Method for correlating and presenting network management data

• US 7,143,159 B1
• Filed: 03/12/2001
• Issued: 11/28/2006
• Est. Priority Date: 03/12/2001
• Status: Expired due to Term

• Current Assignee: Valtrus Innovations Limited (f/k/a Dolya Holdco 9 Limited) (Key Patent Innovations Limited)
• Original Assignee: 3Com Corporation (HP Inc.)
• Inventors: Vered, Ron, Antablian, Arevig, Grace, Jennifer Lynn
• Primary Examiner(s): Etienne, Ario
• Assistant Examiner(s): Dalencourt, Yves
• Application Number:
  US09/732,991
• Time in Patent Office: 2,087 Days
• Field of Search: 709/224, 709/200, 709/203, 709/217, 709/218, 709/219, 709/223, 709/201, 707/10, 707/103.R, 345/853, 715/854, 715/853, 717/105
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0253 using browsers or web-pages for accessing management information
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data

Abstract

NIC collected network statistics are captured by agent devices resident on Host machines of a network. A probe (software or hardware) retrieves the collected statistics from one or more monitored hosts (each host on the network, for example) and places them in RMON MIB and RMON extension MIB formats. The MIB data is retrieved by queries from a data correlation device that then correlates the queried data into useful statistics regarding network traffic. The useful statistics include network traffic in bytes per second for each application, application protocol, hosts, user logon id, etc. for each of the monitored hosts. Different views including a host to host matrix view are provided in a split window display.

Claims

1. A method of correlating and presenting network data, comprising the steps of:

retrieving a set of data from a network statistic data pool, said data pool having network traffic information for at least one of Applications, Application Protocols, Network Protocols, Hosts, and users on the network;

correlating the retrieved data into a map of traffic on said network; and

outputting said map;

wherein;

said map is output in a tree-based hierarchy in a split-window display; and

said tree-based hierarchy is switchable within the split-window display between each of,

an Applications view comprising a hierarchy of network traffic flow for each application currently running on said hosts, further comprising a tree of applications protocol roots expandable to highlight network protocol branches used on the network in conjunction with the expanded application protocol root in a first window of the split-window display, and performance data as to each host pertaining to a selected application protocol and network protocol root branch pair in a second window of the split-window display,

an Application Protocols view comprising a hierarchy of network traffic for each application protocol running on said hosts,

a Hosts view comprising a hierarchy of network traffic for each of said hosts, and

a Matrix view comprising a hierarchy of host to host network traffic on said network for each of said hosts.

2. The method according to claim 1, wherein:

said network statistic data pool is a set of RMON standard MIB objects, and said step of retrieving comprises;

querying the network statistic data pool for RMON standard MIB data;

querying the network statistic data pool for RMON extension MIB data not available in standardized MIBs and also needed in said set of data to produce said map; and

combining the RMON standard MIB and RMON extension MIB data into said data set.

3. The method according to claim 1, wherein said network statistic data pool comprises a set of data placed in at least one of RMON standard and RMON extension MIBs.

4. The method according to claim 1, wherein said step of outputting comprises:

providing each of said Applications, Application Protocols, Hosts, and Matrix views in individual displays; and

displaying a selection mechanism that,

identifies and allows selection of one of said views, and

toggles to a selected one of said maps.

5. A method of presenting network data, comprising the step of:

retrieving network data; and

displaying the network data in a split-window display;

wherein said step of displaying includes the steps of;

displaying high level portions of the network data in a selectable format in a first window of said split-window display; and

displaying details of a high level portion of network data selected in said first window in a second window of said split-window display; and

the steps of displaying include displaying a Hosts view comprising a tree of host roots expandable to highlight network protocols utilized by each root host in a first window of the split-window display, and performance data as to each applications protocol operating under a selected host network protocol root branch pair in a second window of the split-window display;

wherein the steps of displaying comprise displaying an Application view comprising a tree of Application roots expandable to highlight root network protocols expandable to highlight hosts utilizing the root network protocol in conjunction with the expanded root Application in a first window of the split-window display, and performance data related to each application of a selected host, network protocol, and host combination in a second window of the split-window display.

6. The method according to claim 5, further comprising the step of:

switching between various views of the displayed high level portions and details based on a user input criteria.

7. The method according to 6, wherein said user input criteria is a radio box having selections for each view.

8. The method according to claim 6, wherein said user input criteria includes indications for each of Application Protocols, Hosts, Matrix, Applications views of the network data.

9. The method according to claim 5, further comprising the steps of:

retrieving user specified data;

searching said network data for any of the user specified data; and

displaying any network data matching the user specified data.

10. The method according to claim 9, wherein said user specified data is any of an Application Protocol, Application, Network Protocol, Host Name, and user name.

11. The method according to claim 5, wherein said high level details comprises any of Application Protocols, Applications, Network Protocols, Hosts, and users of said network.

