System and method for monitoring communication networks using data stream characterization

• US 6,904,020 B1
• Filed: 11/01/2000
• Issued: 06/07/2005
• Est. Priority Date: 11/01/2000
• Status: Expired due to Fees

• Current Assignee: Agilent Technologies, Inc.
• Original Assignee: Agilent Technologies, Inc.
• Inventors: Pollock, Graham S., Kirshenbaum, Evan R., Goldsack, Patrick, Love, Simon
• Primary Examiner(s): Pham, Chi
• Assistant Examiner(s): George, Keith M.
• Application Number:
  US09/703,542
• Time in Patent Office: 1,679 Days
• Field of Search: 370/241, 370/252, 370254-255, 370257-258, 370/351, 370/400
• US Class Current: 370/252
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/12 Network monitoring probes

Abstract

A system and method for automatically monitoring communications networks and for determining network configuration use data stream characterizations. The system comprises a plurality of measurement probes that passively probe the network and collect data packets carried by data streams in the network. The system further comprises characterization computational units that process the collected data packets and produce data stream characterizations from the collected data packets. The data stream characterizations represent individual data streams in an arbitrarily unique manner. The system still further comprises a configuration processing unit that compares data stream characterizations taken at different points in the network and determines data stream paths through the network based on data stream characterization matching. The method for automatically monitoring communications networks comprises the steps of passively probing the data streams to produce sets of collected data packets from the data streams, determining data stream characterizations from the collected data packets, and comparing the data stream characterizations to one another to identify matching characterizations.

Claims

1. A system for monitoring a communications network having data streams that carry data packets between a plurality of nodes by way of physical connections comprising:

a plurality of measurement probes, each probe for passively collecting the data packets carried by a data stream in a physical connection to produce a set;

a plurality of characterization computational units, each characterization computational unit for receiving the set of collected data packets from a respective one of the plurality of probes and for producing a data stream characterization from the set; and

a configuration processing unit for generating a system configuration for the communications network from the data stream characterization.

2. The system of claim 1, wherein the data stream characterization produced by each characterization computational unit comprises an array of hash values computed from an invariant portion of selected data packets taken from the set of collected data packets.

3. The system of claim 2, wherein the array of hash values are computed using an XOR hash algorithm.

4. The system of claim 1, wherein the data stream characterization produced by each characterization computational unit comprises an array of counts of a number of times each possible hash value occurs when hash values are computed from an invariant portion of selected data packets taken from the set of collected data packets.

5. The system of claim 4, wherein the array of hash values are computed using an XOR hash algorithm.

6. The system of claim 1, wherein the data stream characterization produced by each characterization computational unit comprises an array of counts, the counts corresponding to a number of packets between occurrences of a packet that produces a key hash value when hash values are computed from an invariant portion of selected data packets taken from the set of collected data packets.

7. The system of claim 6, wherein the array of hash values are computed using an XOR hash algorithm.

8. The system of claim 1, wherein the data stream characterization produced by each characterization computational unit comprises an array of hash values computed from groups of data packets, one hash value for each group of data packets, wherein the groups are produced by selecting subsets from the set of collected data packets.

9. The system of claim 8, wherein the array of hash values are computed using an XOR hash algorithm.

10. The system of claim 1, wherein the system configuration is generated by successively comparing data stream characterizations to find matching pairs of characterizations.

11. A method for monitoring a communications network having data streams that carry data packets between a plurality of nodes by way of physical connections comprising the steps of:

passively probing one or more of the physical connections to produce one or more sets of collected data packets from the data streams;

determining a data stream characterization from each the sets of collected data packets; and

comparing the data stream characterizations to one another to identify matching characterizations.

12. The method of claim 11, wherein the step of determining comprises the steps of:

recording peripheral information associated with the data stream characterization; and

computing an array of values from an invariant portion of the set of collected data packets.

13. The method of claim 12, wherein the step of computing the array of values comprises the steps of:

selecting data packets from the set of collected data packets;

computing a hash value from the invariant portion of the selected data packets, wherein one hash value is computed for each of the selected data packets; and

storing the computed hash values in an array.

14. The method of claim 13, wherein the step of computing a hash value uses an XOR hash algorithm.

15. The method of claim 12, wherein the step of computing the array of values comprises the steps of:

selecting data packets from the set of collected data packets;

computing a hash value from the invariant portion of the selected data packets, wherein one hash value is computed for each of the selected data packets;

counting each occurrence of each hash value; and

storing the counted occurrences in an array.

16. The method of claim 15, wherein the step of computing a hash value uses an XOR hash algorithm.

17. The method of claim 12, wherein the step of computing the array of values comprises the steps of:

selecting data packets from the set of collected data packets;

computing a hash value from the invariant portion of the selected data packets, wherein one hash value is computed for each of the selected data packets;

counting a number of hash values that occur between each occurrence of a pre-selected key hash value; and

storing each of the counted numbers in an array.

18. The method of claim 17, wherein the step of computing a hash value uses an XOR hash algorithm.

19. The method of claim 12, wherein the step of computing the array of values comprises the steps of:

selecting data packets from the set of collected data packets to produce a subset of selected data packets;

selecting data packets from the subset of selected data packets to produce groups of data packets;

computing a hash value from the invariant portion of the data packets in each of the groups, wherein one hash value is computed for each group of data packets; and

storing the computed hash values in an array.

20. The method of claim 19, wherein the step of computing a hash value uses an XOR hash algorithm.