Real-time network performance monitoring system and related methods

• US 7,711,751 B2
• Filed: 06/13/2003
• Issued: 05/04/2010
• Est. Priority Date: 06/13/2002
• Status: Active Grant

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: NetScout Systems Incorporated
• Inventors: Nadkarni, Rajeev, Kelley, Bruce, Sweet, Bruce, Singhal, Anil, Singhal, Ashwani
• Primary Examiner(s): Cottingham; John R.
• Assistant Examiner(s): Pham; Michael
• Application Number:
  US10/462,220
• Publication Number:
  US 20040054680A1
• Time in Patent Office: 2,517 Days
• Field of Search: 707/10, 707/100, 370/253
• US Class Current: 707/791
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/02 Capturing of monitoring data
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: Y10S 707/922 Communications

Abstract

Network performance data is collected, recorded, and normalized. In one embodiment, a set of first performance data collected by an agent in response to network transactions initiated by the agent and a second set of performance data resulting from passively monitoring traffic on the network are received. The first and second sets of performance data are normalized to create a set of constantly formatted network performance data capable of convenient analysis.

Claims

1. A method of collecting, recording, and normalizing network performance data, the method comprising:

at least one probe receiving from an agent a first set of performance data collected by the agent in response to synthetic network transactions initiated by the agent, the synthetic network transactions being simulated application transactions,

wherein the first set of performance data has at least a first level of network performance information in a set of levels of network performance information in a common data model,

wherein the levels of network performance information in the common data model correspond to types of performance data, with the first level of network performance information corresponding to a first type of performance data, and

wherein the first set of performance data is collected by the agent into a first management information base;

the at least one probe receiving a second set of performance data resulting from passively monitoring network traffic, the second set of performance data comprising a second type of performance data,

wherein the second set of performance data has at least a second level of network performance information in the set of levels of network performance information in the common data model, the second level corresponding to the first type of performance data and another type of performance data.

wherein the second set of performance data is collected into a second management information base, and

wherein the first management information base is different from the second management information base;

the at least one probe deriving a third set of performance data related to the common data model based on at least one of the first set of performance data and the second set of performance data, the third set of performance data having a third type of performance data;

the at least one probe normalizing at least the first set of performance data and the second set of performance data to create normalized network performance data having a single format; and

the at least one probe storing, at a computer, the normalized network performance data in a schema according to the common data model.

2. The method of claim 1, wherein the first set of performance data comprises data related to a response time of a network resource.

3. The method of claim 1, wherein the first set of performance data comprises data related to availability of a network resource.

4. The method of claim 1, wherein the probe is resident at a network interface.

5. The method of claim 4, wherein the network interface is an interface between a computer and a network interface point.

6. The method of claim 5, wherein the network interface point is a switch.

7. The method of claim 5, wherein the network interface point is a router.

8. The method of claim 4, wherein the network interface is an interface between a service provider network and a local site network.

9. The method of claim 1, further comprising storing the normalized network performance data on a server.

10. A computer system for collecting, recording, and normalizing network performance data, the computer system comprising:

a memory;

a computer;

at least one agent connected to a computer network, the agent collecting a first set of performance data related to synthetic network transactions generated by the agent, the synthetic network transactions being simulated application transactions,

wherein the first set of performance data has at least a first level of network performance information in a set of levels of network performance information in a common data model,

wherein the levels of network performance information in the common data model correspond to types of performance data, with the first level of network performance information corresponding to a first type of performance data, and

wherein the first set of performance data is collected into a first management information base;

at least one probe in communication with the agent, the probe comprising;

(i) at least one network interface card,

(ii) a monitor for passively monitoring the network traffic to thereby collect a second set of performance data comprising a second type of performance data,

wherein the second set of performance data has at least a second level of network performance information in the set of levels of network performance information in the common data model, the second level of network performance information corresponding to the first type of performance data and another type of performance data,

wherein the second set of performance data is collected into a second management information base, and

wherein the first management information base is different than the second management information base,

(iii) a deriver for deriving a third set of performance data related to the common data model based on at least one of the first set of performance data and the second set of performance data, the third set of performance data having a third type of performance data, and

(iv) a normalizer for normalizing at least the first set of performance data and the second set of performance data to generate a set of normalized network performance data having a single format; and

a server in communication with at least one network device, the server comprising a storage device for receiving and storing the set of normalized network performance data in a schema according to the common data model.

11. The computer system of claim 10, wherein the at least one network device is a probe.

12. The computer system of claim 11, wherein the probe further comprises an adapter for adapting data received from a plurality of network devices into a single format.

