Network traffic visualization

• US 6,687,750 B1
• Filed: 04/14/1999
• Issued: 02/03/2004
• Est. Priority Date: 04/14/1999
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Swallow, George, Messinger, Fred
• Primary Examiner(s): Alam; Hosain
• Assistant Examiner(s): NGUYEN, THU HA T
• Application Number:
  US09/291,381
• Time in Patent Office: 1,756 Days
• Field of Search: 345/335 368/113 395/770,779 379/88.22 709/101,224,202,229,223,217 714/47 703/6 713/201
• US Class Current: 709/224
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

A system containing a visualization application which enables the user or other user to obtain information about various types of transactions involving the respective activities of the components. The user selects filtering criteria that identify various types of transactions performed on each network component from the visualization application and the visualization application uses these criteria in compiling the appropriate records from the network information files. The visualization application then forms the data that represent the records that meet each selected criterion and stores the data in a local file. Thereafter, the user may view the network activity through the visualization application which displays a map of the network and overlays the map with graphical moving images that represent the data for each selected criterion. The graphical images change with time to reflect changes in the underlying data.

Claims

1. A data visualization system for graphically presenting characteristics of data traffic on a distributed computer network system comprising:

A) means for monitoring traffic on said system;

B) means for selecting characteristics of said traffic for display;

C) means for presenting said characteristics in a graphical format, said graphical format representing said system in response to said monitoring, said system represented as nodes connected by lines, said lines representing traffic flow between nodes,

D) means for displaying a width of a line of said lines, said width indicating a value of said characteristics, said value obtained from said monitoring during a selected time interval; and

E) means for displaying a sequence of said images, each of said images taken during a different time interval, and changes in said width of said line showing changes in said characteristics.

2. The system of claim 1 wherein the means for monitoring comprises:

a reporting structure which records in network information files the states of network components and activities performed on the components over a period of time.

3. The system of claim 1 wherein the means for selecting further comprises:

A) means for displaying a graphical user interface in the data visualization system to select filtering expressions for extracting information from network information files;

B) means for selecting the relevant records from network information files;

C) means for executing the selected filtering expression on the selected records; and

D) means for calculating parameters that are associated with the selected records and storing said parameters in a local file.

4. The system of claim 3 wherein the graphical format may be any graphical black and white or color image capable of being displayed on the data visualization system.

5. A distributed computer network system comprising:

A) a plurality of network components that generate and transmit records to network information files upon performing each network activity;

B) at least one visualization application generating at least one filtering program, each filtering program displaying filtering criteria including various types of transactions associated with the respective activities of the network components;

C) means for selecting the desired filtering criteria from the visualization application; and

D) means for generating data representing records in the network information files that meet each selected filtering criterion and dynamically displaying graphical images that represent the generated data;

E) means for presenting said graphical images to represent said network as nodes connected by lines, said lines representing traffic flow between nodes;

F) means for displaying a width of a line of said lines, said width indicating a value of said characteristics, said value obtained from said monitoring during a selected time interval; and

G) means for displaying a sequence of said images, each of said images taken during a different time interval, and changes in said width of said line showing changes in said characteristics.

6. The system of claim 5 wherein the visualization application uses the filtering program to select the records in the network information files that meet the selected filtering criteria.

7. The system of claim 6 wherein the visualization application compiles the appropriate records from the network information files during specified intermediate time intervals, each compiled record meeting at least one selected filtering criterion.

8. The system of claim 7 wherein the visualization application calculates data that represent the compiled records and stores the data in a local file.

9. The system of claim 8 wherein the visualization application displays a map of the network topology and overlays the map with moving images that graphically portray the stored data, said moving images changing with time to reflect changes in the underlying data during a period of time selected by a system operator.

10. The system of claim 9 wherein the filtering criteria in the visualization application includes an intermediate time interval criterion which indicates how often the visualization application should compile and package information form the network information files.

11. The system of claim 10 wherein the visualization application graphically displays the network activity for any period within the starting and ending times specified within the filtering criteria.

12. A method for graphically displaying the activities between network components and the composition of transactions that makes up certain network activities in a computer network, the method comprising the steps of:

A) transmitting to network information files records from a plurality of network components upon performing each network activity;

B) displaying filtering criteria from at least one filtering program in a visualization application, the filtering program including the various types of transactions associated with respective activities of the network components;

C) selecting the desired filtering criteria from the visualization application;

D) filtering records in the network information files based on the selected filtering criteria;

E) generating data representing records in the network information files that meet each selected filtering criterion; and

F) presenting the generated data as images, said images representing said network in response to said filtering, said network represented as nodes connected by lines, said lines representing traffic flow between nodes;

G) displaying a width of a line of said lines, said width indicating a value of said characteristics, said value obtained from said monitoring during a selected time interval; and

H) means for displaying a sequence of said images, each of said images taken during a different time interval, and changes in said width of said line showing changes in said characteristics.

13. The method of claim 12 wherein the step C of selecting comprises the step C1 of choosing the desired network components, transaction types and the starting and ending times for filtering records from the network information files.

14. The method of claim 12 wherein the step D of filtering comprises the step D1 of compiling the appropriate records from the network information files that meet the chosen filtering criteria.

15. The method of claim 12 wherein the step E of generating comprises the steps of:

E1. calculating data that represent records in the network information file that meet each selected criterion; and

E2. storing the data in a local file.

