devices with the network topology according to a device association established by the association request.

15. The method of claim 14, wherein:

generating packet flow data representative of the flow of packets between devices at the MAC layer and across the network at the network layer comprises;

identifying packet streams based on a source network layer address and a destination network layer address; and

detecting packet flow path of packets through the network for each stream.

16. The method of claim 14, wherein:

generating endpoint bindings data for endpoints between the source endpoints and the destination endpoints comprises;

generating direct bindings data related to direct bindings, direct bindings based on packets transmitted between devices associated with source endpoint addresses and destination endpoint addresses; and

generating indirect bindings data related to indirect bindings, the indirect bindings based on packets transmitted between a coordinator device storing a binding table defining associations of devices associated with source endpoint addresses and destination endpoint addresses.

17. A packet-based network analysis device for analyzing packet flow among devices in a wireless network, comprising:

means for receiving a plurality of correlated packet records, the correlated packet records representative of the order in which corresponding packets were transmitted in the network and including media access control (MAC) layer data and network layer data for each corresponding packet;

means for generating network topology data representative of the network topology;

means for generating packet flow data representative of the flow of packets between devices at the MAC layer and across the network at the network layer;

means for generating measurement data relating to the packet flow data;

means for generating application layer endpoint data identifying source endpoints and destination endpoints identified by the correlated packet records and associating each respective source endpoint and destination endpoint with a corresponding device in the network and a correspond application layer functionality; and

means for generating endpoint bindings between the source endpoints and the destination endpoints, each binding being a logical link between a source endpoint and cluster identifier and destination endpoint.