13. A method of actively generating and passively collecting data on a network, the method comprising:

an agent generating a synthetic network transaction for at least one probe, the synthetic network transaction being a simulated application transaction;

the at least one probe collecting, in response to the synthetic network transaction, a first set of performance data related to the synthetic network transaction,

wherein the first set of performance data has at least a first level of network performance information in a set of levels of network performance information in a common data model,

wherein the levels of network performance information in the common data model correspond to types of performance data, with the first level of network performance information corresponding to a first type of performance data, and

wherein the first set of performance data is collected into a first management information base;

the at least one probe passively collecting a second set of performance data related to network transactions, the second set of performance data comprising a second type of performance data,

wherein the second set of performance data has at least a second level of network performance information in the set of levels of network performance information in the common data model, the second level of network performance information corresponding to the first type of performance data and another type of performance data,

wherein the second set of performance data is collected into a second management information base, and

wherein the first management information base is different from the second management information base;

the at least one probe deriving a third set of performance data related to the common data model based on at least one of the first set of performance data and the second set of performance data, the third set of performance data having a third type of performance data;

the at least one probe normalizing at least the first set of performance data and the second set of performance data to generate a set of normalized network transaction data; and

the at least one probe storing, at a computer, the set of normalized network transaction data according to common data model.

14. The method of claim 13 wherein collecting data related to the synthetic network transaction comprises collecting data related to a response time of a network resource.

15. The method of claim 14 wherein collecting data related to the synthetic network transaction further comprises collection data related to availability of a network resource.

16. The method of claim 13 wherein storing the normalized network transaction data comprises storing the normalized network transaction data on a server.

17. A network performance data collection device comprising:

a computer;

a memory;

a probe comprising at least one network interface card;

a monitor, connected to the probe, for passively monitoring network traffic received via the network interface card;

an extractor, connected to the probe, for extracting a first set of network performance data related to at least two different management information bases,

wherein the first set of network performance data results from passively monitoring network traffic.

wherein the first set of network performance data has at least a first level of network performance information in a set of levels of network performance information in a common data model,

wherein the levels of network performance information in the common data model correspond to types of performance data, with the first level of network performance information corresponding to a first type of performance data, and

wherein the first set of network performance data is collected into a first management information base;

an agent for actively generating synthetic network transactions and providing a second set of network performance data comprising a second type of performance data,

wherein the second set of network performance data has at least a second level of network performance information in the set of levels of network performance information in the common data model, the second level of network performance information corresponding to the first type of performance data and another type of performance

a normalizer, connected to the probe, for creating normalized performance data from at least the first set of network performance data collected into a first management information base, and from the second set of network performance data collected into a second management information base,

wherein the first management information base is different from the second management information base, and

wherein the synthetic network transactions comprise simulated application transactions;

a deriver, connected to the probe, for deriving a third set of network performance data related to the common data model based on at least one of the first set of network performance data and the second set of network performance data, the third set of network performance data having a third type of performance data; and

a storage device, connected to the probe, for storing the normalized performance data in a schema according to the common data model.

28. The network performance data collection device of claim 17, wherein the agent extracts the second set of network performance data.

18. A method of collecting data on a network, the method comprising:

capturing passive data by a probe in communication with the network, the passive data having a first type of performance data,

wherein the captured passive data have at least a first level of network performance information in a set of levels of network performance information in a common data model,

wherein the levels of network performance information in the common data model correspond to types of performance data, with the first level of the network performance information corresponding to the first type of performance data, and

wherein the passive data are collected into a first management information base;

receiving a first indicator from an agent in communication with the probe that a synthetic network transaction is beginning, the synthetic network transaction being a simulated application transaction;

receiving a second indicator from the agent that the synthetic network transaction is ending;

capturing data related to the synthetic network transaction from the agent,

wherein the data related to the synthetic network transaction are captured in response to receiving the first indicator until the receiving of the second indicator,

wherein the data related to the synthetic network transaction have a second type of performance data,

wherein the data related to the synthetic network transaction have at least a second level of network performance information in the set of levels of network performance information in the common data model, the second level of network performance information corresponding to the first type of performance data and another type of performance data,

wherein the data related to the synthetic network transaction are collected into a second management information base, and

wherein the first management information base is different from the second management information base;

deriving, at the probe, additional performance data related to the common data model based on at least one of the passive data and the data related to the synthetic network transaction, the additional performance data having a third type of performance data; and

storing, in a computer connected to the probe, the captured passive data, the data related to the synthetic network transaction, and the additional performance data in a schema according to the common data model.

19. The method of claim 18, further comprising normalizing the captured passive data and the captured data related to the synthetic network transaction, thereby generating a set of normalized network transaction data.

