Method and monitoring component for network traffic monitoring

• US 8,750,133 B2
• Filed: 10/16/2007
• Issued: 06/10/2014
• Est. Priority Date: 10/16/2007
• Status: Expired due to Fees

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Borsos, Tamas, Tth, Gbor, Malomsoky, Szabolcs
• Primary Examiner(s): Yao, Kwang B
• Assistant Examiner(s): LOO, JUVENA W
• Application Number:
  US12/738,400
• Publication Number:
  US 20100226278A1
• Time in Patent Office: 2,429 Days
• Field of Search: 370229-256, 370229-2362, 370385-399
• US Class Current: 370/242
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic

Abstract

A technique for traffic monitoring in a network comprising monitoring components and a management center (MC) is described. A method implementation comprises the steps of selecting a first set of local identifiers from a larger second set of local identifiers, wherein the local identifiers are capable of providing a unique identification of a network connection at the first monitoring component, filtering network connections, allocating a local identifier of the first set of local identifiers to a network connection in case a filter condition applies during the filtering, checking associations of network traffic with local identifiers, and selectively monitoring network traffic associated with a local identifier from the first set of local identifiers.

Claims

1. A method for monitoring traffic in a network, the network comprising a first monitoring component, the method comprising:

providing a first set of local identifiers selected from a larger second set of local identifiers locally used within a network node to identify a user terminal for monitoring traffic thereof and the first set of local identifiers and the second set of local identifiers provide unique identification of a network connection at the first monitoring component;

filtering incoming connection setup messages;

allocating a local identifier of the first set of local identifiers to the network connection if a filter condition applies during the filtering;

checking incoming data packets for associations with the first set of local identifiers; and

selectively monitoring network traffic associated with the local identifier of the first set of local identifiers.

2. The method according to claim 1, wherein network connections are filtered when network connection set up procedures are performed.

3. The method according to claim 1, wherein the filter condition is based on at least one of a random filtering, a selection of predefined International Mobile Subscriber Identities (IMSI), and a subscriber location-dependent filtering.

4. The method according to claim 1, further comprising:

monitoring only local identifiers of a lowest applicable protocol layer of the network.

5. The method according to claim 1, further comprising:

receiving the filter condition by the first monitoring component from a management center.

6. The method according to claim 1, further comprising:

providing a second monitoring component in the network for traffic monitoring.

7. The method according to claim 6, further comprising:

forwarding the first set of local identifiers from the first monitoring component to the second monitoring component.

8. The method according to claim 1, further comprising:

forwarding the first set of local identifiers from the first monitoring component to a management center.

9. The method according to claim 1, wherein the filter condition is received by a second monitoring component from a management center to enable coordinated traffic monitoring at the first monitoring component and the second monitoring component.

10. The method according to claim 1, further comprising:

logging events associated with monitored network traffic.

11. The method according to claim 10, further comprising:

sending the logged events to a physical monitoring port.

12. The method according to claim 1, wherein the first set of local identifiers is a continuous range of local identifiers.

13. A method for monitoring traffic in a network, the network comprising at least a first monitoring component, the method comprising:

forwarding filter conditions to the at least one monitoring component for filtering incoming connection setup messages; and

receiving a first set of local identifiers from the at least one monitoring component, wherein the first set of local identifiers has been selected from a larger second set of local identifiers and is locally used within a network node to identify a user terminal for monitoring traffic thereof and provide unique identification of a particular network connection.

14. The method according to claim 13, further comprising:

forwarding the filter conditions to a second monitoring component.

15. The method according to claim 13, further comprising:

forwarding the filter conditions to an external capturing device.

16. The method according to claim 13, further comprising:

forwarding the first set of local identifiers to a second monitoring component for coordinated traffic monitoring.

17. The method according to claim 13, further comprising:

forwarding the first set of local identifiers to an external capturing device for coordinated traffic monitoring.

18. A monitoring component for monitoring traffic in a network, the monitoring component comprising:

a processor; and

a non-transitory computer-readable medium, coupled to the processor, the non-transitory computer-readable medium comprising computer-readable instructions, when executed by the processor, are configured to;

provide a first set of local identifiers selected from a larger second set of local identifiers locally used within a network node to identify a user terminal for monitoring traffic thereof and provide a unique identification of a network connection at the monitoring component,

filter incoming connection setup messages,

allocate a local identifier of the first set of local identifiers to a network connection if a filter condition applies when filtering incoming connection setup messages,

check incoming data packets for associations with the first set identifiers, and

selectively monitor network traffic associated with the local identifier of the first set of local identifiers.

19. A management center for monitoring traffic in a network, the management center comprising:

a processor;

a non-transitory computer-readable medium, coupled to the processor, the non-transitory computer-readable medium comprising computer-readable instructions, when executed by the processor, are configured to;

forward filter conditions to at least one monitoring component for filtering incoming connection setup messages; and

an interface adapted to receive a first set of local identifiers from the at least one monitoring component, wherein the first set of local identifiers has been selected from a larger second set of local identifiers and is locally used within a network node to identify a user terminal for monitoring traffic thereof and provide a unique identification of a particular network connection.