Methods and computer programs for generating data traffic matrices

• US 8,005,009 B2
• Filed: 06/25/2004
• Issued: 08/23/2011
• Est. Priority Date: 06/25/2004
• Status: Active Grant

• Current Assignee: InMon Corp.
• Original Assignee: InMon Corp.
• Inventors: McKee, Neil, Phaal, Peter
• Primary Examiner(s): Ngo; Ricky
• Assistant Examiner(s): Patel; Chandrahas
• Application Number:
  US10/877,853
• Publication Number:
  US 20050286434A1
• Time in Patent Office: 2,615 Days
• Field of Search: 370/235, 370/229, 370/230, 370/231.1, 370/241, 370/230.1, 370/253, 370/468, 370/231, 370/252, 370/254, 370/395.21, 709/224
• US Class Current: 370/253
• CPC Class Codes: H04L 43/022 by sampling

Abstract

A method and system for monitoring traffic flow includes assigning a subset of sampling points to a node or unique pair of nodes. The sampling points are determined to be the most likely to monitor data traffic, and preferably all data traffic, associated with the node or node pair. The sampling point subset may automatically be determined and assigned to the node or node pair, based, for example, on historical traffic within the network. The method further includes collecting diagnostic network traffic data from the sampling points, and obtaining sampled traffic flow counts for a flow associated with a node pair from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes of the node pair. The method further includes performing a function on the sampled traffic flow counts to obtain an estimated traffic flow count for the respective flow.

Claims

1. A method of monitoring traffic within a network of nodes, the method comprising:

assigning a subset of network traffic sampling points to each unique pair of nodes in the network;

each said subset comprising a plurality of sampling points distributed throughout the network;

collecting diagnostic network traffic data from the sampling points assigned to each node pair in the network;

for a flow associated with each node pair in the network, obtaining sampled traffic flow counts from the diagnostic traffic data collected from the sampling point subset assigned to the node pair;

each set subset comprising a plurality of sampling points, said sampling points adapted to provide diagnostic network traffic data comprising a source address and a destination address even if the flow data passes more than one sampling point; and

for each flow, performing a function on the respective sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

2. The method of claim 1, wherein the flow is a specific traffic flow associated with the node pair.

3. The method of claim 1, wherein the flow is a total traffic flow associated with the node pair.

4. The method of claim 1, further comprising

generating a data traffic matrix containing the estimated traffic flow counts.

5. The method of claim 1, wherein the sampling point subset is assigned to the node pair based on historical traffic data.

6. The method of claim 1, further comprising determining sampling points most likely to monitor all data traffic associated with the node pair, wherein the determined sampling points are included within the sampling point subset.

7. The method of claim 1, wherein the function is a combinatory function.

8. The method of claim 7, wherein each sampling point has a sampling probability, and the combinatory function comprises dividing the sum of the sampled traffic flow counts by the sum of the sampling probabilities.

9. The method of claim 1, wherein the estimated traffic flow count is one of an estimated data packet count, an estimated byte count, and an estimated connection count.

10. The method of claim 1, further comprising deriving a node-specific estimated traffic count for a node of the node pair at least partially from the estimated traffic flow count.

11. A non-transitory medium carrying a computer program having instructions that, when executed, perform a method of monitoring traffic within a network of nodes, comprising:

assigning a subset of network traffic sampling points to each unique pair of nodes within the network of nodes;

each said subset comprising a plurality of sampling points distributed throughout the network;

said sampling points adapted to provide diagnostic network traffic flow comprising a source address and a destination address, even if the flow passes more than one sampling point;

collecting diagnostic network traffic data from the sampling points assigned to each node pair in the network;

for a flow associated with each node pair in the network, obtaining sampled traffic flow counts from the diagnostic traffic data collected from the sampling point subset assigned to; and

for each flow, performing a function on the respective sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

12. The non-transitory medium of claim 11, wherein the flow is a specific traffic flow associated with the node pair.

13. The non-transitory medium of claim 11, wherein the flow is a total traffic flow associated with the node pair.

14. The non-transitory medium of claim 11, wherein the method further comprises

generating a data traffic matrix containing the estimated traffic flow counts.

15. The non-transitory medium of claim 11, wherein the sampling point subset is assigned to the node pair based on historical traffic data.

16. The non-transitory medium of claim 11, further comprising determining sampling points most likely to monitor all data traffic associated with the node pair, wherein the determined sampling points are included within the sampling point subset.

