Sniffing-based network monitoring

• US 7,936,694 B2
• Filed: 03/30/2007
• Issued: 05/03/2011
• Est. Priority Date: 04/03/2006
• Status: Active Grant

• Current Assignee: Valtrus Innovations Limited (f/k/a Dolya Holdco 9 Limited) (Key Patent Innovations Limited)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Choudhury, Jonmejoy Das
• Primary Examiner(s): Ferris; Derrick W
• Assistant Examiner(s): GHOWRWAL, OMAR J
• Application Number:
  US11/729,864
• Publication Number:
  US 20070230361A1
• Time in Patent Office: 1,495 Days
• Field of Search: 370/252, 370/229, 370/235, 370/237, 370/241, 370/242, 370/244, 370/248, 370/250, 370/351, 370/389, 370/392, 709/224, 379/1.01, 379/27.01, 379/27.02, 379/27.03, 379/27.04, 379/32.01, 379/33, 726/1, 726/2, 726/3, 726/21, 726/22, 726/23, 726/25, 726/26
• US Class Current: 370/252
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0226 Mapping or translating multiple network management protocols
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/087 Jitter
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/55 Testing of service level quality, e.g. simulating service usage
• CPC Class Codes: H04L 65/1026 at the edge
• CPC Class Codes: H04L 65/103 in the network
• CPC Class Codes: H04L 65/1036 at the edge
• CPC Class Codes: H04L 65/104 in the network
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/80 Responding to QoS

Abstract

A method is provided of monitoring a packet-switched network via which real-time data is transmitted. Data packets containing real-time data are sniffed by a monitor subagent to monitor a quality-of-service parameter. A monitor agent is notified in response to a breach of the threshold of the quality-of-service parameter about the breach. A network node manager is notified about the breach, and a root cause analysis is performed.

Claims

1. A method of monitoring a packet-switched network via which real-time data is transmitted, the method comprising:

in response to signaling messages issued by a media gateway controller, non-promiscuously sniffing only data packets of a Voice over Internet Protocol (VoIP) phone call, said data packets containing real-time data, said non-promiscuous sniffing conducted by a monitor subagent to monitor a quality-of-service parameter, said monitor subagent accepting commands from a softswitch to start and stop the non-promiscuous sniffing such that unnecessary non-promiscuous sniffing in an absence of Real-Time Transport Protocol (RTP) traffic does not occur, wherein the sniffing is with regard to at least one of RTP packets and RTP Control Packets (RTCP), wherein said real-time data is encapsulated with a Real-Time Transport Protocol (RTP) header and a Real-Time Transport Protocol (RTP) trailer and said Real-Time Transport Protocol (RTP) header and said Real-Time Transport Protocol (RTP) trailer are encapsulated with a user datagram protocol (UDP) header and a user datagram protocol (UDP) trailer;

notifying, in response to a threshold breach of the quality-of-service parameter detected via said non-promiscuous sniffing, a monitor agent about the threshold breach;

forwarding to the media gateway controller the threshold breach of the quality-of-service parameter, the media gateway controller then adapting to changed network conditions indicated by the quality-of-service parameter by directing media entities to renegotiate bandwidth communication for a higher bandwidth communication for the VoIP phone call;

notifying, by the monitor agent, a network node manager about the threshold breach, wherein the network node manager is a hardware entity comprising computer code stored thereon; and

determining, by the network node manager via responsive initiation and performance of a path analysis, a root cause of a fault of the threshold breach.

2. The method of claim 1, wherein the determining of the root cause of the fault enables Service Level Agreement (SLA) management.

3. The method of claim 1, further comprising reporting the root cause to a user.

4. The method of claim 1, wherein the quality-of-service parameter comprises one of egress delay, ingress delay, jitter, roundtrip delay, packet loss, throughput, instantaneous signal loss, and accumulated content loss.

