Statistical gathering framework for extracting information from a network multi-layer stack

• US 6,615,262 B2
• Filed: 08/21/2001
• Issued: 09/02/2003
• Est. Priority Date: 06/28/1999
• Status: Expired due to Term

• Current Assignee: Amdocs Development Limited (Amdocs Ltd.), Amdocs Ltd.
• Original Assignee: Xacct Technologies Ltd.
• Inventors: Kushnir, Ori, Black, Damian, Givoly, Tal, Schweitzer, Limor
• Primary Examiner(s): Burgess, Glenton B.
• Assistant Examiner(s): EDELMAN, BRADLEY E
• Application Number:
  US09/935,132
• Publication Number:
  US 20020016843A1
• Time in Patent Office: 742 Days
• Field of Search: 709/224, 709/223, 370/229, 370/230, 370/232, 370/253, 705/40
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 41/5087 wherein the managed service relates to voice services management of VoIP services H04M7/0081
• CPC Class Codes: H04L 41/509 wherein the managed service relates to media content delivery, e.g. audio, video or TV
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/41 Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/56 for VoIP communications
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/8016 based on quality of service [QoS]
• CPC Class Codes: H04M 15/81 Dynamic pricing, e.g. change of tariff during call
• CPC Class Codes: H04M 2215/0112 Dynamic pricing, e.g. change of tariff during call
• CPC Class Codes: H04M 2215/0164 Billing record, e.g. Call Data Record [CDR], Toll Ticket[TT], Automatic Message Accounting [AMA], Call Line Identifier [CLI], details, i.e. parameters, identifiers, structure
• CPC Class Codes: H04M 2215/0188 Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04M 2215/202 VoIP; Packet switched telephony
• CPC Class Codes: H04M 2215/22 Bandwidth or usage-sensitve billing
• CPC Class Codes: H04M 2215/7414 QoS
• CPC Class Codes: H04M 3/2218 Call detail recording
• CPC Class Codes: H04M 7/006 : Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42
• CPC Class Codes: H04Q 2213/13034 : A/D conversion, code compression/expansion
• CPC Class Codes: H04Q 2213/1305 : Software aspects
• CPC Class Codes: H04Q 2213/13093 : Personal computer, PC
• CPC Class Codes: H04Q 2213/1313 : Metering, billing
• CPC Class Codes: H04Q 2213/13166 : Fault prevention
• CPC Class Codes: H04Q 2213/13175 : Graphical user interface [GUI], WWW interface, visual indication
• CPC Class Codes: H04Q 2213/13196 : Connection circuit/link/trunk/junction, bridge, router, gateway
• CPC Class Codes: H04Q 2213/13204 : Protocols
• CPC Class Codes: H04Q 2213/13209 : ISDN
• CPC Class Codes: H04Q 2213/1325 : Priority service
• CPC Class Codes: H04Q 2213/13337 : Picturephone, videotelephony
• CPC Class Codes: H04Q 2213/13349 : Network management
• CPC Class Codes: H04Q 2213/13389 : LAN, internet
• CPC Class Codes: H04Q 3/0079 : involving restoration of networks, e.g. disaster recovery, self-healing networks

Abstract

A system, method and computer program product are provided for gathering statistics associated with a network session. Initially, a plurality of packets is received at a plurality of analyzers. Such packets are analyzed to identify a plurality of flows. Further identified are a session associated with the plurality of flows and at least one application associated with the session. The session is then reconstructed utilizing the identified application for analysis purposes. A plurality of statistics associated with the session is then gathered based on the analysis.

Claims

1. A method for gathering statistics associated with a network session, comprising:

receiving a plurality of packets including payloads at a plurality of analyzers;

analyzing the plurality of packets including the payloads thereof to identify a plurality of flows;

identifying a session associated with the plurality of flows;

identifying at least one application associated with the session;

reconstructing the session utilizing the identified application;

analyzing the reconstructed session;

gathering a plurality of statistics associated with the session based on the analysis;

determining a policy;

outputting records reflecting the statistics; and

performing an accounting operation based on the records and the policy;

wherein a timing associated with the output of the records is based on the identified application.

2. The method as recited in claim 1, wherein the statistics include start time, end time, time since last output, number of packets, number of bytes, average time between packets, moving average, latency, throughput, and jitter.

3. The method as recited in claim 1, wherein the statistics are selected from the group consisting of start time, end time, time since last output, number of packets, number of bytes, average time between packets, moving average, latency, throughput, and jitter.

