Network traffic visualization

• US 7,849,408 B1
• Filed: 01/15/2004
• Issued: 12/07/2010
• Est. Priority Date: 04/14/1999
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Swallow, George, Messinger, Fred
• Primary Examiner(s): KE, PENG
• Application Number:
  US10/758,664
• Time in Patent Office: 2,518 Days
• Field of Search: 715733-739, 715/772
• US Class Current: 715/736
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

A system containing a visualization application which enables the user or other user to obtain information about various types of transactions involving the respective activities of the components. The user selects filtering criteria that identify various types of transactions performed on each network component from the visualization application and the visualization application uses these criteria in compiling the appropriate records from the network information files. The visualization application then forms the data that represent the records that meet each selected criterion and stores the data in a local file. Thereafter, the user may view the network activity through the visualization application which displays a map of the network and overlays the map with graphical moving images that represent the data for each selected criterion. The graphical images change with time to reflect changes in the underlying data.

Claims

1. A method for graphically presenting characteristics of data traffic on a distributed computer network, comprising:

monitoring traffic on said network;

storing records relating to said traffic in one or more network information files;

selecting a characteristic of said traffic for display;

obtaining a plurality of values of said characteristic of said traffic from said one or more network information files for a selected plurality of time intervals within a larger time interval; and

displaying a map of a network topology of said network;

presenting said characteristic by playing a rapid succession of graphical images of said map of said network topology, each graphical image representing said network as nodes connected by lines overlaid on said map, said nodes each representing components in said network, said lines representing traffic flow between said components, each graphical image graphically representing the value of said characteristic at a particular selected time interval of said plurality of time intervals within the larger time interval with a property of at least one line of said lines that connect nodes, wherein said property includes a density of said at least one line,

wherein a change in said density of said at least one line that connects nodes in successive graphical images of said map of the network topology indicates a change in the value of said characteristic of said traffic between said components.

2. The method as in claim 1 wherein said density of said at least one line is a width of said at least one line.

3. The method as in claim 1, further comprising:

using a color of said at least one line to further define said property, a change in said color further indicating a change in the value of said characteristic of said traffic.

4. The method as in claim 1, further comprising:

using an arrow drawn on said at least one line to further define said property, a change in said arrow further indicating a change in the value of said characteristic of said traffic.

5. The method as in claim 1, further comprising:

receiving a selection of a filtering expression in a graphical user interface;

selecting records from said network information files; and

executing said filtering expression on the selected records.

6. The method as in claim 5, further comprising:

calculating parameters that are associated with the records selected from said network information files and storing the parameters in a local file.

7. The method as in claim 1, further comprising:

using a filtering program to select records in said network information files that meet selected filtering criteria.

8. The method as in claim 7, further comprising:

compiling the selected records from said network information files, each compiled record meeting at least one selected filtering criterion.

9. The method as in claim 8, further comprising:

calculating data that represent the compiled records, and storing the data in a file.

10. The method of claim 8, further comprising:

including a time interval criterion which indicates how often to compile and package information from the network information files.

11. The method of claim 1, further comprising:

defining the larger time interval with a starting time and an ending time specified within a filtering criteria.

12. A data visualization apparatus for graphically presenting characteristics of data traffic on a distributed computer network, comprising:

means for monitoring traffic on said network;

means for storing records relating to said traffic;

means for selecting characteristics of said traffic for display;

means for obtaining a plurality of values of said characteristics of said traffic from said means for storing for a selected plurality of time intervals within a larger time interval; and

means for displaying a map of a network topology of said network;

means for presenting said characteristics by playing a rapid succession of graphical images of said map of said network topology, each graphical image representing said network as nodes connected by lines overlaid on said map, said nodes each representing components in said network, said lines representing traffic flow between said components, each graphical image graphically representing the value of said characteristics at a particular

time interval of said plurality of time intervals within the larger time interval with a property of at least one line of said lines that connects nodes, wherein said property includes a density of said at least one line,

wherein a change in said density of said at least one line that connects nodes in successive graphical images of said map of said network topology indicates a change in the value of said characteristics of said traffic between said components.

13. The apparatus as in claim 12, wherein said density is a width of said at least one line.

14. The apparatus as in claim 12, further comprising:

means for a using a color of said at least one line to further define said property, a change in said color further indicating a change in the value of said characteristics of said traffic.

15. The apparatus as in claim 12, further comprising:

means for using an arrow drawn on said at least one line to further define said property, a change in said arrow further indicating a change in the value of said characteristics of said traffic.

16. The apparatus as in claim 12, further comprising:

means for receiving a selection of a filtering expression;

means for selecting records from network information files; and

means for executing said filtering expression on the selected records.

