Distributed remote monitoring (dRMON) for networks

• US 6,108,782 A
• Filed: 06/24/1997
• Issued: 08/22/2000
• Est. Priority Date: 12/13/1996
• Status: Expired due to Term

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: 3Com Corporation (HP Inc.)
• Inventors: Banthia, Prakash, Fletcher, Rick
• Primary Examiner(s): Barron, Jr., Gilberto
• Application Number:
  US08/882,207
• Time in Patent Office: 1,155 Days
• Field of Search: 709/224, 709/235, 709/227, 709/230, 709/248, 370/252, 370/241, 370/245, 713/201, 713/202, 713/151, 713/153, 713/160, 713/162
• US Class Current: 713/153
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04J 3/0667 Bidirectional timestamps, e.g. NTP or PTP for compensation of clock drift and for compensation of propagation delays arrangements for monitoring round trip delays in packet switching networks H04L43/0864
• CPC Class Codes: H04L 2012/5626 Network management, e.g. Intelligent nets
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/042 comprising distributed management centres cooperatively managing the network
• CPC Class Codes: H04L 41/044 comprising hierarchical management structures
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/509 wherein the managed service relates to media content delivery, e.g. audio, video or TV
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic

Abstract

Distributed remote monitoring (dRMON) of network traffic and performance uses distributed nodes to collect traffic statistics at distributed points in the network. These statistics are forwarded to collectors which compile the statistics to create combined views of network performance. A collector may mimic a prior art, non-distributed, network probe and may interact with network management software as though it were a stand alone network probe thereby simplifying a user'"'"'s interaction with the distributed system. The invention is designed to work in accordance with a variety of standard network management protocols including SNMP, RMON, and RMON2 but is not limited to those environments. The invention has applications in a variety of communication system environments including local area networks, cable television distribution systems, ATM systems, and advanced telephony systems. A specific embodiment of the invention solves is particularly optimized to work in LAN environments with end systems running under Windows-compatible network operating systems.

Claims

1. A method for distributed collecting of network statistics comprising:

gathering network statistics at a plurality of nodes distributed in a network;

transmitting data containing said statistics to a collector;

combining said statistics from said plurality of nodes into group network statistics to form complied statistics;

reporting network performance data based on said compiled statistics, from said collector, to a network manager; and

wherein multiple nodes each respond to a multicast poll data unit from a collector and flooding of the collector is prevented by having each node delay its response by a random value.

2. The method according to claim 1 further comprising:

setting values at said collector to configure said collecting of network statistics; and

forwarding configuration data by said collector to said nodes to configure said gathering by said nodes.

3. The method according to claim 1 further comprising:

launching an agent in nodes participating in said distributing collecting, said agent being an executable module for gathering network statistics and communicating with said collector.

4. The method according to claim 1 wherein said compiled statistics are as defined in a standard defined for the gathering of network-wide performance statistics.

5. The method according to claim 1 further comprising:

capturing network data streams at said nodes; and

forwarding said captured data streams to said collector.

6. The method according to claim 4 wherein said compiled statistics are as defined by published RMON or RMON2 monitoring protocols.

7. The method according to claim 1 wherein a plurality of said nodes are end systems that provide network communications to a user.

8. The method according to claim 1 wherein a plurality of said nodes communicate using an ethernet protocol.

9. The method according to claim 1 wherein said collector communicates with said network manager using a first protocol, said first protocol being a higher layer protocol defined for the monitoring and management of networks and wherein said node communicates with said collector using a second protocol, said second protocol being a lower layer protocol that in unacknowledged and is specifically designed for lower layer network management communication.

10. The method according to claim 1 wherein said collector and said nodes communicate via a protocol in which:

statistics data from nodes to the collector is generated only in response to a poll packet received from a collector;

poll and response packets are not acknowledged or retransmitted;

nodes report all network statistics in terms of cumulative counters so that any failure of any poll or response packet does not result in erroneous data at the collector but merely results in a delay in the collector receiving the data.

