System and method for network flow traffic rate encoding

• US 7,911,975 B2
• Filed: 08/26/2008
• Issued: 03/22/2011
• Est. Priority Date: 08/26/2008
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Stoecklin, Marc, Droz, Patrick, Hurley, Paul, Kind, Andreas
• Primary Examiner(s): Yao; Kwang B
• Assistant Examiner(s): Bokhari; Syed M
• Application Number:
  US12/198,747
• Publication Number:
  US 20100054151A1
• Time in Patent Office: 938 Days
• Field of Search: 370/252, 370/201, 370/230, 370/352, 370/84, 370/254, 704/201
• US Class Current: 370/254
• CPC Class Codes: H04L 43/024 by adaptive sampling
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/067 using time frame reporting

Abstract

A system and method for monitoring packetized traffic flow in a network and enabling approximation of the rate information of a network flow. The method for monitoring network traffic flow includes receiving, at a network packet flow collector device, packetized traffic flow signals to be monitored; sampling said received packetized traffic flow signals in time to form an approximation of the packet flow rate in time; generating packet flow activity data comprising data representing the sampled traffic flow signals sampled in time; communicating the packet flow activity data to a network packet flow analyzer device and processing the flow activity data to form signals representing an approximate version of the network traffic flow in the network, the analyzer processing the traffic flow signals for reconstructing the rate of the netflow as a function of time. The flow analyzer then generates a compressed version of the network traffic flow signals in the network, the compressed network traffic flow signals comprising relevant approximation of the packet flow rate in time.

Claims

1. A network traffic flow monitor system, comprising:

a network packet flow collector device for receiving netflow packets associated with a flow of packets at a network connection and generating traffic flow activity data, said traffic flow activity data comprising data used to calculate an associated packet flow rate as a function of time;

a filter device, at said flow collector device, configured to generate basis coefficient information from said received netflow packets associated with said flow, said traffic flow activity data including said basis coefficient information;

a network packet flow analyzer device for receiving said traffic flow activity data and processing said traffic flow activity data to form signals representing an approximated packet flow rate in time;

a synthesis filter device, at said flow analyzer device, responsive to said basis coefficient information received from said flow activity data to configure said synthesis filter device to process said formed signals and reconstruct the associated packet flow rate as a function of time, and,

wherein said filter device adapts the netflow packets according to a received network packet flow duration, said network packet flow collector device adapting said basis coefficient data of said filter device according to said network packet flow duration, whereby a reporting of network packet flows is improved.

2. The network traffic flow monitor system as claimed in claim 1, wherein said approximation of said packet flow rate in time comprises a compressed version of said network traffic flow signals.

3. The network traffic flow monitor system as claimed in claim 1, further comprising:

a storage device having a fixed amount of storage space at said network packet flow collector device for storing said basis coefficient information prior to said communicating to said network packet flow analyzer device.

4. The network traffic flow monitor system as claimed in claim 1, wherein said filter and synthesis filter devices are configured according to a type of network flow activity data the network packet flow analyzer device is targeting.

5. The network traffic flow monitor system as claimed in claim 1, wherein said filter and synthesis filter device each includes a bank of filters, each filter bank including one or more:

downsampler device for reducing the sampling rate of received netflow packets associated with said flow; and

,

upsampler device for increasing the sampling rate of said received netflow packets associated with said flow.

6. The network traffic flow monitor system as claimed in claim 5, wherein said downsampler device initiates deleting one or more said basis coefficients to account for the increased packet flow duration lengths.

7. The network traffic flow monitor system as claimed in claim 5, wherein said filter and synthesis filter devices each comprise a perfect reconstruction filter bank.

8. The network traffic flow monitor system as claimed in claim 1, further comprising:

quantizer device for mapping the filter device generated basis coefficients into a predetermined value range, wherein said basis coefficients outputs of said filter devices are pre-processed before being provided to said network packet flow analyzer device.