33. A computer readable medium, comprising

said computer readable medium containing instructions for execution in a processor for the practice of the method of claim 12, or claim 27, or claim 31.

34. Electromagnetic signals propagating on a computer network, comprising:

said electromagnetic signals carrying instructions for execution on a processor for the practice of the method of claim 12, or claim 27, or claim 31.

16. A data visualization system comprising:

A) means for monitoring traffic on a distributed computer network system;

B) means for pre-selecting characteristics of said traffic, performing computations on traffic data, and storing computed results for subsequent graphical display;

C) means for presenting said characteristics in a graphical format, said graphical format representing said system in response to said monitoring, said system represented as nodes connected by lines, said lines representing traffic flow between nodes;

D) means for displaying a width of a line of said lines, said width indicating a value of said characteristics, said value obtained from said monitoring during a selected time interval; and

E) means for displaying a sequence of said images, each of said images taken during a different time interval, and changes in said width of said line showing changes in said characteristics.

17. The system of claim 16 further comprises a reporting structure which records in network information files the states of network components and traffic related activities performed by the components over a period of time.

18. The system of claim 16 wherein said means for pre-selecting further comprises:

A) a graphical user interface to select filtering expressions for extracting information from network information files;

B) means for selecting the relevant records from network information files;

C) means for executing the selected filtering expression on the selected records; and

D) means for calculating parameters that are associated with the selected records and storing said parameters in a local file.

19. The system of claim 18 further comprises a moving image, which may be any graphical black and white or color and may be capable of being displayed on said system.

20. A distributed computer network system comprising:

A) a plurality of network components that generate and transmit records of their network activity to network information files;

B) at least one visualization application generating at least one filtering program, each filtering program displaying the filtering criteria, which includes various types of transactions associated with the respective activities of each network component;

C) means for selecting the desired filtering criteria for the visualization application

D) means for generating data representing records in the network information files that meet each selected filtering criterion;

E) means for presenting said data in a graphical format, said graphical format representing said system in response to said filtering, said system represented as nodes connected by lines, said lines representing traffic flow between nodes;

F) means for displaying a width of a line of said lines, said width indicating a value of said characteristics, said value obtained from said monitoring during a selected time interval; and

G) means for displaying a sequence of said images, each of said images taken during a different time interval, and changes in said width of said line showing changes in said characteristics .

21. The system of claim 20 wherein the visualization application further comprises said filtering program to select the records in the network information files that meet the selected filtering criteria.

22. The system of claim 21 wherein the visualization application further comprises means for compiling the appropriate records from the network information files during specified intermediate time intervals, each compiled record meeting at least one selected filtering criterion.

23. The system of claim 22 wherein the visualization application further comprises means for calculating data that represent the compiled records and stores the data in a local file.

24. The system of claim 23 wherein the visualization application further comprises means for displaying a map of the network topology and overlaying the map with moving images that graphically portray the stored data, said moving images changing with time to reflect changes in the underlying data during a period of time selected by a system operator.

25. The system of claim 24 wherein the filtering criteria in the visualization application further comprises an intermediate time interval criterion which indicates how often the visualization application should compile and package information form the network information files.

26. The system of claim 24 wherein the visualization application further comprises means for graphically displaying the network activity for any period within the starting and ending times specified within the filtering criteria.

27. A method for graphically displaying network traffic comprising the steps of:

A) monitoring traffic on a distributed computer network system;

B) pre-selecting characteristics of said traffic, performing computations on traffic data, and storing computed results for subsequent graphical display; and

C) presenting said characteristics in a graphical format, said graphical format representing said system in response to said monitoring, said system represented as nodes connected by lines, said lines representing traffic flow between nodes;

D) means for displaying a width of a line of said lines, said width indicating a value of said characteristics, said value obtained from said monitoring during a selected time interval; and

E) means for displaying a sequence of said images, each of said images taken during a different time interval, and changes in said width of said line showing changes in said characteristics.

28. The method of claim 27 wherein said step of monitoring further comprises the step of recording in network information files the states of network components and traffic related activities performed by the network components over a period of time.

29. The method of claim 27 wherein said step of pre-selecting further comprises the steps of:

A) selecting filtering expressions for extracting information from network information files;

B) selecting the relevant records from network information files;

C) executing the selected filtering expression on the selected records; and

D) calculating parameters that are associated with the selected records and storing said parameters in a local file.

30. The method of claim 29 further comprises a step of displaying at least one moving image, which may be any graphical black and white or color.

31. A method for displaying traffic on a computer network, comprising:

monitoring traffic by a node, said node sending results of said monitoring to network information files stored on a first computer;

selecting characteristics of said traffic for display by a second computer, said first computer sending data to said second computer; and

displaying, in response to said data, said selected characteristics by said second computer;

presenting said characteristics in a graphical format, said graphical format representing said system in response to said monitoring, said system represented as nodes connected by lines, said lines representing traffic flow between nodes;

displaying a width of a line of said lines, said width indicating a value of said characteristics, said value obtained from said monitoring during a selected time interval; and

displaying a sequence of said images, each of said images taken during a different time interval, and changes in said width of said line showing changes in said characteristics.

32. The method of claim 31, further comprising:

choosing said first computer and said second computer as the same computer.