Parallel distributed network monitoring

• US 8,199,641 B1
• Filed: 07/25/2008
• Issued: 06/12/2012
• Est. Priority Date: 07/25/2007
• Status: Active Grant

• Current Assignee: Virtual Instruments Worldwide, Inc.
• Original Assignee: Xangati Incorporated (Virtana Corp.)
• Inventors: Jagannathan, Rangaswamy, Pan, Xiaohong, Kakatkar, Kishor, Lee, Rosanna, Sanders, Derek
• Primary Examiner(s): HAN, CLEMENCE S
• Application Number:
  US12/179,703
• Time in Patent Office: 1,418 Days
• Field of Search: None
• US Class Current: 370/229
• CPC Class Codes: H04L 41/0645 by additionally acting on or stimulating the network after receiving notifications
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

A network monitoring system includes devices receiving network traffic information, and generating at least partial results relating to network symptoms. Those partial results are forwarded to devices processing those partial results and generating information relating to problems in response to those symptoms. Problems are reported to users or sent as notifications. In one embodiment, information relating to network traffic is monitored both by a first set of devices associated with source addresses for that network traffic and a second set of devices associated with destination addresses for that network traffic. Information received by that first set of devices includes information relating to both the source address and destination address of network traffic. That first set of devices processes information relating to the source address of network traffic and forwards information relating to the destination address of network traffic to that second set of devices.

Claims

1. A method, including steps of

receiving a first set of flow information from a first set of flow information generating devices at a first symptom identifying device;

receiving a second set of flow information from a second set of flow information generating devices at a second symptom identifying device;

generating a sequence of virtual packets in response to the first set and the second set of flow information, said sequence including virtual packets that have no payload and are equally distributed over a time reported for either the first set of flow information or the second set of flow information;

generating discovery information in response to the virtual packets, and

sending the discovery information to a problem identifying device.

2. A method as in claim 1, including steps of forwarding at least some flow information from the first symptom identifying device to the second symptom identifying device.

3. A method as in claim 2, wherein said forwarded flow information includes at least some information relating to flows to a destination address.

4. A method as in claim 1, including steps of

generating symptom information for a set of source endpoints in response to said first set of flow information;

and

generating symptom information for a set of destination endpoints in response to said second set of flow information.

5. A method as in claim 4, including steps of forwarding at least some flow information from said first symptom identifying device to said second symptom identifying device.

6. A method as in claim 4, including steps of forwarding at least some flow information from said first symptom identifying device to said second symptom identifying device, wherein that forwarded flow information includes at least some information relating to flows to a destination address.

7. A method as in claim 1, wherein said flow information generating devices include at least one router.

8. A method as in claim 1, wherein

said first set of flow information is responsive to one or more real flows.

9. A method as in claim 1, including steps of

ordering said virtual packets in a time order;

wherein

said step of generating discovery information in responsive to a result of said step of ordering.