11. The method according to claim 10 wherein said protocol further provides that node responses to a poll from a collector are complete in one data unit so that a received response from a node can be processed without depending that any other data unit be received.

12. The method according to claim 1 wherein said multiple nodes each respond to said multicast poll data unit from said collector and flooding of the collector is prevented by having each node delay its response by said random value, wherein said random value determined at each node and derived from an address of said node.

13. The method according to claim 1 wherein said multiple nodes each repeatedly respond to repeated multicast poll data units from said collector and flooding of the collector is prevented by having each node delay its response by said random value, wherein said random value determined at each node and derived from an address of said node and a changing value such that responses to a multicast poll data unit are redistributed with each poll.

14. The method according to claim 1 wherein a node and a collector each have embedded within them an identical password that is separately encrypted by different reversible algorithms and wherein said collector and said node unencrypt their identical passwords at run-time only said wherein said collector places said identical password in an initial poll data unit and wherein said node responds to that collector only if a password in a poll data unit matches its password.

15. The method according to claim 9 wherein said first protocol is a standard-based SNMP protocol allowing said collector to communicate with standard network management applications and said second protocol is a non-routed layer 2 protocol optimized for unacknowledged communication between a collector and a node.

16. The method according to claim 1 wherein said collector is a set of functions embedded within a network intermediate system.

17. The method according to claim 3 wherein said agent is a set of functions incorporated in other driver or system software installed in a node.

18. The method according to claim 1 further comprising:

transmitting data containing compiled statistics from said collector to a domain collector;

compiling statistics from a plurality of collectors at said domain collector; and

providing reports based on said compiled statistics, from said domain collector, to a network manager.

19. A method for distributed capture of data unit streams comprising:

capturing data units at a plurality of nodes distributed in a network;

encapsulating said captured units and transmitting said encapsulated data to a collector;

combining said captured units from said nodes into group capture channels;

reporting said group capture channels, from said collector, to a network manager; and

transmitting at periodic intervals from said collector to said nodes a synchronization data unit, said synchronization data unit representing an elapsed time at said collector;

using said synchronization data at said nodes to maintain a time at said nodes that is in synchronization with the time at said collector;

and time-stamping captured data at said nodes when said data is transmitted from said nodes;

said time-stamp representing an elapsed time at said node from when said data is received at said and when said encapsulated data is transmitted to said collector;

examining said time-stamp at said collector to determine and order said captured data units.

20. The method according to claim 19 further comprising:

setting values at said collector to configure capture channels for said data;

forwarding configuration data by said collector to said nodes to establish capture channels and filtering definitions; and

at said node, establishing capture channels resident on said node for storing said captured data units prior to encapsulating and transmitting said units to said collector.

21. The method according to claim 19 further comprising:

launching an agent in nodes participating in said distributed capture, said agent being an executable module for establishing capture channels, capturing packets, and communicating with said collector.

22. The method according to claim 19 wherein a plurality of said nodes are end systems that provide network communications to a user.

23. The method according to claim 19 wherein said collector communicates with said network manager using a first protocol, said first protocol being a higher layer protocol defined for the monitoring and management of networks and wherein said node communicates with said collector using a second protocol, said second protocol being a lower layer protocol that is flexibly either unacknowledged or acknowledged, has low overhead, and is specifically designed for lower layer network management communication.

24. The method according to claim 19 wherein said collector furthers examines a time stamp for captured data units and, where necessary, examines other protocol information in said data units to determine a correct order for said data units.

25. The method according to claim 19 wherein a node records the identity of all other nodes capable of performing distributed capture and only captures data if:

the data traffic is directed data traffic either to or from that one node; and

if the other node is either not capable of performing data capture or if the address of the other node indicates that said node is designated to perform packet capture.

26. The method according to claim 19 wherein a node transmits encapsulated data only in response to a poll signal from a collector.