4. The method as recited in claim 1, wherein the statistics are gathered from a plurality of layers of a network protocol.

5. The method as recited in claim 4, wherein the layers of the network protocol include a physical layer, a data link layer, a network layer, a transport layer, a session layer, a presentation layer, and an application layer.

6. The method as recited in claim 1, and further comprising filtering the packets for removing packets unrelated to the session.

7. The method as recited in claim 1, and further comprising gathering a plurality of flow statistics associated with the plurality of flows.

8. The method as recited in claim 7, wherein the flow statistics include timestamps.

9. The method as recited in claim 8, wherein the timestamps are used to generate the statistics associated with the session.

10. The method as recited in claim 1, and further comprising outputting a plurality of reports including a plurality of the statistics reported in terms of the identified application.

11. The method as recited in claim 10, wherein the reports are outputted at an application-specific interval.

12. The method as recited in claim 1, wherein the statistics are gathered based on the policy.

13. A computer program product for gathering statistics associated with a network session, comprising:

computer code for receiving a plurality of packets including payloads at a plurality of analyzers;

computer code for analyzing the plurality of packets including the payloads

thereof to identify a plurality of flows;

computer code for identifying a session associated with the plurality of flows;

computer code for identifying at least one application associated with the session;

computer code for reconstructing the session utilizing the identified application;

computer code for analyzing the reconstructed session;

computer code for gathering a plurality of statistics associated with the session based on the analysis;

computer code for determining a policy;

computer code for outputting records reflecting the statistics; and

computer code for performing an accounting operation based on the records and the policy;

wherein a timing associated with the output of the records is based on the identified application.

14. The computer program product as recited in claim 13, wherein the statistics include start time, end time, time since last output, number of packets, number of bytes, average time between packets, moving average, latency, throughput, and jitter.

15. The computer program product as recited in claim 13, wherein the statistics are selected from the group consisting of start time, end time, time since last output, number of packets, number of bytes, average time between packets, moving average, latency, throughput, and jitter.

16. The computer program product as recited in claim 13, wherein the statistics are gathered from a plurality of layers of a network protocol.

17. The computer program product as recited in claim 16, wherein the layers of the network protocol include a physical layer, a data link layer, a network layer, a transport layer, a session layer, a presentation layer, and an application layer.

18. The computer program product as recited in claim 13, and further comprising computer code for filtering the packets for removing packets unrelated to the session.

19. The computer program product as recited in claim 13, and further comprising computer code for gathering a plurality of flow statistics associated with the plurality of flows.

20. The computer program product as recited in claim 19, wherein the flow statistics include timestamps.

21. The computer program product as recited in claim 20, wherein the timestamps are used to generate the statistics associated with the session.

22. The computer program product as recited in claim 13, and further comprising computer code for outputting a plurality of reports including a plurality of the statistics reported in terms of the identified application.

23. The computer program product as recited in claim 22, wherein the reports are outputted at an application-specific interval.

24. The computer program product as recited in claim 13, wherein the statistics are gathered based on the policy.

25. A method for gathering statistics associated with a network session, comprising:

(a) receiving a plurality of packets including payloads at a plurality of analyzers;

(b) analyzing the plurality of packets including the payloads thereof to identify at least a first flow;

(c) identifying a session associated with the first flow;

(d) identifying additional flows in the plurality of packets associated with the session;

(e) filtering the packets for removing packets unrelated to the session;

(f) gathering a plurality of flow statistics associated with the plurality of flows including timestamps;

(g) identifying at least one application associated with the session;

(h) reconstructing the session utilizing the identified application and the flow statistics;

(i) analyzing the reconstructed session;

(j) determining a policy;

(k) gathering a plurality of session statistics associated with the session from a plurality of layers of a network protocol based on the analysis and the policy;

(l) said session statistics selected from the group consisting of start time, end time, time since last output, number of packets, number of bytes, average time between packets, moving average, latency, throughput, and jitter;

(m) said layers of the network protocol including a physical layer, a data link layer, a network layer, a transport layer, a session layer, a presentation layer, and an application layer;

(n) outputting a plurality of reports including a plurality of the session statistics reported in terms of the identified application, in accordance with the policy;

(o) said reports selected from the group consisting of service detail reports, quality of service reports, and router command reports; and

(p) combining the session statistics from the reports;

(q) wherein the reports are outputted at an application-specific interval;

(r) wherein records are outputted reflecting the statistics, an accounting operation including billing is performed based on the policy, and a timing associated with the output of the records is based on the identified application.