5. The method of claim 1, wherein notifying a network node manager comprises sending a trap to the network node manager.

6. The method of claim 5, wherein sending a trap comprises sending a simple network management protocol (SNMP)-trap.

7. The method of claim 1, wherein the path analysis comprises examining interfaces of network devices lying on a path.

8. The method of claim 1, wherein the monitor subagent cooperates with determining the root cause of the fault.

9. The method of claim 1, wherein the network node manager comprises a path analysis subsystem and a root cause analysis subsystem.

10. The method of claim 1, wherein an alert is triggered in response to breaching a threshold.

11. The method of claim 1, wherein a “

what-if”

analysis is performed based on performance data stored in a data warehouse.

12. A system for monitoring a packet-switched network via which real-time data is transmitted, the system comprising:

one or more monitor subagents configured to;

in response to signaling messages issued by a media gateway controller, non-promiscuously sniff only data packets of a Voice over Internet Protocol (VoIP) phone call, said data packets containing real-time data to monitor a quality-of-service parameter, said monitor subagent accepting commands from a softswitch to start and stop the non-promiscuous sniffing such that unnecessary non-promiscuous sniffing in an absence of Real-Time Transport Protocol (RTP) traffic does not occur, wherein the sniffing is with regard to at least one of (RTP) RTP packets and RTP control packets (RTCP), wherein said real-time data is encapsulated with a Real-Time Transport Protocol (RTP) header and a Real-Time Transport Protocol (RTP) trailer and said Real-Time Transport Protocol (RTP) header and said Real-Time Transport Protocol (RTP) trailer are encapsulated with a user datagram protocol (UDP) header and a user datagram protocol (UDP) trailer;

notify, in response to a threshold breach of the quality-of-service parameter detected via said non-promiscuous sniffing, a monitor agent about the threshold breach;

forward to the media gateway controller the threshold breach of the quality-of-service parameter, the media gateway controller then adapting to changed network conditions indicated by the quality-of-service parameter by directing media entities to renegotiate bandwidth communication for a higher bandwidth communication for the VoIP phone call; and

the monitor agent configured to notify a network node manager about the threshold breach, wherein the network node manager is a hardware entity comprising computer code stored thereon that, when executed by a processor, causes the network node manager to responsively initiate and perform a path analysis to determine a root cause of a fault of the threshold breach.

13. The system of claim 12, wherein the network node manager is configured to determine the root cause of the fault by performing a path analysis to find out a path over which real-time data is transmitted.

14. A non-transitory computer-readable storage medium having stored thereon, computer-executable instructions that, when executed by a system, causes the system to perform a method comprising:

in response to signaling messages issued by a media gateway controller, non-promiscuously sniffing only data packets of a Voice over Internet Protocol (VoIP) phone call, said data packets containing real-time data, said non-promiscuous sniffing conducted by a monitor subagent to monitor a quality-of-service parameter, said monitor subagent accepting commands from a softswitch to start and stop the non-promiscuous sniffing such that unnecessary non-promiscuous sniffing in an absence of Real-Time Transport Protocol (RTP) traffic does not occur, wherein the sniffing is with regard to at least one of RTP packets and RTP control packets (RTCP), wherein said real-time data is encapsulated with a Real-Time Transport Protocol (RTP) header and a Real-Time Transport Protocol (RTP) trailer and said Real-Time Transport Protocol (RTP) header and said Real-Time Transport Protocol (RTP) trailer are encapsulated with a user datagram protocol (UDP) header and a user datagram protocol (UDP) trailer;

notifying, in response to a threshold breach of the quality-of-service parameter detected via said non-promiscuous sniffing, a monitor agent about the threshold breach;

forwarding to the media gateway controller the threshold breach of the quality-of-service parameter, the media gateway controller then adapting to changed network conditions indicated by the quality-of-service parameter by directing media entities to renegotiate bandwidth communication for a higher bandwidth communication for the VoIP phone call;

notifying, by the monitor agent, a network node manager about the threshold breach, wherein the network node manager is a hardware entity; and

determining, by the network node manager via responsive initiation and performance of a path analysis, a root cause of a fault of the threshold breach.

15. The computer-readable storage medium of claim 14, wherein determining the root cause of the fault comprises performing a path analysis to find out a path over which real-time data is transmitted.