METHOD AND SYSTEM FOR NETWORK MONITORING USING SIGNATURE PACKETS

• US 20130212439A1
• Filed: 02/15/2013
• Published: 08/15/2013
• Est. Priority Date: 02/15/2012
• Status: Active Grant

• Current Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Original Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Inventors: Stevens, Michael, D'Eletto, Robert
• Granted Patent: US 9,141,506 B2
• Time in Patent Office: Days
• US Class Current: 714/39
• CPC Class Codes: G06F 11/3065 Monitoring arrangements determined by the means or processing involved in reporting the monitored data error or fault reporting or logging G06F11/0766
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method of monitoring a network with a test device connected to the network includes monitoring a plurality of packets which pass through the test device, comparing a predefined field of each of the plurality of packets to a predefined pattern so as to identify signature packets, evaluating whether the signature packets satisfy a predefined condition, and, if the predefined condition is satisfied, sending a notification to a user. A system implementing the method is provided.

Claims

1. A method of monitoring a network with a test device connected to the network, comprising:

monitoring a plurality of packets which pass through the test device,

comparing a predefined field of each of the plurality of packets to a predefined pattern so as to identify signature packets,

evaluating whether the signature packets satisfy a predefined condition, and, when the predefined condition is satisfied, sending a notification to a user.

2. The method as defined in claim 1, wherein each of the signature packets includes at least two QoS fields, and the evaluating step comprises determining whether a combination of values in the QoS fields is a permitted combination.

3. The method as defined in claim 2 wherein the signature packets are MPLS packets.

4. The method as defined in claim 2 wherein the signature packets are VLAN packets.

5. The method as defined in claim 4 wherein the signature packets are MPLS/VLAN packets.

6. The method as defined in claim 1, wherein the step of evaluating comprises determining whether a number of signature packets which are out of order is above a predefined threshold.

7. The method as defined in claim 1, wherein the step of evaluating comprises determining whether a difference between a number of the signature packets identified at the test device and a number of signature packets identified at another test device is above a predefined threshold.

8. The method as defined in claim 1, wherein the step of evaluating comprises determining whether a delay between receiving one of the signature packets at the test device and at another test device is above a predefined threshold.

9. The method as defined in claim 1, wherein the step of evaluating comprises determining whether time passed after receiving a latest of the signature packets is greater than a predefined threshold.

10. The method as defined in claim 9, wherein the signature packets are DHCP renewal packets.

11. The method as defined in claim 1, wherein the signature packets are test packets with a predefined pattern in a payload.

12. The method as defined in claim 1, wherein the step of evaluating comprises determining whether a number of the signature packets received within a predefined time interval is below a predefined threshold.

13. A system implementing the method defined in claim 1.

14. A non-transitory computer-readable medium which includes computer program instructions that cause a computer system to execute the method defined in claim 1.

15. A system for monitoring a network, comprising:

a plurality of sensors, each programmed to capture a plurality of packets passing therethrough, and a monitoring manager programmed to send a notification to a user;

wherein the system is programmed to

(a) compare a predefined field of each of the plurality of packets to a predefined pattern stored in a tangible memory so as to identify signature packets,

(b) evaluate whether the signature packets satisfy a predefined condition, and,

(c) send the notification if the predefined condition is satisfied; and

,

wherein either the sensors are programmed to perform steps (a) and (b), or the monitoring manager is programmed to perform steps (a) and (b), or the sensors are programmed to perform step (a) and the monitoring manager is programmed to perform step (b).