System and method for correlating transaction messages in a communications network

• US 6,411,604 B1
• Filed: 06/05/1998
• Issued: 06/25/2002
• Est. Priority Date: 06/05/1998
• Status: Expired due to Term

• Current Assignee: NetScout Systems Texas, LLC (NetScout Systems Incorporated)
• Original Assignee: Inet Technologies, Inc. (Fortive Corp.)
• Inventors: Lin, Lisan, Brockman, Pierce Edward
• Primary Examiner(s): Nguyen, Chau
• Assistant Examiner(s): MEHRA, INDER P
• Application Number:
  US09/092,771
• Time in Patent Office: 1,481 Days
• Field of Search: 370/216, 370/217, 370/218, 370/219, 370/220, 370/221, 370/222, 370/223, 370/224, 370/225, 370/226, 370/227, 370/228, 370/241, 370/242, 370/243, 370/244, 370/245, 370/246, 370/247, 370/248, 370/249, 370/250, 370/251, 370/252, 370/253, 370/352, 370/384, 370/385, 370/389, 370/392, 370/400, 370/401, 370/394, 370/410, 370/522, 379/207, 379/230
• US Class Current: 370/244
• CPC Class Codes: H04M 3/2254 in networks
• CPC Class Codes: H04M 7/06 using auxiliary connections for control or supervision , e.g. where the auxiliary connection is a signalling system number 7 link
• CPC Class Codes: H04Q 2213/13176 Common channel signaling, CCS7
• CPC Class Codes: H04Q 3/5455 Multi-processor, parallelism, distributed systems

Abstract

A system and method for processing transaction signaling units is disclosed. A plurality of interlinked network monitoring devices capture signaling units on links in a communications network. The signaling units have unique transaction identifiers which correlate the signaling unit to a specific transaction. The monitoring devices comprise a number of processors, each of the transactions is assigned to a specific processor. The system collects all of the signaling units for each transactions and combine the signaling units into a plurality of transaction records. The processors are capable of correlating multiple detections of individual messages and sorting the individual signaling units into time order. A processor receives signaling units from the communications links and determines whether it is responsible for processing the transaction that corresponds to the signaling units. If the processor has been assigned the corresponding transaction, then the signaling unit is processed locally. Otherwise the signaling unit is forwarded to another processor either on the same monitor or on a different monitor. Signaling units can only be forwarded within each monitor once and they can only be transferred among the monitors once. A table comprising processing instructions for each transaction is maintained by each processor. The table is used to route each signaling unit to the proper processor for the corresponding transaction.

Claims

1. A method for correlating messages in an communications network having a plurality of nodes coupled by communications links, wherein messages pass between said nodes over said communications links, and

wherein a plurality of interlinked monitors are coupled to said communications links, said monitors capturing said messages on said communications links;

and said monitors capable of exchanging said messages;

wherein messages from one or more of said communications links are routed to a first monitor;

said method comprising the steps of;

forwarding said messages to a first processor on said first monitor;

sorting said messages in a first sort queue to generate sorted messages;

determining whether to process said sorted messages on said first processor;

processing a first group of sorted messages on said first processor;

forwarding a second group of sorted messages to a second processor on said first monitor; and

forwarding a third group of sorted messages to a second monitor.

2. The method of claim 1 further comprising the steps of:

receiving a fourth group of messages at said first processor from another processor on said first monitor;

determining whether to processes said fourth group of messages on said first processor;

processing a first portion of said fourth group of messages on said first monitor; and

sending a second portion of said fourth group of messages to said second monitor.

3. The method of claim 1 further comprising the steps of:

receiving a fifth group of messages at said first processor from another monitor;

determining whether to processes said fifth group of messages on said first processor;

processing a first portion of said fifth group of messages on said first monitor; and

sending a second portion of said fifth group of messages to said second processor on said first monitor.

4. The method of claim 1 further comprising the steps of:

receiving a fourth group of messages at said first processor from other processors on said first monitor;

determining whether to processes said fourth group of messages on said first processor;

processing a first portion of said fourth group of messages on said first monitor; and

sending a second portion of said fourth group of messages to other monitors;

receiving a fifth group of messages at said first processor from said other monitors;

determining whether to processes said fifth group of messages on said first processor;

processing a first portion of said fifth group of messages on said first monitor; and

sending a second portion of said fifth group of messages to said other processors on said first monitor.

5. The method of claim 4 further comprising the step of:

sorting messages to be processed on said first monitor in a second sort queue.

6. The method of claim 5 further comprising the step of:

forwarding messages from said second sort queue to one or more application processors.

7. The method of claim 6 further comprising the step of:

selecting application processors to receive said messages from said second sort queue based upon a transaction identifier in said messages.

8. The method of claim 1 wherein said determining step further comprises:

comparing a transaction identifier for received messages to transaction identifiers assigned to said first processor for processing.

9. The method of claim 7 further comprising the step of:

correlating said messages into transaction records, wherein said transaction records comprise ones of said received messages having a same transaction identifier.

10. The method of claim 9 further comprising the step of:

separating messages having a same transaction identifier into two or more transaction records if said transaction record has been used for different transactions at different times.

