Method and apparatus for monitoring network traffic and determining the timing associated with an application

• US 8,489,679 B2
• Filed: 08/16/2011
• Issued: 07/16/2013
• Est. Priority Date: 08/16/2011
• Status: Active Grant

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: Fluke Corporation (Fortive Corp.)
• Inventors: Jiang, Long, Tai, Charles
• Primary Examiner(s): SALL, EL HADJI MALICK
• Application Number:
  US13/211,223
• Publication Number:
  US 20130046809A1
• Time in Patent Office: 700 Days
• Field of Search: 709/224, 709/223, 709/203, 726/3, 726/22
• US Class Current: 709/203
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/0864 Round trip delays

Abstract

A method and apparatus is disclosed herein for monitoring network traffic. In one embodiment, the method comprises monitoring, using a monitoring device located near a first end of one segment of a connection with a client and a server in a network, packets that are part of an initial TCP handshake between the client and the server and determining a network time, a server time, and a client time based on information collected when monitoring the one segment.

Claims

1. A method comprising:

monitoring, using a monitoring device located near a first end of one segment of a connection between a client and a server in a network, at least packets of an initial transmission control protocol handshake between the client and the server; and

determining by the monitoring device a network time, a server time, and a client time based on information collected when monitoring the one segment, wherein the determining comprises at least;

classifying client and server packets based on one or more transmission control protocol turns in a message exchange on the one segment, wherein each of the one or more transmission control protocol turns comprises at least one request message and at least one response message to the at least one request message;

identifying a network roundtrip time based on the classifying the client and server packets;

identifying a first time period corresponding to a total time that transpires after each transmission control protocol turn from the one segment, and

determining a second end time period for a second end of a further segment of the connection between the client and the server, the further segment not comprising the monitoring device, by subtracting the network roundtrip time from the first time period; and

determining a first end time period by subtracting a total of the network roundtrip times for all of the one or more transmission control protocol turns and a total of the times of the second end for all of the one or more transmission control protocol turns from a total time associated with the message exchange.

2. The method defined in claim 1, wherein the network time is a total time that the connection uses due to network delays and one or more retries, if any, the client time is time spent at the client including client idle time and client response delays, and the server time is time spent at the server, including server idle time and server response delays.

3. The method defined in claim 1, further comprising determining an average network delay for a session based on information received from monitoring the packets of the initial transmission control protocol handshake.

4. The method defined in claim 1, wherein if the first end comprises a client side of the one segment and the second end comprises a server side of the further segment, then the first end time period and the second end time period comprise the client time and the server time respectively, and further wherein if the first end comprises a server side of the one segment and the second end comprises a client side of the further segment, then the first end time period and the second end time period comprise the server time and the client time respectively.

5. The method defined in claim 1, wherein the determining of the network time, the server time and the client time further comprises determining whether the monitoring device is monitoring of the packets at a server side of the one segment or a client side of the one segment based on a delay between sending the first message from the first end of the segment and subsequently receiving the second message from the second end of the further segment opposite to the first end.

6. The method defined in claim 1 wherein identifying the roundtrip time as the larger of the roundtrip time for two response messages during the initial transmission control protocol handshake.

7. The method defined in claim 1, further comprising using the roundtrip time as the network time and subtracting the roundtrip time from a delta time of the response packet if a time is greater than or equal to the roundtrip time.

19. The method of claim 1, wherein the determining the network time, the server time, and the client time comprises at least finding out by the monitoring device whether the monitoring device is located on a client side or on a server side.

8. A computer program product comprising one or more non-transitory computer readable storage media storing a computer program code, the computer program code comprising:

code for monitoring, using a monitoring device located near a first end of one segment of a connection between a client and a server in a network, at least packets of an initial transmission control protocol handshake between the client and the server; and

code for determining by the monitoring device a network time, a server time, and a client time based on information collected when monitoring the one segment, wherein the determining comprises at least;

code for classifying client and server packets based on one or more transmission control protocol turns in a message exchange on the one segment, wherein each of the one or more transmission control protocol turns comprises at least one request message and at least one response message to the at least one request message;

code for identifying a network roundtrip time based on the classifying the client and server packets;

code for identifying a first time period corresponding to a total time that transpires after each transmission control protocol turn from the one segment, and

code for determining a second end time period for a second end of a further segment of the connection between the client and the server, the further segment not comprising the monitoring device, by subtracting the network roundtrip time from the first time period; and

code for determining a first end time period by subtracting a total of the network roundtrip times for all of the one or more transmission control protocol turns and a total of the times of the second end for all of the one or more transmission control protocol turns from a total time associated with the message exchange.