17. The non-transitory medium of claim 11, wherein the function is a combinatory function.

18. The non-transitory medium of claim 17, wherein each sampling point has a sampling probability, and the combinatory function comprises dividing the sum of the sampled traffic flow counts by the sum of the sampling probabilities.

19. The non-transitory medium of claim 11, wherein the estimated traffic flow count is one of an estimated data packet count, an estimated byte count, and an estimated connection count.

20. The non-transitory medium of claim 11, wherein the method further comprises deriving a node-specific estimated traffic count for a node of the node pair at least partially from the estimated traffic flow count.

21. A method of monitoring traffic within a network of nodes, comprising:

assigning a plurality of network traffic sampling points to a source node and a destination node;

said plurality of sampling points distributed throughout the network;

said sampling points adapted to provide diagnostic network traffic data comprising a source address and a destination address;

even if said flow passes more than one sampling point;

collecting diagnostic network traffic data from the sampling points;

obtaining sampled traffic flow counts for a flow associated with the source and destination nodes from the diagnostic traffic data collected from the sampling points; and

performing a combinatory function on the sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

22. The method of claim 21, wherein the flow is a specific traffic flow associated with the source node and destination node.

23. The method of claim 21, wherein the flow is a total traffic flow associated with the source node and destination node.

24. The method of claim 21, further comprising:

assigning network traffic sampling points to the nodes;

for a flow associated with each unique pair of nodes, obtaining sampled traffic flow counts from the diagnostic traffic data collected from the sampling points assigned to source and destination nodes of the respective node pair;

for each flow, performing a function on the respective sampled traffic flow counts to obtain an estimated traffic flow count; and

generating a data traffic matrix containing the estimated traffic flow counts.

25. The method of claim 21, wherein the sampling points are assigned to the source and destination nodes as individual nodes.

26. The method of claim 21, wherein the sampling points are assigned to the source and destination nodes as a unique node pair.

27. The method of claim 21, wherein the sampling points are assigned to the source and destination nodes based on historical traffic data.

28. The method of claim 21, further comprising determining sampling points most likely to monitor all data traffic associated with the source and destination nodes, wherein the determined sampling points are the assigned sampling points.

29. The method of claim 21, wherein each sampling point has a sampling probability, and the combinatory function comprises dividing the sum of the sampled traffic flow counts by the sum of the sampling probabilities.

30. The method of claim 21, wherein the estimated traffic flow count is one of an estimated data packet count, an estimated byte count, and an estimated connection count.

31. A non-transitory medium carrying a computer program having instructions that, when executed, perform a method of monitoring traffic within a network of nodes, comprising:

assigning a plurality of network traffic sampling points to a source node and a destination node;

said plurality of sampling points being distributed throughout the network;

said sampling points adapted to provide diagnostic network traffic data comprising a source address and a destination address;

even if said flow passes more than one sampling point;

collecting diagnostic network traffic data from the sampling points;

obtaining sampled traffic flow counts for a flow associated with the source and destination nodes from the diagnostic traffic data collected from the sampling points; and

performing a combinatory function on the sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

32. The non-transitory medium of claim 31, wherein the flow is a specific traffic flow associated with the source node and destination node.

33. The non-transitory medium of claim 31, wherein the flow is a total traffic flow associated with the source node and destination node.

34. The non-transitory medium of claim 31, wherein the method further comprises:

assigning network traffic sampling points to the nodes;

for a flow associated with each unique pair of nodes, obtaining sampled traffic flow counts from the diagnostic traffic data collected from the sampling points assigned to source and destination nodes of the respective node pair;

for each flow, performing a function on the respective sampled traffic flow counts to obtain an estimated traffic flow count; and

generating a data traffic matrix containing the estimated traffic flow counts.

35. The non-transitory medium of claim 31, wherein the sampling points are assigned to the source and destination nodes as individual nodes.

36. The non-transitory medium of claim 31, wherein the sampling points are assigned to the source and destination nodes as a unique node pair.

37. The non-transitory medium of claim 31, wherein the sampling points are assigned to the source and destination nodes based on historical traffic data.

38. The non-transitory medium of claim 31, wherein the method further comprises determining sampling points most likely to monitor all data traffic associated with the source and destination nodes, wherein the determined sampling points are the assigned sampling points.