11. A system for correlating messages in an communications network having a plurality of nodes coupled by communications links, wherein messages pass between said nodes over said communications links, and

wherein a plurality of interlinked monitors are coupled to said communications links, said monitors capturing said messages on said communications links;

and said monitors capable of exchanging said messages;

wherein messages from one or more of said communications links are routed to a first monitor;

said system comprising;

means for forwarding said messages to a first processor on said first monitor;

means for sorting said messages to generate sorted messages;

means for determining whether to process said sorted messages on said first processor;

means for processing a first group of sorted messages on said first processor;

means for forwarding a second group of sorted messages to other processors on said first monitor; and

means for forwarding a third group of sorted messages to other monitors.

12. The system of claim 11 further comprising the steps of:

means for receiving a fourth group of messages at said first processor from other processors on said first monitor;

means for determining whether to processes said fourth group of messages on said first processor;

means for processing a first portion of said fourth group of messages on said first monitor; and

means for sending a second portion of said fourth group of messages to other monitors.

13. The system of claim 11 further comprising:

means for receiving a fifth group of messages at said first processor from other monitors;

means for determining whether to processes said fifth group of messages on said first processor;

means for processing a first portion of said fifth group of messages on said first monitor; and

means for sending a second portion of said fifth group of messages to other processors on said first monitor.

14. The system of claim 11 further comprising:

means for receiving a fourth group of messages at said first processor from other processors on said first monitor;

means for determining whether to processes said fourth group of messages on said first processor;

means for processing a first portion of said fourth group of messages on said first monitor; and

means for sending a second portion of said fourth group of messages to other monitors;

means for receiving a fifth group of messages at said first processor from said other monitors;

means for determining whether to processes said fifth group of messages on said first processor;

means for processing a first portion of said fifth group of messages on said first monitor; and

means for sending a second portion of said fifth group of messages to said other processors on said first monitor.

15. The system of claim 14 further comprising:

second means for sorting messages to be processed on said first monitor.

16. The system of claim 15 further comprising:

means for forwarding messages from said second sort means to one or more application processors.

17. The system of claim 16 further comprising:

means for selecting application processors to receive said messages from said second sort means based upon a transaction identifier in said messages.

18. The system of claim 11 wherein said determining means further comprises:

means for comparing a transaction identifier for received messages to transaction identifiers assigned to said first processor for processing.

19. The system of claim 17 further comprising:

means for correlating said messages into transaction records, wherein said transaction records comprise ones of said received messages having a same transaction identifier.

20. The system of claim 19 further comprising:

means for separating messages having a same transaction identifier into two or more transaction records if said transaction record has been used for different transactions at different times.

21. A computer readable medium having a computer program thereon for use in a system for correlating messages in a communications network having a plurality of nodes coupled by communications links, wherein messages pass between said nodes over said communications links, and

wherein a plurality of interlinked monitors are coupled to said communications links, said monitors capturing said messages on said communications links;

and said monitors capable of exchanging said messages;

wherein messages from one or more of said communications links are routed to a first monitor;

said computer readable medium comprising;

means for sorting messages received from said communications links to generate sorted messages;

means for determining whether to process said sorted messages on said first processor;

means for processing a first group of sorted messages on said first processor;

means for forwarding a second group of sorted messages to other processors on said first monitor; and

means for forwarding a third group of sorted messages to other monitors.

22. The computer readable medium of claim 21 further comprising:

means for receiving a fourth group of messages at said first processor from other processors on said first monitor;

means for determining whether to processes said fourth group of messages on said first processor;

means for processing a first portion of said fourth group of messages on said first monitor; and

means for sending a second portion of said fourth group of messages to other monitors.

23. The computer readable medium of claim 21 further comprising:

means for receiving a fifth group of messages at said first processor from other monitors;

means for determining whether to processes said fifth group of messages on said first processor;

means for processing a first portion of said fifth group of messages on said first monitor; and

means for sending a second portion of said fifth group of messages to other processors on said first monitor.

24. The computer readable medium of claim 21 further comprising:

means for receiving a fourth group of messages at said first processor from other processors on said first monitor;

means for determining whether to processes said fourth group of messages on said first processor;

means for processing a first portion of said fourth group of messages on said first monitor; and

means for sending a second portion of said fourth group of messages to other monitors;

means for receiving a fifth group of messages at said first processor from said other monitors;

means for determining whether to processes said fifth group of messages on said first processor;

means for processing a first portion of said fifth group of messages on said first monitor; and

means for sending a second portion of said fifth group of messages to said other processors on said first monitor.

25. The computer readable medium of claim 24 further comprising:

second means for sorting messages to be processed on said first monitor.

26. The computer readable medium of claim 25 further comprising:

means for forwarding messages from said second sort means to one or more application processors.

27. The computer readable medium of claim 26 further comprising:

means for selecting application processors to receive said messages from said second sort means based upon a transaction identifier in said messages.

28. The computer readable medium of claim 21 wherein said determining means further comprises:

means for comparing a transaction identifier for received messages to transaction identifiers assigned to said first processor for processing.

29. The system of claim 27 further comprising:

means for correlating said messages into transaction records, wherein said transaction records comprise ones of said received messages having a same transaction identifier.

30. The system of claim 29 further comprising:

means for separating messages having a same transaction identifier into two or more transaction records if said transaction record has been used for different transactions at different times.