Passive network monitoring system

• US 7,483,379 B2
• Filed: 05/17/2002
• Issued: 01/27/2009
• Est. Priority Date: 05/17/2002
• Status: Expired due to Fees

• Current Assignee: WSOU Investments, LLC (WSOU Holdings, LLC)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Kan, Chao, Guingo, Pierrick
• Primary Examiner(s): Nguyen, Chau
• Assistant Examiner(s): Scheibel, Robert C
• Application Number:
  US10/147,830
• Publication Number:
  US 20030214913A1
• Time in Patent Office: 2,447 Days
• Field of Search: 370229-238, 370/252, 370/401, 370/469, 709223-224
• US Class Current: 370/237
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A network monitoring system (10). The system comprises a database (32) and at least one monitoring circuit (36) coupled to a network (20). Network traffic flows along the network in a form of packets. The at least one monitoring circuit is programmed to perform the steps of receiving a packet communicated along the network and determining whether data in the packet satisfies a rule set. Further, the at least one monitoring circuit is responsive to determining that data in the packet satisfies a rule set by copying information relating to the packet to be stored into the database. The system also comprises circuitry for querying the information communicated by the at least one monitoring circuit to the database to identify an irregularity in the network traffic.

Claims

1. A network performance monitoring system, comprising:

a database;

at least one network performance monitoring circuit coupled to a network along which network traffic flows in a form of packets, said at least one network performance monitoring circuit programmed to perform the steps of;

receiving a video packet communicated along the network;

determining whether data in the packet satisfies a rule set; and

responsive to determining that data in the packet satisfies a rule set, copying information relating to the packet to be stored into the database;

a recorder layer for communicating between the database and the monitoring circuit, the recorder layer comprising manager applications and meter reading applications, the recorder layer configured to provide the rule set in a flow store to a meter that identifies packets based on a service type and a Quality of Service (QoS) of each of the packets in response to the rule set, said meter programmed to perform the steps of;

selecting a source and a destination for each of the identified packets when the QoS exceeds a value; and

forwarding the selected packets to the recorder layer;

querying circuitry for querying the information communicated by the at least one network performance monitoring circuit to the database to identify an irregularity in the network traffic originated when a route related to the forwarded selected packets is compared to a route related to a source and a destination for each of the identified packets when the QoS does not exceed the value; and

corrective circuitry for electronically providing a corrective action with respect to the identified irregularity in the network traffic, the corrective action ensuring a quality of the video based on the compared routes.

2. The system of claim 1 wherein the database stores the rule set.

3. The system of claim 1 and further comprising a plurality of network performance monitoring circuits coupled to the network:

wherein the plurality of network performance monitoring circuits include the at least one network performance monitoring circuit; and

wherein each of the plurality of network performance monitoring circuits comprises a corresponding database.

4. The system of claim 3, wherein each of the plurality of network performance monitoring circuits is programmed to perform the steps of:

receiving a packet communicated along the network;

determining whether data in the packet satisfies a rule set; and

responsive to determining that data in the packet satisfies a rule set, copying information relating to the packet to be stored into the corresponding database.

5. The system of claim 4:

wherein the packet comprises a header and a payload; and

wherein the step of determining whether data in the packet satisfies a rule set comprises determining whether data in the header satisfies a rule set.

6. The system of claim 5 wherein the step of determining whether data in the header satisfies a rule set comprises determining whether a field in the header satisfies the rule set, wherein the field is selected from a set consisting of source address, destination address, type of service, packet size, and router port number.

7. The system of claim 5 wherein the step of determining whether data in the header satisfies a rule set comprises determining whether the packet comprises an internet control message protocol message.

8. The system of claim 4 wherein the step of determining whether data in the packet satisfies a rule set comprises determining whether one or more QoS parameters satisfy the rule set.

9. The system of claim 4:

wherein the packet comprises a header and a payload; and

wherein the step of determining whether data in the packet satisfies a rule set comprises determining whether data in the payload satisfies the rule set.

10. The system of claim 9 wherein the step of determining whether data in the packet satisfies a rule set comprises determining whether one or more QoS parameters in the payload satisfy the rule set.

11. The system of claim 4 wherein the copying step for each of the plurality of network performance monitoring circuits comprises copying a portion of the packet.

12. The system of claim 4 wherein the copying step for each of the plurality of network performance monitoring circuits comprises copying at least one statistic relating to the packet.

13. The system of claim 4 wherein each corresponding database stores the rule set for a corresponding network performance monitoring circuit.

14. The system of claim 13:

and further comprising a recorder layer for communicating between each corresponding database and network performance monitoring circuit;

wherein the recorder layer is operable to communicate the rule set from the corresponding database to the network performance monitoring circuit; and

wherein the recorder layer is operable to communicate the copied information relating to the packet from the network performance monitoring circuit to the corresponding database.

15. The system of claim 1, wherein the corrective action comprises re-routing network traffic.

16. The system of claim 4, wherein the corrective action is accomplished within five minutes of the queriying circuitry for querying detecting the identified irregularity.

17. The system of claim 1 wherein the network comprises an internet protocol network.

18. The system of claim 1 wherein the internet protocol network comprises the global internet.

19. The system of claim 1 wherein the network comprises a network selected from a group consisting of asynchronous transfer mode, token ring, Novell, and Apple Talk.

20. A method of monitoring the performance of a network along which network traffic flows in a form of packets, comprising:

receiving a video packet communicated along the network;

determining whether data in the packet satisfies a rule set;

responsive to determining that data in the packet satisfies a rule set, copying information relating to the packet to be stored into a database;

providing the rule set in a flow store to a meter, said meter;

identifying the packet based on a service type and a Quality of Service (QoS) in response to the rule set;

selecting a source and a destination for the packet when the QoS exceeds a value; and

forwarding the selected packet to the database;

storing a network flow in the database and corresponding to the information;

querying the information to identify an irregularity in the network traffic originated when a route related to the forwarded selected packets is compared to a route related to a source and a destination for a packets when the QoS does not exceed the value;

and providing a corrective action with respect to the identified irregularity in the network traffic, the corrective action ensuring a quality of the video based on the compared routes.

21. The method of claim 20 wherein the database stores the rule set.

22. The method of claim 20 and further comprising repeating each of the receiving, determining, and copying steps at different locations in the network.

23. The method of claim 22:

wherein the packet comprises a header and a payload; and

wherein the step of determining whether data in the packet satisfies a rule set comprises determining whether data in the header satisfies a rule set.

24. The method of claim 23 wherein each step of determining whether data in the header satisfies a rule set comprises determining whether a field in the header satisfies the rule set, wherein the field is selected from a set consisting of source address, destination address, type of service, packet size, and router port number.

25. The method of claim 23 wherein each step of determining whether data in the header satisfies a rule set comprises determining whether the packet comprises an internet control message protocol message.

26. The method of claim 23 wherein each step of determining whether data in the packet satisfies a rule set comprises determining whether one or more QoS parameters satisfy the rule set.

27. The method of claim 23:

wherein the packet comprises a header and a payload; and

wherein each step of determining whether data in the packet satisfies a rule set comprises determining whether data in the payload satisfies the rule set.

28. The method of claim 27 wherein each step of determining whether data in the packet satisfies a rule set comprises determining whether one or more QoS parameters in the payload satisfy the rule set.

29. The method of claim 23 wherein at least some of the copying steps comprise copying a portion of the packet.

30. The method of claim 23 wherein at least some of the copying steps comprise copying at least one statistic relating to the packet.