9. The computer program product of claim 8, wherein the network time is a total time that the connection uses due to network delays and one or more retries, if any, the client time is time spent at the client including client idle time and client response delays, and the server time is time spent at the server, including server idle time and server response delays.

10. The computer program product of claim 8, wherein the method further comprises determining an average network delay for a session based on information received from monitoring the packets of the initial transmission control protocol handshake.

11. The computer program product of claim 8, wherein if the first end comprises a client side of the one segment and the second end comprises a server side of the further segment, then the first end time period and the second end time period comprise the client time and the server time respectively, and further wherein if the first end comprises a server side of the one segment and the second end comprises a client side of the further segment, then the first end time period and the second end time period comprise the server time and the client time respectively.

12. The computer program product of claim 8, wherein the computer program code further comprises code for determining whether the monitoring device is monitoring of the packets at a server side of the one segment or a client side of the one segment based on a delay between sending the first message from the first end of the segment and subsequently receiving the second message from the second end of the further segment opposite to the first end.

20. The computer program product of claim 8, wherein determining the network time, the server time, and the client time comprises at least finding out by the monitoring device whether the monitoring device is located on a client side or on a server side.

13. A monitoring device for use in a network having a client and a server communicating with each other over a connection, the monitoring device located near a first end of one segment of the connection, the monitoring device comprising:

a network interface configured to couple to the network;

a memory; and

an analyzer coupled to the network interface and the memory to monitor packets that are part of an initial transmission control protocol handshake between the client and the server and determine a network time, a server time, and a client time based on information collected when monitoring the one segment,

wherein determining a network comprises;

classifying client and server packets based on one or more transmission control protocol turns in a message exchange on the one segment, wherein each of the one or more transmission control protocol turns comprises at least one request message and at least one response message to the at least one request message;

identifying a network roundtrip time based on the classifying the client and server packets;

identifying a first time period corresponding to a total time that transpires after each transmission control protocol turn from the one segment, and

determining a second end time period for a second end of a further segment of the connection between the client and the server, the further segment not comprising the monitoring device, by subtracting the network roundtrip time from the first time period; and

determining a first end time period by subtracting a total of the network roundtrip times for all of the one or more transmission control protocol turns and a total of the times of the second end for all of the one or more transmission control protocol turns from a total time associated with the message exchange.

14. The device defined in claim 13, wherein the network time is a total time that the connection uses due to network delays and one or more retries, if any, the client time is time spent at the client including client idle time and client response delays, and the server time is time spent at the server, including server idle time and server response delays.

15. The device defined in claim 13, wherein the analyzer is operable to determine a network delay for a session based on information received from monitoring the packets of the initial transmission control protocol handshake.

16. The device defined in claim 13, wherein if the first end comprises a client side of the one segment and the second end comprises a server side of the further segment, then the first end time period and the second end time period comprise the client time and the server time respectively, and further wherein if the first end comprises a server side of the one segment and the second end comprises a client side of the further segment, then the first end time period and the second end time period comprise the server time and the client time respectively.

17. An apparatus comprising:

a processing system comprising at least one processor and a memory storing a set of computer instructions, the apparatus is located near a first end of one segment of a connection between a client and a server in a network, in which the processing system is arranged to cause the apparatus to;

monitor at least packets of an initial transmission control protocol handshake between the client and the server; and

determine a network time, a server time, and a client time based on information collected when monitoring the one segment, wherein the determining of the network time, the server time, and the client time is performed by the processing system arranged to cause the apparatus to;

classify client and server packets based on one or more transmission control protocol turns in a message exchange on the one segment, wherein each of the one or more transmission control protocol turns comprises at least one request message and at least one response message to the at least one request message;

identify a network roundtrip time based on the classifying the client and server packets;

identify a first time period corresponding to a total time that transpires after each transmission control protocol turn from the one segment, and

determine a second end time period for a second end of a further segment of the connection between the client and the server, the further segment not comprising the monitoring device, by subtracting the network roundtrip time from the first time period; and

determine a first end time period by subtracting a total of the network roundtrip times for all of the one or more transmission control protocol turns and a total of the times of the second end for all of the one or more transmission control protocol turns from a total time associated with the message exchange.

18. The apparatus of claim 17, wherein the processing system is arranged to cause the apparatus to determine the network time, the server time, and the client time by finding out whether the monitoring device is located on a client side or on a server side.