Dynamically controlled packet filtering with correlation to signaling protocols

• US 7,372,848 B2
• Filed: 10/11/2002
• Issued: 05/13/2008
• Est. Priority Date: 10/11/2002
• Status: Active Grant

• Current Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Original Assignee: Agilent Technologies, Inc.
• Inventors: Luna, Steve, Doerr, Bradley S., Jones, Stewart
• Primary Examiner(s): Ni; Suhan
• Application Number:
  US10/268,985
• Publication Number:
  US 20040071130A1
• Time in Patent Office: 2,041 Days
• Field of Search: 381352-356, 381328-329, 381/335, 381/349
• US Class Current: 370/352
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/80 Responding to QoS

Abstract

A host processor operating together with a network processor to detect packet media streams on a link of a packet network in accordance with a trigger. The network processor captures substantially all packets on the link in real-time to thereby capture communications transmitted via packets on the link. Each communication has at least one corresponding packet media stream. The host system communicates with the network processor to detect respective packet media streams from the captured packets in accordance with a trigger.

Claims

1. An apparatus comprising:

a network processor capturing substantially all packets on at least one link of a packet network in real-time to thereby capture multiple communications transmitted via packets on said at least one link, each communication having corresponding signaling packets and at least one corresponding packet media stream; and

a host system communicating with the network processor to filter the captured packets to thereby separate the signaling packets from the packet media streams, analyze the separated signaling packets to identify the communications, obtain respective packet media streams corresponding to captured communications from the separated packet media streams in accordance with a trigger applied to the identified communications, produce flow information records for the obtained packet media streams, and analyze the flow information records.

2. An apparatus as in claim 1, wherein the network processor is at a remote location from the host system.

3. An apparatus as in claim 1, wherein the trigger is applied to the identified communications to correlate data within different network protocols related to a same communication.

4. An apparatus as in claim 1, wherein the host system and the network processor operate together to correlate results of the analyzed flow information records to captured communications.

5. An apparatus comprising:

a signaling analyzer; and

a network processor capturing substantially all packets on at least one link of a packet network in real-time to thereby capture multiple communications transmitted via packets on said at least one link, each communication having corresponding signaling packets and at least one corresponding packet media stream, the network processor including;

a filter filtering the captured packets to separate the signaling packets from the packet media streams, the separated signaling packets being provided to the signaling analyzer so that the signaling analyzer analyzes the separated signaling packets to identify the communications, and

a flow engine obtaining respective packet media streams corresponding to captured communications from the separated packet media streams in accordance with a trigger applied to the communications as identified by the signaling analyzer, and producing flow information records for the obtained packet media streams; and

an application analyzing the flow information records produced by the flow engine.

6. An apparatus as in claim 5, wherein the signaling analyzer is located remotely from the network processor and communicates with the network processor via communication lines.

7. An apparatus as in claim 6, further comprising:

a host system which includes the signaling analyzer.

8. An apparatus as in claim 5 ,wherein the filter and flow engine are dynamically reconfigured in accordance the analysis of the separated signaling packets by the signaling analyzer to filter the captured communications and obtain the media streams, respectively.

9. An apparatus as in claim 5, further comprising:

a host system which includes the signaling analyzer and is located remotely from the network processor, the host system communicating with the network processor via communication lines.

10. An apparatus as in claim 5, wherein the application resides on at least one of the group consisting of the network processor and a host system which includes the signaling analyzer.

11. An apparatus as in claim 5, wherein the trigger is applied to the identified communications to correlate data within different network protocols related to the same communication.

12. An apparatus as in claim 5, wherein results of the analysis of the flow information records by the application are correlated to captured communications.

13. An apparatus for capturing packets on at least one link of a packet network to thereby capture multiple communications transmitted via packets on said at least one link, each communication having corresponding signaling packets and at least one corresponding packet media stream, the apparatus comprising:

a signaling analyzer;

a filter capturing substantially all the packets in real-time and filtering the captured packets to separate the signaling packets from the packet media streams, the separated signaling packets being provided to the signaling analyzer so that the signaling analyzer analyzes the separated signaling packets to identify the multiple communications;

a flow engine obtaining respective packet media streams corresponding to captured communications from the separated packet media streams, in accordance with a trigger applied to the communications as identified by the signaling analyzer, and producing flow information records for the obtained packet media streams; and

an application analyzing the flow information records produced by the flow engine.

14. An apparatus as in claim 13, further comprising:

a network processor which includes the filter and the flow engine; and

a host system which includes the signaling analyzer.