39. The non-transitory medium of claim 31, wherein each sampling point has a sampling probability, and the combinatory function comprises dividing the sum of the sampled traffic flow counts by the sum of the sampling probabilities.

40. The non-transitory medium of claim 31, wherein the estimated traffic flow count is one of an estimated data packet count, an estimated byte count, and an estimated connection count.

41. A method of monitoring traffic within a network of nodes, comprising:

obtaining historical network traffic data over a plurality of network traffic sampling points;

said plurality of sampling points being distributed throughout the network;

said sampling points adapted to provide diagnostic network traffic data comprising a source address and a destination address;

even if said flow passes more than one sampling point;

assigning sampling points to the nodes based on the historical traffic data;

obtaining sampled traffic flow counts for a flow associated with the source and destination nodes of a unique pair of nodes from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes; and

performing a function on the sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

42. The method of claim 41, further comprising determining sampling points most likely to monitor all data traffic associated with a node or unique node pair, wherein the determined sampling points are assigned to the node or node pair.

43. The method of claim 41, wherein the sampling points are assigned to the nodes as individual nodes.

44. The method of claim 41, wherein the sampling points are assigned to the nodes as unique node pairs.

45. A non-transitory medium carrying a computer program having instructions that, when executed, perform a method of monitoring traffic within a network of nodes, comprising:

obtaining historical network traffic data over a plurality of network traffic sampling points;

said plurality of sampling points being distributed throughout the network;

said sampling points adapted to provide diagnostic network traffic data comprising a source address and a destination address even if the flow data passes more than one sampling point;

assigning sampling points to the nodes based on the historical traffic data;

obtaining sampled traffic flow counts for a flow associated with source and destination nodes of a unique pair of nodes from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes; and

performing a function on the sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

46. The non-transitory medium of claim 45, wherein the sampling points are assigned to the nodes as unique node pairs.

47. The non-transitory medium of claim 45, wherein the method further comprises determining sampling points most likely to monitor all data traffic associated with a node or unique node pair, wherein the determined sampling points are assigned to the node or node pair.

48. The non-transitory medium of claim 45, wherein the sampling points are assigned to the nodes as individual nodes.

49. A non-transitory medium carrying a computer program having instructions that, when executed, perform a method of monitoring traffic within a network of nodes, comprising:

determining network traffic sampling points distributed throughout the network;

said sampling points adapted to provide diagnostic network traffic flow comprising a source address and a destination address even if the traffic passes more than one sampling point; and

most likely to monitor traffic associated with a source node and a destination node;

assigning the sampling points to the source and destination nodes;

obtaining sampled traffic flow counts for a flow associated with the source and destination nodes from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes; and

performing a function on the sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

50. The non-transitory medium of claim 49, wherein a source subset of sampling points is determined to be most likely to monitor traffic associated with the source node, and a destination subset of sampling points is determined to be most likely to monitor traffic associated with the destination node, and the source and destination sampling point subsets are respectively assigned to the source and destination nodes.

51. The non-transitory medium of claim 49, wherein the sampling points are determined to be most likely to monitor traffic associated with the source and destination nodes as a unique node pair, and the sampling points are assigned to the unique node pair.

52. The non-transitory medium of claim 49, wherein the determined sampling points are most likely to monitor all traffic associated with the source and destination nodes.

53. A method of monitoring traffic within a network of nodes, comprising:

automatically determining network traffic sampling points distributed throughout the network;

said sampling points adapted to provide diagnostic network traffic data comprising a source address and a destination address even if the flow data passes more than one sampling point, most likely to monitor traffic associated with a source node and a destination node; and

automatically assigning the sampling points to the source and destination nodes;

obtaining sampled traffic flow counts for a flow associated with the source and destination nodes from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes; and

performing a function on the sampled traffic flow counts to obtain an estimated traffic flow count for the flow.

54. The method of claim 53, wherein the sampling points are determined to be most likely to monitor traffic associated with the source and destination nodes as a unique node pair, and the sampling points are assigned to the unique node pair.

55. The method of claim 53, wherein the determined sampling points are most likely to monitor all traffic associated with the source and destination nodes.

56. The method of claim 53, wherein a source subset of sampling points is determined to be most likely to monitor traffic associated with the source node, and a destination subset of sampling points is determined to be most likely to monitor traffic associated with the destination node, and the source and destination sampling point subsets are respectively assigned to the source and destination nodes.