9. The network traffic flow monitor system as claimed in claim 1, wherein said receiving of said netflow packets is adjusted so decreased detailed information is communicated for long packet flow duration, and increased detailed information for shorter packet flow duration.

10. A method for monitoring network traffic flow comprising:

receiving, at a network packet flow collector device, netflow packets associated with a flow of packets at a network connection to be monitored;

generating, from received netflow packets, traffic flow activity data comprising data used to calculate an associated packet flow rate as a function of time;

sampling said received netflow packets in time to form an approximation of said packet flow rate in time;

providing, at said network packet flow collector device, a filter device for generating basis coefficient information from said received netflow packets associated with said flow, said traffic flow activity data including said basis coefficient information; and

,

communicating said traffic flow activity data to a network packet flow analyzer device for receiving said traffic flow activity data and processing said traffic flow activity data to form signals representing an approximated packet flow rate in time; and

configuring, at said flow analyzer device, a synthesis filter device in response to said basis coefficient information received from said traffic flow activity data to process said formed signals and reconstruct the associated packet flow rate as a function of time,

wherein the netflow packets are adapted according to a received network packet flow duration, said network packet flow collector device adapting said basis coefficient data of said filter device according to said network packet flow duration whereby a reporting of network packet flows is improved.

11. The method as claimed in claim 10, wherein said filter device generates a compressed version of said network traffic flow signals in said network, said compressed network traffic flow signals comprising relevant approximation of said packet flow rate in time.

12. The method as claimed in claim 10, further comprising:

providing, at said network packet flow collector device, a storage device having a fixed amount of storage space for storing said basis coefficient information and additional network flow activity data prior to said communicating to said network packet flow analyzer device.

13. The method as claimed in claim 10, further comprising:

configuring said filter and synthesis filter devices according to a type of network flow activity data the network packet flow analyzer device is targeting.

14. The method as claimed in claim 10, further comprising, performing one or more or combination of:

reducing, by one or more downsampler devices implemented at each said filter and synthesis filter device, the sampling rate of received netflow packets associated with said flow; and

,

increasing, by one or more upsampler devices implemented at each said filter and synthesis filter device, the sampling rate of said received netflow packets associated with said flow.

15. The method as claimed in claim 14, further comprising:

deleting, by said downsampler device, one or more said basis coefficients to account for the increased packet flow duration lengths.

16. The method as claimed in claim 14, further comprising:

pre-processing said basis coefficients outputs of said filter devices before being provided to said network packet flow analyzer device, said pre-processing comprising mapping the filter device generated basis coefficients into a predetermined value range.

17. The method as claimed in claim 10, wherein said receiving said netflow packets is adjusted so decreased detailed information is communicated for long packet flow duration, and increased detailed information for shorter packet flow duration.

18. A computer program product for monitoring network traffic flow, the computer program product comprising a non-transitory storage device readable by a processing circuit and storing instructions run by the processing circuit for performing a method, the method comprising:

receiving, at a network packet flow collector device, netflow packets associated with a flow of packets at a network connection to be monitored;

generating, from received netflow packets, traffic flow activity data comprising data used to calculate an associated packet flow rate as a function of time;

sampling said received netflow packets in time to form an approximation of said packet flow rate in time;

providing, at said network packet flow collector device, a filter device for generating basis coefficient information from said received netflow packets associated with said flow, said traffic flow activity data including said basis coefficient information;

communicating said traffic flow activity data to a network packet flow analyzer device for receiving said traffic flow activity data and processing said traffic flow activity data to form signals representing an approximated packet flow rate in time; and

configuring a synthesis filter device, at said flow analyzer device, in response to said basis coefficient information received from said traffic flow activity data, to process said formed signals and reconstruct the associated packet flow rate as a function of time, wherein the netflow packets are adapted according to a received network packet flow duration, said network packet flow collector device adapting said basis coefficient data of said filter device according to said network packet flow duration whereby a reporting of network packet flows is improved.