NETWORK TRAFFIC MONITORING

• US 20130322266A1
• Filed: 05/29/2012
• Published: 12/05/2013
• Est. Priority Date: 05/29/2012
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Maon, Sigal, Manor, Lior
• Granted Patent: US 9,276,819 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/18 Protocol analysers

Abstract

A network traffic monitoring method includes generating packet information for packets destined for a target subnet. The method includes identifying network connections associated with an application running on a device based on socket activities performed by the application. The method further includes filtering out network traffic information between the application and the target subnet based on the identified network connections and the packet information.

Claims

1. A network traffic monitoring method, comprising:

generating packet information for packets destined for a target subnet;

identifying network connections associated with an application running on a device, based on socket activities performed by the application;

filtering out network traffic information between the application and the target subnet based on the identified network connections and the packet information.

2. The method of claim 1, further comprising communicating the network traffic information.

3. The method of claim 1, wherein generating the packet information and identifying the network connections occur substantially concurrently.

4. The method of claim 1, wherein generating the packet information comprises:

monitoring packet traffic between the device and a plurality of subnets including the target subnet; and

generating packet information for each of the plurality of subnets based on the monitored packet traffic.

5. The method of claim 1, wherein identifying the network connections comprises detecting socket activities performed by the application and by sub-processes of the application.

6. The method of claim 1, wherein the network traffic information indicates an amount of network traffic between the application and the target subnet.

7. The method of claim 6, wherein the network traffic information further includes a direction of the network traffic between the application and the target subnet.

8. The method of claim 7, wherein the network traffic information indicates an amount of outgoing traffic from the application to the target subnet.

9. The method of claim 7, wherein the network traffic information includes an amount of incoming traffic from the target subnet to the application.

10. The method of claim 1, wherein the packet information inc ides packet header information and packet size information.

11. The method of claim 1, the socket activities include at least one of socket creation and socket deletion.

12. The method of claim 11, wherein the socket activities include at least one of socket creation time and socket deletion time.

13. A non-transitory computer readable medium comprising instructions that, when executed by a processor, cause the processor to:

generate packet information for packets sent to a target subnet;

identify network connections associated with an application based on socket activities of the application; and

filter out network traffic information between the application and the target subnet from the identified network connections and packet information.

14. The non-transitory computer readable medium of claim 13, further comprising instructions executable by the processor to detect socket activities performed by the application and by sub-processes of the application.

15. The non-transitory computer readable medium of claim 13, further comprising instructions executable by the processor to:

monitor packet traffic between a device and a plurality of subnets including the target subnet; and

generate packet information for each of the plurality of subnets from the monitored network traffic, the generated packet information including packet information associated with the target subnet.

16. The non-transitory computer readable medium of claim 13, further comprising instructions executable by the processor to communicate the network traffic information.

17. The non-transitory computer readable medium of claim 16, wherein the network traffic information includes an amount of outgoing traffic from the application to the target subnet and an amount of incoming traffic from the target subnet to the application.

18. A network traffic monitoring system comprising:

a network sniffer engine to generate packet information for packet traffic to a target subnet;

a hook engine to identify network connections associated with an application running on a device based on socket activities of the application; and

a filter engine to filter out network traffic information between the application and the target subnet based on the identified network connections and packet information corresponding to the target subnet.

19. The system of claim 18, the network sniffer engine comprising:

a packet monitor engine to monitor packet traffic between the device and a plurality of subnets including the target subnet; and

an extraction engine to extract packet information for packets sent to the plurality of subnets including the target subnet.

20. The system of claim 18, the hook engine comprising:

a breakpoint trigger engine to insert breakpoint triggers into the application, the breakpoint triggers to detect socket activities performed by the application and by sub-processes of the application; and

a socket activity extraction engine to record the detected socket activities.

21. The system of claim 18, the network monitor further comprising a communication engine to communicate a count of outgoing network traffic from the application to the target subnet and a count of incoming network traffic from the target subnet to the application, based on the network traffic information.