12. The method according to claim 5, wherein said details is at least one of number of packets transmitted, bytes per second or other network data statistic.

13. The method according to claim 5, wherein said details comprises bytes per second of network traffic.

14. The method according to claim 5, wherein said details include a chart indicating an amount of network traffic associated with the selected portion.

15. The method according to claim 5, wherein said step of displaying includes the step of displaying high level portion of said network data in a tree format in a first window of said split-window display.

16. The method according to claim 15, wherein said tree format is a branch expandable/collapsible tree format.

17. The method according to claim 15, wherein:

a top level of said tree format contain Application Protocols;

a second level of said tree format contains Network Protocols; and

a third level of said tree format contains Host identifiers.

18. The method according to claim 15, wherein:

a top level of said tree format contains Hosts connected to said network;

a second level of said tree format contains Network protocols associated with the hosts in said top level; and

a third level of said tree format contains Application protocols associated with the network protocols in said second level.

19. The method according to claim 15 wherein:

a top level of said tree format contains Host Data; and

a second level of said tree format contains hosts having conversations with the Hosts at the top level;

wherein the hosts are identified by any one of usernames (logon ids), machine names, network addresses, and MAC addresses.

20. The method according to claim 17, wherein:

a top level of said tree format contains identifications of Applications resident on a Host of said network;

a second level of said tree format contains Network Protocols; and

a third level of said tree format contains any of User Names, machine names, and network addresses on said network running the Applications identified in said second level.

21. The method according to claim 11, wherein said Hosts are identified by at least one of usernames (login ids) machine names, network addresses, and MAC addresses, in that order.

22. A method of presenting network data, comprising the step of:

retrieving network data;

displaying the network data in a split-window display;

displaying a high level hierarchy of the network data in a first side of the split-window display;

selecting one of the network data; and

displaying performance data related to the selected network data in a second side of the split-window display.

23. The method according to claim 22, wherein:

the step of displaying a high-level hierarchy comprises, displaying a listing of applications running on the network, and, for each application, displaying protocols used by the application, and hosts executing the application in an expandable tree format such that each application contains at least one protocol branch, and each protocol contains at least one host executing the application;

the step of selecting comprises selecting at least one of the hosts, under a specific protocol of an application; and

the step of displaying performance data comprises displaying data related to network performance as to each of the applications running on the selected host using the specific protocol.

24. The method according to claim 22, wherein:

the step of displaying a high-level hierarchy comprises a listing of root hosts communicating over the network displayed in an expandable tree format such that each root host contains at least one branch containing a host communicating with the root host;

the step of selecting comprises selecting at least one of the root hosts; and

the step of displaying performance data comprises displaying data related to network performance as to each of the branch hosts communicating with the selected root host.

25. The method according to claim 24, wherein the performance data includes a set of combined horizontal bar graph and network statistic each indicating communication performance of one of the branch hosts with the root host.

26. The method according to claim 22, wherein:

the step of displaying a high-level hierarchy comprises, displaying a listing of hosts operating on the network, and, for each host, displaying network protocols used on host, and displaying application protocols utilized in conjunction with each network protocol, the hosts and protocols being displayed in an expandable tree format such that each host contains at least one network protocol branch, and each network protocol contains at least one application protocol branch;

the step of selecting comprises selecting at least one of the network protocols under a host; and

the step of displaying performance data comprises displaying data related to network performance as to each of the application protocols of the selected network protocols.

27. The method according to claim 22, wherein:

the step of displaying a high-level hierarchy comprises, displaying a listing of application protocols utilized by applications running on hosts of the network, and, for each application protocol, displaying network protocols utilized by each application protocol, and displaying the hosts running applications using the application protocol and network protocols over the network, the hosts and protocols being displayed in an expandable tree format such that each application protocol is a root having a first level of branches comprising the each network protocols, and a second level of branches comprising each host;

the step of selecting comprises selecting at least one of the network protocols under an application protocol; and

the step of displaying performance data comprises displaying data related to network performance as to each of the hosts as to the root application protocol of the selected network protocols.

28. The method according to claim 22, wherein:

the steps of displaying a high-level hierarchy and displaying performance data comprise a set of selectable views, comprising,

an Applications Protocols view comprising a tree of applications protocol roots expandable to highlight network protocol branches used on the network in conjunction with the expanded application protocol root in a first window of the split-window display, and performance data as to each host as it pertains to a selected application protocol and network protocol root branch pair in a second window of the split-window display;

a Hosts view comprising a tree of host roots expandable to highlight network protocols utilized by each root host in a first window of the split-window display, and performance data as to each applications protocol operating under a selected host network protocol root branch pair in a second window of the split-window display;

a Matrix view comprising a tree of host roots expandable to highlight other hosts communicating with the root host in a first window of the split-window display, and performance data as to each host communicating with a selected root host in a second window of the split-window display; and

the Application view.