System and method for monitoring and analyzing network traffic

• US 8,406,131 B2
• Filed: 08/14/2008
• Issued: 03/26/2013
• Est. Priority Date: 08/14/2008
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Kotrla, Scott R., DelRegno, Christopher N., Turlington, Matthew W., Bencheck, Michael U., Schell, Richard C.
• Primary Examiner(s): Yao, Kwang B
• Assistant Examiner(s): NGUYEN, ANH NGOC M
• Application Number:
  US12/191,557
• Publication Number:
  US 20100039957A1
• Time in Patent Office: 1,685 Days
• Field of Search: 370/233, 370/253, 370/232, 370/229, 370/230, 370/252, 370/235, 370/389, 370/391
• US Class Current: 370/230.1
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5019 Ensuring fulfilment of SLA
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 47/20 Traffic policing

Abstract

An approach is provided for monitoring and analyzing network traffic. Traffic is monitored during a configurable time interval. A number of bursts associated with the traffic are tracked. A measured traffic rate is generated based on the number of bursts occurring within the time interval. The measured traffic rate is compared with a committed rate to determine if the measured traffic rate exceeds the committed rate.

Claims

1. A method comprising:

monitoring traffic during a configurable time interval at a node;

shaping bursts associated with the traffic according to associated burst lengths, wherein each associated burst length is an amount of traffic stored to a buffer of a shaper of the node during a subinterval of the configurable time interval;

tracking number of shaped bursts;

generating a measured traffic rate based on the number of shaped bursts occurring within the configurable time interval; and

determining whether the measured traffic rate exceeds a committed rate,

wherein each associated burst length is determined based on an amount of traffic received by the node during the subinterval, an amount of traffic stored to the buffer during a previous subinterval, and an amount of traffic to be released from the buffer during the subinterval.

2. A method according to claim 1, wherein the committed rate is specified in a service level agreement associated with a subscriber, the method further comprising:

determining statistics for the shaped bursts;

generating a bursty traffic report using the statistics; and

transmitting the bursty traffic report to the subscriber.

3. A method according to claim 1, wherein the tracking step includes:

counting number of bytes corresponding to the bursts.

4. A method according to claim 1, further comprising:

determining a maximum excess byte count based on the bursts.

5. A method according to claim 1, wherein the configurable time interval has a granularity in order of either a microsecond or a millisecond.

6. A method according to claim 1, wherein the traffic is a flow of one or more data units corresponding to blocks, cells, frames, or packets.

9. A method according to claim 1, further comprising:

mapping the measured traffic rate to a corresponding frequency of occurrence;

determining an active traffic period based on one or more mappings; and

determining an average active traffic rate based on the active traffic period.

7. A method comprising:

monitoring traffic during a configurable time interval at a node;

shaping bursts associated with the traffic according to associated burst lengths, wherein each associated burst length is an amount of traffic stored to a buffer of a shaper of the node during a subinterval of the configurable time interval;

tracking number of shaped bursts;

generating a measured traffic rate based on the number of shaped bursts occurring within the configurable time interval; and

determining whether the measured traffic rate exceeds a committed rate,

wherein individual data units of the traffic are associated with corresponding subintervals of the configurable time interval and the individual data units have corresponding lengths, the method further comprising;

grouping particular data units corresponding to a same subinterval into a group;

summing lengths of the particular data units of the group; and

subtracting a predetermined amount from summation,

wherein an excess length from subtraction corresponds to a burst length for the same subinterval.

8. A method according to claim 7, wherein the excess length is added to summation of lengths of particular data units grouped to a subsequent same subinterval for determining burst length for the subsequent same subinterval.

10. An apparatus comprising:

an interface configured to monitor traffic during a configurable time interval at a node and to shape bursts associated with the traffic according to associated burst lengths, wherein each associated burst length is an amount of traffic stored to a buffer of a shaper of the node during a subinterval of the configurable time interval; and

a processor configured to track number of shaped bursts associated with the traffic, to generate a measured traffic rate based on the number of shaped bursts occurring within the time configurable interval, and to determine whether the measured traffic rate exceeds a committed rate,

wherein each associated burst length is determined based on an amount of traffic received by the node during the subinterval, an amount of traffic stored to the buffer during a previous subinterval, and an amount of traffic to be released from the buffer during the subinterval.

11. An apparatus according to claim 10, wherein the committed rate is specified in a service level agreement associated with a subscriber, the apparatus further comprising:

a communication interface configured to determine statistics for the shaped bursts, to generate a bursty traffic report using the statistics, and to transmit the bursty traffic report to the subscriber.

12. An apparatus according to claim 10, wherein the processor is further configured to count number of bytes corresponding to the bursts when tracking number of bursts.

13. An apparatus according to claim 10, wherein the processor is further configured to determine a maximum excess byte count based on the bursts.

14. An apparatus according to claim 10, wherein the configurable time interval has a granularity in order of either a microsecond or a millisecond.

15. An apparatus according to claim 10, wherein the traffic is a flow of one or more data units corresponding to blocks, cells, frames, or packets.

18. An apparatus according to claim 10, wherein the processor is further configured to map the measured traffic rate to a corresponding frequency of occurrence, to determine an active traffic period based on one or more mappings, and to determine an average active traffic rate based on the active traffic period.

16. An apparatus comprising:

an interface configured to monitor traffic during a configurable time interval at a node and to shape bursts associated with the traffic according to associated burst lengths, wherein each associated burst length is an amount of traffic stored to a buffer of a shaper of the node during a subinterval of the configurable time interval; and

a processor configured to track number of shaped bursts associated with the traffic, to generate a measured traffic rate based on the number of shaped bursts occurring within the time interval, and to determine whether the measured traffic rate exceeds a committed rate,

wherein individual data units of the traffic are associated with corresponding subintervals of the configurable time interval, and individual data units have corresponding lengths, the processor is further configured to group particular data units corresponding to a same subinterval into a group, to sum lengths of the particular data units of the group, and to subtract a predetermined amount from summation, wherein an excess length from subtraction corresponds to a burst length for the same subinterval.

17. An apparatus according to claim 16, wherein the excess length is added to sum of lengths of particular data units grouped to a subsequent same subinterval for determining burst length for the subsequent same subinterval.

19. A system comprising:

a traffic module configured to monitor traffic during a configurable time interval at a node and to shape bursts associated with the traffic according to associated burst lengths, wherein each associated burst length is an amount of traffic stored to a buffer of a shaper of the node during a subinterval of the configurable time interval; and

a server configured to track number of shaped bursts associated with the traffic, to generate a measured traffic rate based on the number of shaped bursts occurring within the time configurable interval, and to determine whether the measured traffic rate exceeds a committed rate,

wherein each associated burst length is determined based on an amount of traffic received by the node during the subinterval, an amount of traffic stored to the buffer during a previous subinterval, and an amount of traffic to be released from the buffer during the subinterval.

20. A system according to claim 19, wherein the server is further configured to filter the bursts according to associated lengths and to determine statistics for the filtered bursts, to generate a bursty traffic report using the statistics, and to transmit the bursty traffic report to a subscriber.

21. A system according to claim 20, further comprising:

a repository configured to store service level agreements of subscribers including the committed rate of service.

22. A system according to claim 19, wherein the server is further configured to count number of bytes corresponding to the bursts when tracking number of bursts and to determine a maximum excess byte count based on the bursts.

23. A system according to claim 19, wherein the configurable time interval has a granularity in order of either a microsecond or a millisecond.