Utilizing Packet Headers To Monitor Network Traffic In Association With A Client Device

• US 20160088125A1
• Filed: 10/27/2014
• Published: 03/24/2016
• Est. Priority Date: 09/19/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Polychronis, Konstantinos
• Granted Patent: US 9,838,292 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Various methods and systems for facilitating network traffic monitoring in association with an application running on a client device are provided. In this regard, aspects of the invention facilitate monitoring network traffic being transmitted to and/or from a client device, such as a mobile device, so that network performance can be analyzed. In various implementations, packet headers of data packets are read to obtain or extract desired network metrics that indicate network performance. Packet headers are generally read to the extent necessary to identify various network data. As such, by avoiding examination of a packet payload and, in some cases, examination of the entire header, the efficiency of monitoring network traffic at a client device is improved.

Claims

1. A method for monitoring network traffic, the method comprising:

obtaining a data packet being communicated to or from an application running on a device;

reading a packet header of the packet to obtain a predetermined set of network data that indicate information associated with a network; and

providing the network data obtained from the packet header for use in analyzing performance of the application.

2. The method of claim 1, wherein the application is a mobile application running on the device.

3. The method of claim 1, wherein the data packet is being communicated to a remote application server associated with the application or from the remote application server associated with the application.

4. The method of claim 1, wherein the packet header of the packet is read in its entirety to obtain the predetermined set of network data without reading a remainder of the packet.

5. The method of claim 1, wherein the packet header of the packet is read only to an extent necessary to obtain the predetermined set of network data.

6. The method of claim 5, wherein upon obtaining each of the predetermined set of network data within the packet header, the method further comprises discontinuing reading the remainder of the packet header.

7. The method of claim 1 further comprising:

determining that each of the predetermined set of network data are in the packet header; and

based on the determination that each of the predetermined set of network data are in the packet header, discontinuing reading the remainder of the packet and proceeding to read a next packet header associated with another packet.

8. The method of claim 1 further comprising:

determining that each of the predetermined set of network data are not in the packet header; and

based on the determination that each of the predetermined set of network data are not in the packet header, reading the payload of the packet to obtain the at least one of the predetermined set of network data not in the packet header.

9. The method of claim 8, wherein the payload of the packet is only read when the at least one of the predetermined set of network data comprises a packet size.

10. The method of claim 8, wherein the payload is read only to the extent necessary to obtain the at least one of the predetermined set of network data not in the packet header.

11. The method of claim 1 further comprising providing a null or zero value for any network data not obtained from the packet header.

12. The method of claim 1, wherein the network data is provided to an analytics server.

13. The method of claim 12, wherein the analytics server uses the network data to generate one or more network metrics indicating performance of the network in association with the application.

14. The method of claim 13, wherein at least one of the one or more network metrics indicate a latency, a bandwidth, a throughput, a jitter variation, or an error rate.

15. The method of claim 1 further comprising determining whether each of the predetermined set of network data are in the packet header, wherein

when each of the predetermined set of network data are in the packet header, proceeding to read a next packet header associated with another packet, and

when at least one of the predetermined set of network data is not in the packet header, reading the payload of the packet to obtain the at least one of the predetermined set of network data not in the packet header.

16. The method of claim 1, wherein one or more classes are used to facilitate the method of claim, each of the one or more classes being a custom class incorporated with the application via a plug-in.

17. The method of claim 16, wherein the plug-in is initiated via the application in accordance with a network monitor trigger that triggers activation of the plug-in.

18. The method of claim 17, wherein the network monitor trigger comprises one line of code that triggers activation of the plug-in in accordance with the application being launched.

19. The method of claim 1, wherein the predetermined set of network data comprises a uniform resource locator (URL), a connection type, a connection start time, a connection end time, a http status code, a request length, a response length, a request headers, a response headers, or a combination thereof.

20. The method of claim 1, wherein the device is a mobile device.

21. The method of claim 1, wherein the device is a non-mobile device.

22. The method of claim 1, wherein the device comprises a mobile device having an Android-based platform.

23. A system for monitoring network traffic, the system comprising:

one or more data processors; and

one or more computer-readable storage media containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including;

obtaining a data packet being communicated to or from an application running on a device;

reading a packet header of the packet to obtain a predetermined set of network data that indicate information associated with a network; and

providing the network data obtained from the packet header for use in analyzing performance of the application.

24. The system of claim 23, wherein the device comprises a mobile device.

25. The system of claim 23, wherein the packet header of the packet is read in its entirety to obtain the predetermined set of network data without reading a remainder of the packet.

26. The system of claim 23, wherein the packet header of the packet is read only to an extent necessary to obtain the predetermined set of network data.

27. The system of claim 26, wherein upon obtaining each of the predetermined set of network data within the packet header, the method further comprises discontinuing reading the remainder of the packet header.

28. The system of claim 23 further comprising:

determining that each of the predetermined set of network data are in the packet header; and

based on the determination that each of the predetermined set of network data are in the packet header, discontinuing reading a remainder of the packet and proceeding to read a next packet header associated with another packet.

29. The system of claim 23 further comprising:

determining that each of the predetermined set of network data are not in the packet header; and

based on the determination that each of the predetermined set of network data are not in the packet header, reading the payload of the packet to obtain the at least one of the predetermined set of network data not in the packet header.

30. One or more computer-storage media storing computer-executable instructions that, when executed by a computing device, perform a method for monitoring network traffic, the method comprising:

obtaining a data packet being communicated to or from an application running on a device;

reading a packet header of the packet to obtain a predetermined set of network data that indicate information associated with a network; and

providing the network data obtained from the packet header for use in analyzing performance of the application.