Real-time analysis through capture buffer with real-time historical data correlation

• US 6,526,044 B1
• Filed: 06/29/1999
• Issued: 02/25/2003
• Est. Priority Date: 06/29/1999
• Status: Expired due to Term

• Current Assignee: Wandel & Goltermann Technologies, Inc. (Lumentum Holdings Inc.)
• Original Assignee: Wandel & Goltermann Technologies, Inc. (Lumentum Holdings Inc.)
• Inventors: Cookmeyer, Eugene N. II, Novak, Jay E.
• Primary Examiner(s): CANGIALOSI, SALVATORE A
• Application Number:
  US09/342,384
• Time in Patent Office: 1,337 Days
• Field of Search: 370/252, 707/10
• US Class Current: 370/352
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/18 Protocol analysers

Abstract

A knowledge based system uses a protocol analyzer which acquires real time statistical data on network signal traffic in a monitoring session and reports a session performance history as a real time composite of measured statistics and analysis-derived statistics, together with a real time report of discarded frames.

Claims

1. A method of obtaining analysis-derived statistics relating to signal traffic over a network, comprising:

acquiring sample network signal frames in real time within a monitoring session;

tagging each acquired sample frame with a time stamp and with a frame number, the time stamp identifying the sample frame'"'"'s real time of acquisition, and the frame number identifying its relative placement among a sequence of acquired sample frames within said session;

storing succeeding sample frames at succeeding available address locations among a first group of address locations in signal memory;

analyzing each stored sample frame to obtain an analysis-derived statistic therefrom;

storing each analysis-derived statistic in association with the time stamp and frame number of its related analyzed sample frame at one of a second group of address locations in signal memory; and

reporting said analysis-derived statistics in a format which evidences the real time of occurrence of each statistic within the session.

2. The method of claim 1, further including:

marking each of said first group of address locations in signal memory as available address locations at the beginning of a monitoring session;

prioritizing said available address locations in a sequence of next available address locations;

pointing to each next available address location of said sequence as the storage location for each next succeeding acquired sample frame; and

removing the address location of each stored sample frame from said sequence of next available address locations.

3. The method of claim 2, further including:

marking the address location of each such analyzed sample frame as a present available address location at which to store an acquired sample frame in signal memory; and

adding each said present available address location to said sequence of next available address locations.

4. The method of claim 3, further including:

discarding an acquired sample frame in the absence of an identified next available address location in said first group of address locations;

recording the time stamp and frame number of each said discarded acquired sample frame; and

maintaining a count of the total number of discarded sample frames in a monitoring session.

5. The method of claim 4, wherein the step of reporting includes:

identifying in the format the real time of acquisition of each discarded frame in a manner which quantifies the number and real time of discarded sample frames within a monitoring session.

6. The method of claim 5, further including:

sequencing the retrieval of the stored analysis-derived statistics, as necessary, to present the reporting of the analysis-derived statistics in the frame number sequence of their respective associated sample frames.

7. A method of providing a real time composite of measured statistics and analysis derived statistics relating to signal traffic over a network, comprising:

obtaining measured statistics of selected events occurring in the network signal traffic within a monitoring session and tagging each measured statistic with a time stamp identifying the statistic'"'"'s real time of occurrence;

acquiring sample network signal frames in real time within the monitoring session, and tagging each acquired sample frame with a time stamp and with a frame number, the time stamp identifying the sample frame'"'"'s real time of acquisition and the frame number identifying its relative placement among a sequence of acquired sample frames within a session;

storing succeeding sample frames in association with their time stamp and frame number at succeeding available address locations among a first group of address locations in signal memory, and storing the measured statistics in association with their time stamp at address locations among a second group of address locations in signal memory;

analyzing each stored sample frame to obtain an analysis-derived statistic value therefrom;

storing each analysis-derived statistic value in association with the time stamp and frame number of its related analyzed sample frame in signal memory; and

reporting the stored measured statistics and the stored analysis-derived statistics in a format which evidences a composite of the real time of occurrence of each measured statistic and of each analysis-derived statistic within the session.

8. The method of claim 7 wherein the step of storing each derived statistics value further includes storing each derived statistic in association with the measured statistics in the second group of address locations in signal memory.

9. The method of claim 7, further including:

marking each of said first group of address locations in signal memory as available address locations at the beginning of a monitoring session;

prioritizing said available address locations in a sequence of next available address locations;

pointing to each next available address location of said sequence as the storage location for each next succeeding acquired sample frame; and

removing the address location of each stored sample frame from said sequence of next available address locations.

10. The method of claim 9, further including:

marking the address location of each such analyzed sample frame as a present available address location at which to store an acquired sample frame in signal memory; and

adding each said present available address location to said sequence of next available address locations.

11. The method of claim 10, further including:

discarding an acquired sample frame in the absence of an identified next available address location in said first group of address locations;

recording the time stamp and frame number of each said discarded acquired sample frame; and

maintaining a count of the total number of discarded sample frames in a monitoring session.

12. The method of claim 11, wherein the step of reporting includes:

identifying in the reporting format the real time of acquisition of each discarded frame in a manner which quantifies the number and the real time of acquisition of the discarded sample frames within a monitoring session.

