Method and apparatus for session reconstruction

• US 7,539,749 B2
• Filed: 06/09/2003
• Issued: 05/26/2009
• Est. Priority Date: 04/20/2000
• Status: Expired due to Fees

• Current Assignee: Amdocs Development Limited (Amdocs Ltd.), Amdocs Ltd.
• Original Assignee: Amdocs Ltd.
• Inventors: Kushnir, Ori, Givoly, Tal, Black, Damian, Schweitzer, Limor
• Primary Examiner(s): NGUYEN, THANH T
• Application Number:
  US10/458,768
• Publication Number:
  US 20040049576A1
• Time in Patent Office: 2,178 Days
• Field of Search: 709/224, 709/217, 370/13.1, 370/13, 370/106, 370/119, 328/118
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0627 by acting on the notification or alarm source
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5029 Service quality level-based billing, e.g. dependent on measured service level customer is charged more or less
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 41/5058 Service discovery by the service manager
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/41 Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/56 for VoIP communications
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/8016 based on quality of service [QoS]
• CPC Class Codes: H04M 15/81 Dynamic pricing, e.g. change of tariff during call
• CPC Class Codes: H04M 2215/0112 Dynamic pricing, e.g. change of tariff during call
• CPC Class Codes: H04M 2215/0164 Billing record, e.g. Call Data Record [CDR], Toll Ticket[TT], Automatic Message Accounting [AMA], Call Line Identifier [CLI], details, i.e. parameters, identifiers, structure
• CPC Class Codes: H04M 2215/0188 Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04M 2215/202 VoIP; Packet switched telephony
• CPC Class Codes: H04M 2215/22 Bandwidth or usage-sensitve billing
• CPC Class Codes: H04M 2215/7414 QoS
• CPC Class Codes: H04M 3/2218 Call detail recording
• CPC Class Codes: H04M 7/006 : Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42
• CPC Class Codes: H04Q 2213/13034 : A/D conversion, code compression/expansion
• CPC Class Codes: H04Q 2213/1305 : Software aspects
• CPC Class Codes: H04Q 2213/13093 : Personal computer, PC
• CPC Class Codes: H04Q 2213/1313 : Metering, billing
• CPC Class Codes: H04Q 2213/13166 : Fault prevention
• CPC Class Codes: H04Q 2213/13175 : Graphical user interface [GUI], WWW interface, visual indication
• CPC Class Codes: H04Q 2213/13196 : Connection circuit/link/trunk/junction, bridge, router, gateway
• CPC Class Codes: H04Q 2213/13204 : Protocols
• CPC Class Codes: H04Q 2213/13209 : ISDN
• CPC Class Codes: H04Q 2213/1325 : Priority service
• CPC Class Codes: H04Q 2213/13337 : Picturephone, videotelephony
• CPC Class Codes: H04Q 2213/13349 : Network management
• CPC Class Codes: H04Q 2213/13389 : LAN, internet
• CPC Class Codes: H04Q 3/0079 : involving restoration of networks, e.g. disaster recovery, self-healing networks

Abstract

A method and apparatus for reconstructing sessions on a network is described. The method allows for monitoring of quality of service at an application level as well as for understanding application specific events. This allows the method to be used to generate service detail records for usage based on application type for use in billing. It also allows the qualitative and quantitative analysis of quality of service based on application specific parameters. For example, for web applications, quality of service can be measured by the time from requesting a link till the close of the session by delivery of the whole page. Similarly, for voice over IP calls, application events like adding participants and removing participants can be detected and billed accordingly. Also, the quality of service can be measured. For example, the actual latency can be compared to a predetermined latency amount set by a provider for voice over IP calls. Additionally, service detail records can be generated based on application specific events instead of generic flows, so usage billing can be performed based on factors such as a price per minute per leg, etc, with application specific events generated each time a leg is added or dropped. Further, because the periodicity of the output can be controlled on a per application basis, output for voice over IP calls can be generated more often than for other applications. Additionally, embodiments of the invention can reconstruct sessions that are flowing across multiple network devices.

Claims

1. A method for gathering statistics associated with a network session, comprising:

receiving a plurality of packets including payload text portions at a plurality of analyzers;

analyzing the plurality of packets including the payload text portions thereof to identify a plurality of flows;

identifying a session associated with the plurality of flows;

identifying at least one application associated with the session;

reconstructing the session utilizing the identified application;

analyzing the reconstructed session;

gathering a plurality of statistics associated with the session based on the analysis;

determining a policy;

outputting records reflecting the statistics; and

wherein an accounting operation is performed based on the records and the policy;

wherein an aspect associated with the output of the records is based on the identified application;

wherein the statistics include at least three of the following;

start time, end time, time since last output, number of packets, number of bytes, average time between packets, moving average, latency, throughput, jitter, and an application specific statistic;

wherein a plurality of reports are outputted including a plurality of the statistics records in terms of the identified application.

