Network analysis system and method

• US 7,660,892 B2
• Filed: 01/24/2006
• Issued: 02/09/2010
• Est. Priority Date: 01/24/2005
• Status: Active Grant

• Current Assignee: Daintree Networks Pty Ltd. (GE Aerospace)
• Original Assignee: Daintree Networks Pty Ltd. (GE Aerospace)
• Inventors: Barron, Gregory Joseph, Choong, Jason Yew Choo, Cobb, Peter Graeme, Wood, William Raymond, van Gerrevink, Dean
• Primary Examiner(s): Patel; Ashok B
• Assistant Examiner(s): GOLDBERG, ANDREW C
• Application Number:
  US11/338,532
• Publication Number:
  US 20060168206A1
• Time in Patent Office: 1,477 Days
• Field of Search: 709/224, 702/182, 370/235
• US Class Current: 709/224
• CPC Class Codes: H04L 1/1835 Buffer management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/34 Signalling channels for network management communication
• CPC Class Codes: H04L 41/344 Out-of-band transfers
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 40/00 Communication routing or communication path finding
• CPC Class Codes: H04W 80/02 Data link layer protocols

Abstract

A system for analyzing a packet-based network includes a wireless network analysis processing device that is configured to receive correlated packet records representative of the order in which corresponding packets are transmitted in a wireless network. The correlated packet records include media access control (MAC) layer data and network layer data for each corresponding packet. The MAC layer data and network layer data are processed to generate network topology data representative of the network topology, generate packet flow data representative of the flow of packets between devices at the MAC layer and across the network at the network layer, and measurement data relating to the packet flow data.

Claims

1. A packet-based network analysis system for analyzing packet flow among devices in a ZigBee wireless network, comprising:

a wireless network analysis processing device configured to;

receive a plurality of correlated packet records, the correlated packet records representative of the order in which corresponding packets were transmitted in the network and including media access control (MAC) layer data, application support (APS) layer data, and network layer data for each corresponding packet;

process the MAC layer data and network layer data to generate network topology data representative of the network topology, generate packet flow data representative of the flow of packets between devices at the MAC layer and across the network at the network layer, and generate measurement data relating to the packet flow data; and

process the APS layer data to generate endpoint data and binding data, the endpoint data identifying source endpoints and destination endpoints identified by the correlated packet records and associating each respective source endpoint and destination endpoint with a corresponding device in the network and a corresponding application layer functionality, and the binding data defining a logical link between a source endpoint, cluster identifier, and a destination endpoint;

wherein;

the packet flow data comprises packet flow records, and the wireless network analysis processing device is further configured to;

create a new packet flow record and add packet flow data corresponding to a first hop of a packet in the network if the source MAC address matches the source network address in a corresponding correlated packet record;

add packet flow data corresponding to a last hop of a packet in the network to a packet flow record if the destination MAC address matches the destination network address in a corresponding correlated packet record; and

add packet flow data corresponding to an intermediate hop of a packet in the network to a packet flow record if the destination MAC address does not match the destination network address and the source MAC address does not match the source network address in a corresponding correlated packet record.

2. The packet-based network analysis system of claim 1, wherein:

the wireless network analysis processing device is configured to;

identify packet streams based on a source network layer address and a destination network layer address.

3. The packet-based network analysis system of claim 2, wherein:

the wireless network analysis processing device is configured to;

compare a source MAC address and a destination MAC address to the source network layer address and the destination network layer address to generate packet flow data for the packet streams.

4. The packet-based network analysis system of claim 1, further comprising:

a correlator processor configured to;

receive packet records corresponding to packets communicated over the network and store the packet records in a data store; and

generate the correlated packet records from the packet records stored in the data store, the correlated packet records comprising hop data and timing data representative of the packet path and packet transmission times in the network for each corresponding packet, the correlated packet records filtered of packet records for duplicate packet transmissions and packet retransmissions.

5. The packet-based network analysis system of claim 4, further comprising:

a plurality of capture devices configured to monitor packets communicated over the network and create the corresponding packet records, and wherein each capture device includes a capture clock and each capture device is further configured to include a timestamp in each packet record corresponding to the capture clock time the capture device detects the start of frame of a packet.

6. The packet-based network analysis system of claim 5, wherein:

the correlator is configured to timestamp synchronize the packet records stored in the data store and received packet records by designating a first capture device as a master capture device and time synchronize packet records received from other capture devices to the master capture device.

7. A packet-based network analysis device for analyzing packet flow among devices in a ZigBee wireless network, comprising:

a data store;

a communication subsystem; and

a processing subsystem in data communication with the communication subsystem and the data store;

wherein the packet-based network analysis device is configured to;

receive a plurality of correlated packet records, the correlated packet records representative of the order in which corresponding packets were transmitted in the network and including media access control (MAC) layer data, application support (APS) layer data, network layer data, and packet data for each corresponding packet;

detect new network objects and network topology changes based on the correlated packet records;

extract network object information from the correlated packet records;

generate packet flow data representative of the flow of packets between the network objects;

generate endpoint data and binding data from the correlated packet records, the endpoint data identifying source endpoints and destination endpoints identified by the correlated packet records and associating each respective source endpoint and destination endpoint with a corresponding network object in the network and a corresponding application layer functionality, and the binding data defining a logical link between a source endpoint, cluster identifier, and a destination endpoint;

create a new packet flow record and add packet flow data corresponding to a first hop of a packet in the network if the source MAC address matches the source network address in a corresponding correlated packet record;

add packet flow data corresponding to a last hop of a packet in the network to a packet flow record if the destination MAC address matches the destination network address in a corresponding correlated packet record; and

add packet flow data corresponding to an intermediate hop of a packet in the network to a packet flow record if the destination MAC address does not match the destination network address and the source MAC address does not match the source network address in a corresponding correlated packet record.

8. The packet-based network analysis device of claim 7, wherein:

the packet-based network analysis device is configured to;

detect packet exchanges from the correlated packet records corresponding to an association request frame and a reply to the association request frame to detect new network objects and network topology changes.

9. The packet-based network analysis device of claim 8, wherein:

the packet-based network analysis device is configured to;

identify packet streams based on a source network layer address and a destination network layer address; and

compare a source MAC address and a destination MAC address to the source network layer address and the destination network layer address and detect a packet flow path of packets through the network for each stream based on the comparison.