20. The method of claim 19, further comprising storing the normalized network transaction data.

21. The method of claim 20, wherein storing the normalized network transaction data comprises storing the normalized network transaction data on a server.

22. The method of claim 21, wherein storing the normalized network transaction data on a server further comprises storing the normalized network transaction data in a database schema according to the common data model.

23. A method of monitoring the performance of a computer network, the method comprising:

receiving a plurality of sets of network performance information at a probe from a plurality of sources, at least one of the plurality of sources comprising an agent,

wherein the sets of network performance information have a first type of performance information,

wherein the sets are stored in at least two different management information bases,

wherein the sets of network performance information have at least a first level of network performance information in a set of levels of network performance information in a common data model, and

wherein the levels of network performance information in the common data model correspond to types of performance information, with the first level of network performance information corresponding to the first type of performance information;

deriving, at the probe, additional network performance information related to the common data model based on the plurality of sets of network performance information,

wherein the additional network performance information has an additional type of performance information that is different from the first type of performance information, and

wherein the additional network performance information has at least an additional level of network performance information in the set of levels of network performance information in the common data model, the additional level of network performance information corresponding to the first type of performance information and the additional type of performance information;

normalizing, at the probe, the plurality of sets of network performance information and the additional network performance information to conform to the common data model used by the probe;

aggregating, at the probe, the normalized network performance information to produce a single result;

storing, in a computer connected to the probe, the aggregated normalized network performance information in a schema according to the common data model; and

providing, at the probe, access to the aggregated normalized network performance information.

24. The method of claim 23, wherein providing access to the aggregated normalized network performance information comprises providing access to the aggregated normalized network performance information in the common data model.

29. The method of claim 23, wherein aggregating the normalized network performance information comprises performing at least one computation using the normalized network performance information.

25. A method of monitoring the performance of a computer network, the method comprising:

receiving a plurality of sets of network performance information at a plurality of source probes, each source probe receiving network performance information stored in a plurality of management information bases and from a plurality of sources, at least one of the plurality of sources comprising an agent,

wherein the sets of network performance information have a first type of performance information,

wherein the plurality of management information bases comprises at least two different management information bases,

wherein the sets of network performance information has at least a first level in a set of levels of network performance information in a common data model, and

wherein the levels of network performance information in the common data model correspond to types of performance information, with the first level corresponding to the first type of performance information

deriving, at a selected probe, additional network performance information related to the common data model based on the plurality of sets of network performance information,

wherein the additional network performance information has an additional type of performance information that is different from the first type of performance information, and

wherein the additional network performance information has at least an additional level of network performance information in the set of levels of network performance information in the common data model, the additional level of network performance information corresponding to the first type of performance information and the additional type of performance information;

transmitting the plurality of sets of network performance information and the additional network performance information to a single destination probe;

incorporating the plurality of sets of network performance information and the additional network performance information received at the single destination probe into common data mode;

aggregating the transmitted information at the destination probe into a single data structure; and

storing, in a computer connected to the destination probe, the aggregated transmitted information in a schema according to the common data model.

26. The method of claim 25, wherein storing the aggregated transmitted information comprises storing the single data structure on a server.

30. The method of claim 25, wherein aggregating the transmitted information comprises performing at least one computation using the transmitted information.

27. A computer system for collecting, recording, and normalizing network performance data, the system comprising:

a memory;

a computer;

a plurality of source probes comprising a plurality of network interface cards, connected to a computer network, the source probes collecting a plurality of sets of network performance data from a plurality of sources on a computer network, at least one of the plurality of sources comprising an agent,

wherein the sets of network performance data have a first type of performance data and are collected into at least two different management information bases,

wherein the sets of network performance data have at least a first level of network performance information in a set of levels of network performance information in a common data model, and

wherein the levels of network performance information in the common data model correspond to types of performance data, with the first level of network performance information corresponding to the first type of performance data;

a destination probe in communication with the source probes, the destination probe comprising

(i) a receiver for receiving the plurality of sets of network performance data from the source probes,

(ii) a deriver for deriving additional network performance data based on the plurality of sets of network performance data,

wherein the additional network performance data have an additional type of performance data that is different from the first type of performance data, and

wherein the additional network performance data have at least an additional level of network performance information in the set of levels of network performance information in the common data model, the additional level of network performance information corresponding to the first type of performance data and the additional type of performance data;

(iii) an aggregation module for aggregating the plurality of sets of network performance data and the additional network performance data into aggregated network performance data having a single format; and

a storage device for storing the aggregated network performance data according to the common data model.

31. The system of claim 27, wherein the aggregation module performs at least one computation using the plurality of sets of network performance data and the additional network performance data.