15. An apparatus as in claim 14, wherein the network processor is located remotely from the host system and communicates with the host system via communication lines.

16. An apparatus as in claim 13, further comprising:

a network processor which includes the filter and the flow engine; and

a host system which includes the signaling analyzer and the application.

17. An apparatus as in claim 14, wherein the network processor is located remotely from the host system and communicates with the host system via communication lines.

18. An apparatus as in claim 14, wherein the application is included on at least one of the group consisting of the network processor and the host system.

19. An apparatus as in claim 14, wherein the host system dynamically reconfigures at least one of the group consisting of the filter and the flow engine in accordance the analysis of the separated signaling packets by the signaling analyzer.

20. An apparatus as in claim 13, wherein the trigger is applied to the identified communications to correlate data within different network protocols related to a same communication.

21. An apparatus as in claim 13, wherein results of the analysis of the flow information records by the application are correlated to captured communications.

22. An apparatus for capturing packets on at least one link of a packet network to thereby capture multiple communications transmitted via packets on said at least one link, each communication having corresponding signaling packets and at least one corresponding packet media stream, the apparatus comprising:

a signaling analyzer;

a filter capturing substantially all the packets on said at least one link in real-time and filtering the captured packets to separate the signaling packets from the packet media streams, the separated signaling packets being provided to the signaling analyzer so that the signaling analyzer analyzes the separated signaling packets and thereby produces call flow records;

call flow logic which produces control signals from a trigger applied to information provided by the call flow records;

a flow engine obtaining respective packet media streams corresponding to captured multiple communications from the separated packet media streams, in accordance with the control signals, and producing flow information records for the obtained packet media streams; and

an application analyzing the flow information records produced by the flow engine.

23. An apparatus as in claim 22, further comprising:

a network processor which includes the filter and the flow engine; and

a host system which includes the signaling analyzer and the call flow logic.

24. An apparatus as in claim 23, wherein the network processor is located remotely from the host system and communicates with the host system via communication lines.

25. An apparatus as in claim 22, further comprising:

a network processor which includes the filter and the flow engine; and

a host system which includes the signaling analyzer, the call flow logic and the application.

26. An apparatus as in claim 25, wherein the network processor is located remotely from the host system and communicates with the host system via communication lines.

27. An apparatus as in claim 23, wherein the application is included on at least one of the group consisting of the network processor and the host system.

28. An apparatus as in claim 22, wherein call flow logic produces signals to dynamically reconfigure at least one of the group consisting of the filter and the flow engine in accordance the analysis of the separated signaling packets by the signaling analyzer.

29. An apparatus as in claim 23, wherein call flow logic produces signals to dynamically reconfigure at least one of the group consisting of the filter and the flow engine in accordance the analysis of the separated signaling packets by the signaling analyzer.

30. An apparatus as in claim 22, wherein the trigger is applied to the information provided by the call flow records to correlate data within different network protocols related to the same communication.

31. An apparatus as in claim 22, wherein results of the analysis of the flow information records by the application are correlated to captured communications.

32. A method comprising:

capturing packets on at least one link of a packet network in real-time to thereby capture multiple communications transmitted via packets on said at least one link, each communication having corresponding signaling packets and at least one corresponding packet media stream;

filtering the captured packets to separate the signaling packets from the packet media streams;

analyzing the separated signaling packets to identify the communications;

obtaining respective packet media streams corresponding to captured communications from the separated packet media streams, in accordance with a trigger applied to the identified communications;

producing flow information records for the obtained packet media streams; and

analyzing the flow information records.

33. A method as in claim 32, wherein said capturing and said obtaining the packet media streams are performed by a network processor, and said analyzing the separated signaling packets is performed by a call signaling analyzer.

34. A method as in claim 33, wherein the network processor is at a remote location from the call signaling analyzer, and the network processor and the call signaling analyzer communicate with each other via communication links.

35. A method as in claim 32, wherein the trigger is applied to the identified communications to correlate data within different network protocols related to the same communication.

36. A method as in claim 32, further comprising:

correlating results of the analysis of the flow information records to captured communications.

37. An apparatus comprising:

means for capturing packets on at least one link of a packet network in real-time to thereby capture multiple communications transmitted via packets on said at least one link, each communication having corresponding signaling packets and at least one corresponding packet media stream;

means for filtering the captured packets to separate the signaling packets from the packet media streams;

means for analyzing the separated signaling packets to identify the communications; and

means for obtaining respective packet media streams corresponding to captured communications from the separated packet media streams, in accordance with a trigger applied to the identified communications.