Method of tracing data traffic on a network

• US 7,171,464 B1
• Filed: 01/24/2000
• Issued: 01/30/2007
• Est. Priority Date: 06/23/1999
• Status: Expired due to Term

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ramanathan, Venkataraman, Raghuraman, Melur K.
• Primary Examiner(s): Najjar; Saleh
• Assistant Examiner(s): LAZARO, DAVID R
• Application Number:
  US09/490,981
• Time in Patent Office: 2,563 Days
• Field of Search: 709102-107, 709/229, 709223-226, 709/249, 709/227, 709/228, 709/237, 709/203, 710/5
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0896 Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Abstract

A method of tracing data on a network that detects receive and send events in a protocol stack is provided. The method provides key information for capacity planners for correctly charging network traffic to the individual services and applications. The TCP/IP stack is instrumented at the transport layer, so that Input/Output Request packets (IRP) representing sends and receives can be detected as they pass through the stack. When such packets are detected an appropriate send or receive event is recorded in a trace log.

Claims

1. A method of tracing data traffic on a network, the method comprising:

at the transport layer of a protocol stack residing on a first device in the network, detecting, upon the occurrence on an event, a transmission or receipt of data to or from a second device on the network as a transport control block entry related to the event, the event comprising;

a send complete event, a receive indicate event, or a receive complete event; and

in response to the transmission or receipt being detected, copying the transport control block entry related to the event from the transport control block to a trace log;

wherein the trace log is accessible to determine the volume of data traveling over a network.

2. The method of claim 1, wherein the protocol stack is a TCP/IP stack.

3. The method of claim 1, further comprising detecting the presence of an input/output packet representing the transmission or receipt.

4. The method of claim 1, wherein the transmission of data is recorded at the completion of the transmission indicated by an acknowledgement from the first device.

5. The method of claim 1, wherein the entry related to the event comprises at least one of a source address, a destination address, a source port number, a destination port number, a number of bytes transmitted, a size of the data received, a process identification, an entry time, or a transmission time.

6. The method of claim 1, wherein the send complete event occurs when the first device receives an acknowledgement for a last byte of the transmission from the second device.

7. The method of claim 1, wherein the receive indicate event occurs when the protocol stack receives an input/output request packet through an interface.

8. The method of claim 1, wherein the receive complete event occurs when a request for data is completed.

9. A method of tracing a data transmission of data over a computer network comprising:

detecting a transport-layer request to transmit the data transmission in a transport control block;

searching the data transmission to determine an identity of a process that created the data transmission; and

storing in a trace log a first entry representing the transport-layer request to transmit the data transmission;

detecting an acknowledgment of the data transmission in a transport control block;

storing in the trace log a second entry representing the acknowledgment of the data transmission;

detecting a transport-layer reception of the data transmission in the transport control block;

storing in the trace log a third entry representing receiving the data transmission;

detecting a transport-layer completion of the data transmission in the transport control block;

storing in the trace log a fourth entry representing the completion of the data transmission;

wherein the first entry comprises the identity of the process; and

wherein the trace log is accessible to determine a volume of data being transmitted over the network.

10. The method of claim 9, wherein the identity of the process includes a port number or an IP address relating to the transmission.

11. The method of claim 9, wherein the acknowledgement of the data transmission is detected when the last byte of the transport-layer request to transmit the data transmission is received.

12. The method of claim 9, wherein the transport-layer reception of the data transmission is detected when the transport layer receives the data transmission through an interface.

13. The method of claim 9, wherein the transport-layer completion of the data transmission is detected when the request to transmit the data transmission is completed.

14. The method of claim 9, wherein the first, second, third, and fourth entries comprise at least one parameter related to the data transmission, the at least one parameter related to the data transmission comprising a source address, a destination address, a source port number, a destination port number, a number of bytes transmitted, a size of the data received, a process identification, an entry time, or a transmission time.

15. A computer-readable medium having stored thereon computer-executable instructions for tracing data traffic on a network comprising:

detecting a transport-layer request to transmit a data transmission to a port connection;

searching the data transmission to determine an identity of a process that created the the data transmission; and

storing in a trace log a first entry representing the transport-layer request to transmit the data transmission;

detecting an acknowledgment of the data transmission in the transport control block;

storing in the trace log a second entry representing the acknowledgment of the data transmission;

detecting a transport-layer reception of the data transmission in the transport control block;

storing in the trace log a third entry representing receiving the data transmission;

detecting a transport-layer completion of the data transmission in the transport control block;

storing in the trace log a fourth entry representing the completion of the data transmission;

wherein the first entry comprises the identity of the process; and

wherein the trace log is accessible to determine a volume of data being transmitted over the network.

16. The computer-readable medium of claim 15, having further computer-executable instructions comprising:

opening the port connection by the process;

creating a connection object representing the opening of the port connection by the process;

copying the process identification from the connection object into a transport control block associated with the port; and

in response to the detection of the receipt of data at the port connection, copying the process identification into the trace log from the transport control block.

17. The computer-readable medium of claim 15, wherein the acknowledgement of the data transmission is detected when the last byte of the transport-layer request to transmit the data transmission to the port is received.

18. The computer-readable medium of claim 15, wherein the transport-layer reception of the data transmission is detected when the transport layer receives the data transmission through an interface.

19. The computer-readable medium of claim 15, wherein the transport-layer completion of the data transmission is detected when the request to transmit the data transmission to the port is completed.

20. The computer-readable medium of claim 15, wherein the first, second, third, and fourth entries comprise at least one parameter related to the data transmission, the at least one parameter related to the data transmission comprising a source address, a destination address, a source port number, a destination port number, a number of bytes transmitted, a size of the data received, a process identification, an entry time, or a transmission time.

21. A computer system comprising:

a network;

a first computing device configured to send a transmission across the network to a second computing device;

a transport protocol stack residing on the first computing device configured to receive the transmission;

a transport control block communicating with the transport protocol stack, the transport control block configured to store at least one transport control block entry, the at least one transport control block entry comprising at least one transmission parameter; and

a trace logger comprising a trace log;

wherein the trace logger is configured to copy the at least one transmission parameter to the trace log from the transport control block, the at least one transmission parameter comprising information related to at least one of a send complete event, a receive indicate event, or a receive complete event; and

wherein the trace log is accessible to determine a volume of data being transmitted over the network.

22. The system of claim 21, wherein the at least one transmission parameter comprises at least one of a source address, a destination address, a source port number, a destination port number, a number of bytes transmitted, a size of the data received, a process identification, an entry time, or a transmission time.

23. The system of claim 21, wherein the send complete event occurs when the first device receives an acknowledgement for a last byte of the transmission from the second device.

24. The system of claim 21, wherein the receive indicate event occurs when the protocol stack receives an input/output request packet through an interface.

25. The system of claim 21, wherein the receive complete event occurs when a request for data is completed.