Internet traffic analysis tool
First Claim
Patent Images
1. A traffic analysis tool for a network based on TCP/IP or UDP/IP or a combination thereof comprising:
- passive monitoring means at intermediate nodes of the network,estimation means to determine a full set of network traffic metrics connected to said passive monitoring means, andmodeling means for determining a pricing for different users of said network based on a utilization of network resources by said different users,wherein said estimation means includes a mechanism for determining goodput by aggregating the number of bytes in all relevant packets received at the node in unit time and deducting from said aggregate the aggregate of the number of bytes in packets that arrive more than once in said unit time,wherein said estimation means determines duplicate packets by a mechanism for identifying packets bearing the same packet number,wherein said estimation means includes a mechanism for determining link utilization by calculating a ratio of the aggregate link throughput to the capacity of the link,wherein said estimation means is based on an analysis of the correlation between sequence numbers of the monitored packets both for forward (data packets) and reverse (acknowledgement packets (‘
Acks’
)) packet streams,wherein said estimation means includes a mechanism for determining retransmission by detecting retransmissions due to timeout or shrinking of transmission window by identifying when the transmission enters a slow start phase,wherein the slow start phase is identified by means determining when the inter-packet time difference is greater than a defined multiple of the average inter-packet time difference, andwherein said estimation means determines lost packets by a mechanism for identifying packets for which an additional packet bearing the same packet sequence number is received prior to the receipt of the ‘
ACK’ and
the time interval between the receipt of the second packet and the receipt of the ‘
ACK’
is comparable to the estimated round trip time.
1 Assignment
0 Petitions
Accused Products
Abstract
The present invention relates to a traffic analysis method and tool for a network based on TCP/IP or UDP/IP or a combination thereof comprising passive monitoring means at intermediate nodes of the network, and estimation means to determine a full set of network traffic metrics connected to said passive monitoring means.
The instant invention also provides a configured computer program product for carrying out the above method.
-
Citations
24 Claims
-
1. A traffic analysis tool for a network based on TCP/IP or UDP/IP or a combination thereof comprising:
-
passive monitoring means at intermediate nodes of the network, estimation means to determine a full set of network traffic metrics connected to said passive monitoring means, and modeling means for determining a pricing for different users of said network based on a utilization of network resources by said different users, wherein said estimation means includes a mechanism for determining goodput by aggregating the number of bytes in all relevant packets received at the node in unit time and deducting from said aggregate the aggregate of the number of bytes in packets that arrive more than once in said unit time, wherein said estimation means determines duplicate packets by a mechanism for identifying packets bearing the same packet number, wherein said estimation means includes a mechanism for determining link utilization by calculating a ratio of the aggregate link throughput to the capacity of the link, wherein said estimation means is based on an analysis of the correlation between sequence numbers of the monitored packets both for forward (data packets) and reverse (acknowledgement packets (‘
Acks’
)) packet streams,wherein said estimation means includes a mechanism for determining retransmission by detecting retransmissions due to timeout or shrinking of transmission window by identifying when the transmission enters a slow start phase, wherein the slow start phase is identified by means determining when the inter-packet time difference is greater than a defined multiple of the average inter-packet time difference, and wherein said estimation means determines lost packets by a mechanism for identifying packets for which an additional packet bearing the same packet sequence number is received prior to the receipt of the ‘
ACK’ and
the time interval between the receipt of the second packet and the receipt of the ‘
ACK’
is comparable to the estimated round trip time. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8)
-
-
9. A traffic analysis method for a network based on TCP/IP or UDP/IP or a combination thereof, said method comprising:
-
monitoring passively at intermediate nodes of the network, estimating a full set of network traffic metrics, and determining a pricing model for different users of said network based on a utilization of network resources by said different users, wherein said estimation includes determining goodput by aggregating the number of bytes in all relevant packets received at the node in unit time and deducting from said aggregate the aggregate of the number of bytes in packets that arrive more than once in said unit time, wherein said estimation determines duplicate packets for identifying packets bearing the same packet number, wherein said estimation determines link utilization by calculating a ratio of the aggregate link throughput to the capacity of the link, wherein said estimation is based on an analysis of the correlation between sequence numbers of the monitored packets both for forward (data packets) and reverse (acknowledgement packets (‘
Acks’
)) packet streams,wherein said estimation includes determining retransmission by detecting retransmissions due to timeout or shrinking of transmission window by identifying when the transmission enters a slow start phase, wherein the slow start phase is identified by determining when the inter-packet time difference is greater than a defined multiple of the average inter-packet time difference, and wherein said estimation determines lost packets by a mechanism for identifying packets for which an additional packet bearing the same packet sequence number is received prior to the receipt of the ‘
ACK’ and
the time interval between the receipt of the second packet and the receipt of the ‘
ACK’
is comparable to the estimated round trip time. - View Dependent Claims (10, 11, 12, 13, 14, 15, 16)
-
-
17. A computer program product comprising computer readable program code stored on computer readable storage medium embodied therein for traffic analysis for a network based on TCP/IP or UDP/IP or a combination thereof comprising:
-
computer readable program code means configured for monitoring passively at intermediate nodes of the network, computer readable program code means configured for estimating a full set of network traffic metrics, and computer readable program code means configured for determining a pricing model for different users of said network based on a utilization of network resources by said different users, wherein said computer readable program code means configured for estimating includes determining goodput by aggregating the number of bytes in all relevant packets received at the node in unit time and deducting from said aggregate the aggregate of the number of bytes in packets that arrive more than once in said unit time, wherein said computer readable program code means configured for estimating determines duplicate packets by a mechanism for identifying packets bearing the same packet number, wherein said computer readable program code means configured for estimating determines link utilization by calculating a ratio of the aggregate link throughput to the capacity of the link, wherein said computer readable program code means configured for estimating is based on an analysis of the correlation between sequence numbers of the monitored packets both for forward (data packets) and reverse (acknowledgement packets (‘
Acks’
)) packet streams,wherein said computer readable program code means configured for estimating includes determining retransmission by detecting retransmissions due to timeout or shrinking of transmission window by identifying when the transmission enters a slow start phase, wherein the slow start phase is identified by determining when the inter-packet time difference is greater than a defined multiple of the average inter-packet time difference, and wherein said computer readable program code means configured for estimating determines lost packets for identifying packets for which an additional packet bearing the same packet sequence number is received prior to the receipt of the ‘
ACK’ and
the time interval between the receipt of the second packet and the receipt of the ‘
ACK’
is comparable to the estimated round trip time. - View Dependent Claims (18, 19, 20, 21, 22, 23, 24)
-
Specification