13. A protocol analyzer, adapted for use with a host computer to acquire statistics related to network signal traffic occurring in a monitoring session, and for reporting the acquired statistics to the host computer, the analyzer comprising:

line interface module (LIM) circuitry, having a LIM signal processor and LIM signal memory for storing signals, including program signals for controlling the LIM signal processor in;

acquiring sample network signal frames in real time and tagging each with a time stamp identifying its real time of acquisition and with a frame number identifying its relative placement in the sequence of acquired frames within the session;

the analyzer further comprising;

protocol analyzer module (PAM) circuitry, having a PAM signal processor adapted for communication with the LIM signal processor and having a PAM signal memory for storing signals, including program signals for controlling the PAM signal processor in;

storing succeeding sample frames at succeeding available address locations among a first group of address locations in the PAM signal memory;

analyzing each stored sample frame to obtain an analysis-derived statistic therefrom;

storing each analysis-derived statistic in association with the time stamp and frame number of its related analyzed sample frame at one of a second group of address locations in the PAM signal memory; and

uploading said analysis-derived statistic values to the host computer in a format for reporting the real time of occurrence of each statistic within the session.

14. The protocol analyzer of claim 13, wherein the program signals further control the PAM signal processor in:

marking each of said first group of address locations in signal memory as available address locations at the beginning of a monitoring session;

prioritizing said available address locations in a sequence of next available address locations;

pointing to each next available address location of said sequence as the storage location for each next succeeding acquired sample frame; and

removing the address location of each stored sample frame from said sequence of next available address locations.

15. The protocol analyzer of claim 14, wherein the program signals further control the PAM signal processor in:

marking the address location of each such analyzed sample frame as a present available address location at which to store an acquired sample frame in signal memory; and

adding each said present available address location to said sequence of next available address locations.

16. The protocol analyzer of claim 15, wherein the program signals further control the PAM signal processor in:

discarding an acquired sample frame in the absence of an identified next available address location in said first group of address locations;

recording the time stamp and frame number of each said discarded acquired sample frame; and

maintaining a count of the total number of discarded sample frames in a monitoring session.

17. The protocol analyzer of claim 16, wherein the program signals further control the PAM signal processor in:

uploading the analysis-derived statistics to the host computer in a format which also identifies the real time of acquisition of each discarded frame in a manner which quantifies the number and real time of discarded sample frames within a monitoring session.

18. The protocol analyzer of claim 17, wherein the program signals further control the PAM signal processor in:

sequencing the uploading of the stored analysis-derived statistics, as necessary, to present the reporting format of the analysis-derived statistics in the frame number sequence of their respective associated sample frames.

19. A protocol analyzer, adapted for use with a host computer to acquire real time measured statistics and analysis-derived statistics relating to network signal traffic occurring in a monitoring session, and for reporting the acquired statistics to the host computer, the analyzer comprising:

line interface module (LIM) circuitry, having a LIM signal processor and having a LIM signal memory for storing signals, including program signals for controlling the LIM signal processor in;

obtaining measured statistics of selected events occurring in the network signal traffic the monitoring session and tagging each measured statistic with a time stamp identifying the statistic'"'"'s real time of occurrence;

acquiring sample network signal frames in real time within the monitoring session, and tagging each acquired sample frame with a time stamp and with a frame number, the time stamp identifying the sample frame'"'"'s real time of acquisition and the frame number identifying its relative placement among a sequence of acquired sample frames within the session;

the analyzer further comprising;

protocol analyzer module (PAM) circuitry, having a PAM signal processor adapted for communication with the LIM signal processor, and having a PAM signal memory for storing signals, including program signals for controlling the PAM signal processor in;

storing succeeding sample frames in association with their time stamp and frame number at succeeding available address locations among a first group of address locations in signal memory, and storing the measured statistics in association with their time stamp at address locations among a second group of address locations in signal memory;

analyzing each stored sample frame to obtain an analysis-derived statistic value therefrom;

storing each analysis-derived statistic value in association with the time stamp and frame number of its related analyzed sample frame in signal memory; and

uploading the stored measured statistics and the stored analysis-derived statistics to the host computer in a format which reports the real time of occurrence of each measured statistic and each analysis-derived statistic within the session.

20. The protocol analyzer of claim 19, wherein the program signals further control the PAM signal processor in:

storing each derived statistic in association with the measured statistics in the second group of address locations in signal memory.

21. The protocol analyzer of claim 19, wherein the program signals further control the PAM signal processor in:

marking each of said first group of address locations in signal memory as available address locations at the beginning of a monitoring session;

prioritizing said available address locations in a sequence of next available address locations;

pointing to each next available address location of said sequence as the storage location for each next succeeding acquired sample frame; and

removing the address location of each stored sample frame from said sequence of next available address locations.

22. The protocol analyzer of claim 21, wherein the program signals further control the PAM signal processor in:

marking the address location of each such analyzed sample frame as a present available address location at which to store an acquired sample frame in signal memory; and

adding each said present available address location to said sequence of next available address locations.

23. The protocol analyzer of claim 22, wherein the program signals further control the PAM signal processor in:

discarding an acquired sample frame in the absence of an identified next available address location in said first group of address locations;

recording the time stamp and frame number of each said discarded acquired sample frame; and

maintaining a count of the total number of discarded sample frames in a monitoring session.

24. The protocol analyzer of claim 23, wherein the program signals further control the PAM signal processor in:

identifying in the reporting format the real time of acquisition of each discarded frame in a manner which quantifies the number and the real time of acquisition of the discarded sample frames within a monitoring session.