17. The apparatus as in claim 16, further comprising:

means for calculating parameters that are associated with the records selected from said network information files and storing the parameters in a local file.

18. The apparatus as in claim 12, further comprising:

means for using a filtering program to select records in network information files that meet selected filtering criteria.

19. The apparatus as in claim 18, further comprising:

means for compiling the selected records from said network information files, each compiled record meeting at least one selected filtering criterion.

20. The apparatus as in claim 19, further comprising:

means for calculating data that represent the compiled records, and storing the data in a file.

21. The apparatus as in claim 19, further comprising:

means for including a time interval criterion which indicates how often to compile and package information from the network information files.

22. The apparatus as in claim 12, further comprising:

means for defining the larger time interval with a starting time and an ending time specified within a filtering criteria.

23. A data visualization apparatus for graphically presenting characteristics of data traffic on a distributed computer network, comprising:

a computer to monitor traffic on said network and store storing records relating to said traffic;

a graphical user interface to select a characteristic of said traffic for display;

a reporting system executing on said computer to obtain a plurality of values of said characteristic of said traffic from said stored records for a selected plurality of time intervals within a larger time interval; and

a visualization system executing on said computer to display a map of a network topology of said network and present said characteristic by playing a rapid succession of graphical images of said map of said network topology, each graphical image representing said network as nodes connected by lines overlaid on said map, said nodes each representing components in said network, said lines representing traffic flow between said components, each graphical image graphically representing the value of said characteristic at a particular selected time interval of said plurality of time intervals within the larger time interval with a property of at least one line of said lines that connect nodes, wherein said property includes a density of said at least one line,

wherein a change in said density of said at least one line that connects nodes in successive graphical images of said map of the network topology indicates a change in the value of said characteristic of said traffic between said components.

24. The apparatus as in claim 23 wherein the density of said at least one line is a width of said at least one line.

25. The apparatus as in claim 23, further comprising:

instructions to execute in said computer to use a color of said at least one line to further define said property, a change in said color further indicating a change in the value of said characteristic of said traffic.

26. The apparatus as in claim 23, further comprising:

instructions to execute in said computer to use an arrow drawn on said at least one line to further define said property, a change in said arrow further indicating a change in the value of said characteristic of said traffic.

27. The apparatus as in claim 23, further comprising:

instructions to execute in said computer to receive a selection of a filtering expression in a graphical user interface;

instructions to execute in said computer to select records from network information files; and

instructions to execute in said computer to execute said filtering expression on the selected records.

28. The apparatus as in claim 27, further comprising:

instructions to execute in said computer to calculate parameters that are associated with the records selected from said network information files and storing the parameters in a local file.

29. The apparatus as in claim 23, further comprising:

instructions to execute in said computer to use a filtering program to select records in network information files that meet selected filtering criteria.

30. The apparatus as in claim 29, further comprising:

instructions to execute in said computer to compile the selected records from network information files each compiled record meeting at least one selected filtering criterion.

31. The apparatus as in claim 30, further comprising:

instructions to execute in said computer to calculate data that represent the compiled records, and storing the data in a file.

32. The apparatus as in claim 30, further comprising:

instructions to execute in said computer to include a time interval criterion which indicates how often to compile and package information from the network information files.

33. The apparatus as in claim 23, further comprising:

instructions to execute in said computer to define the larger time interval with a starting time and an ending time specified within a filtering criteria.

34. A method comprising:

monitoring data traffic in a distributed computer network;

storing records relating to the data traffic in one or more network information files;

selecting a characteristic of the data traffic for display;

extracting data from the network information files related to the selected characteristic for a plurality of time intervals within a larger time interval; and

for each time interval within the larger time interval, generating a frame that visually depicts a map of the network topology of the distributed computer network, with nodes of the map representing network components, the nodes interconnected by lines overlaid on the frame that represent traffic flow between the network components, the frame, that visually depicts the map of the network topology, to visually indicate a value of the characteristic of data traffic between two network components with the visual appearance of a line interconnecting the two nodes representing those two network components; and

playing a rapid succession of frames, that visually depict the map of the network topology, to a user to illustrate changes in the characteristic of the data traffic over the larger time interval, wherein changes in a density of a line interconnecting the two nodes in successive frames indicate changes in the value of the characteristic of the data traffic between the two network components.

35. The method of claim 34 wherein the characteristic of the data traffic is a number of attempted long-ins.

36. The method of claim 34 wherein the characteristic of the data traffic is an amount of data traffic.

37. The method of claim 34 wherein the extracting selects data from the network information files using a filtering expression.