Real-Time Network Monitoring and Subscriber Identification with an On-Demand Appliance

• US 20130322242A1
• Filed: 05/31/2013
• Published: 12/05/2013
• Est. Priority Date: 06/01/2012
• Status: Active Grant

• Current Assignee: Otello Corp. ASA
• Original Assignee: Skyfire Labs Inc. (Otello Corp. ASA)
• Inventors: Swenson, Erik R., Bhandari, Nitin
• Granted Patent: US 8,792,347 B2
• Time in Patent Office: Days
• US Class Current: 370/232
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 47/12 Avoiding congestion; Recovering from congestion
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/823 Prediction of resource usage
• CPC Class Codes: H04L 47/83 based on usage prediction
• CPC Class Codes: H04N 21/64738 Monitoring network characteristics, e.g. bandwidth, congestion level data switched network analysis H04L41/14; monitoring functioning in data switched networks H04L43/0817; flow control in packet networks H04L47/10
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 24/10 Scheduling measurement reports ; Arrangements for measurement reports
• CPC Class Codes: H04W 28/06 Optimizing the usage of the radio link, e.g. header compression, information sizing , discarding information system modifying transmission characteristic according to link quality by modifying frame length H04L1/0007; dynamic adaptation of the packet size for flow control or congestion control H04L47/365

Abstract

A system and a method are disclosed for selectively monitoring traffic in a service provider network. The system receives a notice for a beginning of a network data flow, which responds to a request from a user device for content at an origin server. The system then determines whether to monitor the data flow from the origin server to the user device. If so determined, the system collects statistic information of the data flow and stores the statistic information to a flow record in a database. The system also maps the flow record to a subscriber of the service provider network by analyzing the statistic information of the data flow and estimates bandwidth provided to the data flow by the service provider'"'"'s network based on the analysis of the statistic information of the data flow.

Claims

1. A method for selectively monitoring traffic in a service provider network, the method comprising:

receiving a notice for a beginning of a network data flow from an origin server to a user device, the data flow responsive to a request for content from a requesting user device;

determining, by a processor, whether to monitor the data flow from the origin server to the user device;

responsive to a determination to monitor the data flow, collecting statistic information of the flow;

storing the statistic information of the data flow to a flow record in a database;

mapping the flow record to a user of the service provider network by analyzing the statistic information of the data flow; and

estimating bandwidth provided to the data flow by the service provider'"'"'s network based on the analysis of the statistic information of the data flow.

2. The method of claim 1, wherein determining whether to monitor the data flow comprises determining whether the content in the data flow contains video and/or images larger than a predetermined size.

3. The method of claim 1, wherein the statistical information of the data flow include throughput, latency, size and duration of the flow.

4. The method of claim 1, wherein the flow record comprises at least one of:

user source IP address, subscriber identifier, estimated bandwidth, cookie hashes, flow identifier, and transmitted and received bytes, and wherein the flow record is updated during a lifespan of the data flow.

5. The method of claim 1, wherein estimating the bandwidth provided to the data flow comprises:

receiving an update on the transmitted or received bytes to the flow record; and

calculating the bandwidth by dividing a difference between the transmitted or received bytes since last update by an interval of time since the last update.

6. The method of claim 1, further comprising:

summing up the estimated bandwidth of all data flows in the service provider network; and

determining a congestion level of the network by comparing the sum of bandwidth of all data flows against a list of utilized bitrate ranges of the service provider network.

7. The method of claim 6, further comprising:

determining whether to optimize a data flow based on the congestion level of the network and a size of the content in the data flow; and

redirecting the content request from the requesting user device to a video optimizer to retrieve the content, wherein the video optimizer retrieves the content from the origin server, optimizes the content for the user device, and transmits the optimized content to the user device.

8. The method of claim 1, wherein mapping the flow record to a subscriber of the service provider network is based on at least one of:

user source IP address and MAC address, TCP port number, and hashes of a cookie associated with the data flow.

9. The method of claim 1, further comprising:

aggregating one or more flow records mapped to a same subscriber in the database;

storing the aggregated one or more flow records to the subscriber'"'"'s historical flow records; and

estimating historical bandwidth provided to the subscriber by the service provider'"'"'s network based on the analysis of the subscriber'"'"'s historical flow records.