2. Tile method as recited in claim 1, wherein the statistics include the start time, the end time, the time since last output, the number of packets, the number of bytes, the average time between packets, the moving average, the latency, the throughput, and the jitter.

3. The method as recited in claim 1, wherein the statistics are gathered from a plurality of layers of a network protocol.

4. The method as recited in claim 3, wherein the layers of the network protocol include a physical layer, a data link layer, a network layer, a transport layer, a session layer, a presentation layer, and an application layer.

5. The method as recited in claim 1, and further comprising filtering the packets for removing packets unrelated to the session.

6. The method as recited in claim 1, and further comprising gathering a plurality of flow statistics associated with the plurality of flows.

7. The method as recited in claim 6, wherein the flow statistics include timestamps.

8. The method as recited in claim 7, wherein the timestamps are used to generate the statistics associated with the session.

9. The method as recited in claim 1, wherein the reports are outputted at an interval.

10. The method as recited in claim 1, wherein the reports are outputted at an application-specific interval.

11. The method as recited in claim 1, wherein the statistics are gathered based on the policy.

12. A computer readable storage medium including program instruction/codes executable by a computer processor for gathering statistics associated with a network session, comprising:

computer code for receiving a plurality of packets including payload text portions at a plurality of analyzers;

computer code for analyzing the plurality of packets including the payload text portions thereof to identify a plurality of flows;

computer code for identifying a session associated with the plurality of flows;

computer code for identifying at least one application associated with the session;

computer code for reconstructing the session utilizing the identified application;

computer code for analyzing the reconstructed session;

computer code for gathering a plurality of statistics associated with the session based on the analysis;

computer code for determining a policy;

computer code for outputting records reflecting the statistics; and

wherein an accounting operation is performed based on the records and the policy;

wherein an aspect associated with the output of the records is based on the identified application;

wherein an aspect associated with the output of the records is based on the identified application;

wherein the statistics include at least three of the following;

start time, end time, time since last output, number of packets, number of bytes, average time between packets, moving average, latency, throughput, jitter, and an application specific statistic;

wherein a plurality of reports are outputted including a plurality of the statistics records in terms of the identified application.

13. The computer program product as recited in claim 12, wherein the statistics include the staff time, the end time, the time since last output, the number of packets, the number of bytes, the average time between packets, the moving average, the latency, the throughput, and the jitter.

14. The computer program product as recited in claim 12, wherein the statistics are gathered from a plurality of layers of a network protocol.

15. The computer program product as recited in claim 14, wherein the layers of the network protocol include a physical layer, a data link layer, a network layer, a transport layer, a session layer, a presentation layer, and an application layer.

16. The computer program product as recited in claim 12, and further comprising computer code for filtering the packets for removing packets unrelated to the session.

17. The computer program product as recited in claim 12, and further comprising computer code for gathering a plurality of flow statistics associated with the plurality of flows.

18. The computer program product as recited in claim 17, wherein the flow statistics include timestamps.

19. The computer program product as recited in claim 18, wherein the timestamps are used to generate the statistics associated with the session.

20. The computer program product as recited in claim 12, wherein the reports are outputted at an interval.

21. The computer program product as recited in claim 12, wherein the reports are outputted at an application-specific interval.

22. The computer program product as recited in claim 12, wherein the statistics are gathered based on the policy.

23. A method for gathering statistics associated with a network session, comprising:

receiving a plurality of packets including payload text portions at a plurality of analyzers;

analyzing the plurality of packets including the payload text portions thereof to identify a plurality of flows;

identifying a session associated with the plurality of flows;

identifying at least one protocol associated with the session;

reconstructing the session utilizing the identified protocol;

analyzing the reconstructed session;

gathering a plurality of statistics associated with the session based on the analysis;

determining a policy;

outputting records reflecting the statistics; and

wherein an accounting operation is performed based on the records and the policy;

wherein an aspect associated with the output of the records is based on the identified application;

wherein the statistics include at least three of the following;

start time, end time, time since last output, number of packets, number of bytes, average time between packets, moving average, latency, throughput, jitter, and an application specific statistic;

wherein a plurality of reports are outputted including a plurality of the statistics records in terms of the identified protocol.