10. A non-transitory computer-readable storage medium storing executable computer program instructions for selectively monitoring traffic in a service provider network, the computer program instructions comprising instructions for:

receiving a notice for a beginning of a network data flow from an origin server to a user device, the data flow being a response to a request for content from a requesting user device;

determining, by a processor, whether to monitor the data flow from the origin server to the user device;

responsive to a determination to monitor the data flow, collecting statistic information of the flow;

storing the statistic information of the data flow to a flow record in a database;

mapping the flow record to a user of the service provider network by analyzing the statistic information of the data flow; and

estimating bandwidth provided to the data flow by the service provider'"'"'s network based on the analysis of the statistic information of the data flow.

11. The non-transitory computer-readable storage medium of claim 10, wherein determining whether to monitor the data flow comprises determining whether the content in the data flow contains video and/or images larger than a predetermined size.

12. The non-transitory computer-readable storage medium of claim 10, wherein the statistical information of the data flow include throughput, latency, size and duration of the flow.

13. The non-transitory computer-readable storage medium of claim 10, wherein the flow record comprises at least one of:

user source IP address, subscriber identifier, estimated bandwidth, cookie hashes, flow identifier, and transmitted and received bytes, and wherein the flow record is updated during a lifespan of the data flow.

14. The non-transitory computer-readable storage medium of claim 10, wherein estimating the bandwidth provided to the data flow comprises:

receiving an update on the transmitted or received bytes to the flow record; and

calculating the bandwidth by dividing a difference between the transmitted or received bytes since last update by an interval of time since the last update.

15. The non-transitory computer-readable storage medium of claim 10, the computer program instruction further comprising instruction for:

summing up the estimated bandwidth of all data flows in the service provider network; and

determining a congestion level of the network by comparing the sum of bandwidth of all data flows against a list of utilized bitrate ranges of the service provider network.

16. The non-transitory computer-readable storage medium of claim 15, the computer program instruction further comprising instruction for:

determining whether to optimize a data flow based on the congestion level of the network and a size of the content in the data flow; and

redirecting the content request from the requesting user device to a video optimizer to retrieve the content, wherein the video optimizer retrieves the content from the origin server, optimizes the content for the user device, and transmits the optimized content to the user device.

17. The non-transitory computer-readable storage medium of claim 10, wherein mapping the flow record to a subscriber of the service provider network is based on at least one of:

user source IP address and MAC address, TCP port number, and hashes of a cookie associated with the data flow.

18. The non-transitory computer-readable storage medium of claim 10, the computer program instruction further comprising instruction for:

aggregating one or more flow records mapped to a same subscriber in the database;

storing the aggregated one or more flow records to the subscriber'"'"'s historical flow records; and

estimating historical bandwidth provided to the subscriber by the service provider'"'"'s network based on the analysis of the subscriber'"'"'s historical flow records.

19. A system for selectively monitoring traffic in a service provider network, comprising:

a processor; and

a non-transitory computer-readable storage medium storing executable computer program instructions for;

receiving a notice for a beginning of a network data flow from an origin server to a user device, the data flow being a response to a request for content from a requesting user device;

determining, by a processor, whether to monitor the data flow from the origin server to the user device;

responsive to a determination to monitor the data flow, collecting statistic information of the flow;

storing the statistic information of the data flow to a flow record in a database;

mapping the flow record to a subscriber of the service provider network by analyzing the statistic information of the data flow; and

estimating bandwidth provided to the data flow by the service provider'"'"'s network based on the analysis of the statistic information of the data flow.

20. The system of claim 19, wherein the system collects statistic information of the flow as an inline network element that receives and forwards the data flow.

21. The system of claim 19, wherein the system collects statistic information from another inline network element that receives and forwards the data flow.

22. The system of claim 19, wherein the executable computer program instructions further comprising instruction for:

summing up the estimated bandwidth of all data flows in the service provider network; and

determining a congestion level of the network by comparing the sum of bandwidth of all data flows against a list of utilized bitrate ranges of the service provider network.

23. The system of claim 19, wherein the executable computer program instructions further comprising instruction for:

determining whether to optimize a data flow based on the congestion level of the network and a size of the content in the data flow; and

redirecting the content request from the requesting user device to a video optimizer to retrieve the content, wherein the video optimizer retrieves the content from the origin server, optimizes the content for the user device, and transmits the optimized content to the user device.

24. The system of claim 23, wherein the executable computer program instructions further comprising instruction for:

aggregating one or more flow records mapped to a same subscriber in the database;

storing the aggregated one or more flow records to the subscriber'"'"'s historical flow records; and

estimating historical bandwidth provided to the subscriber by the service provider'"'"'s network based on the analysis of the subscriber'"'"'s historical flow records.