Network sniffer for performing service level management

• US 8,892,737 B2
• Filed: 03/06/2007
• Issued: 11/18/2014
• Est. Priority Date: 03/06/2006
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Wexler, Asaf, Dembak, Yoav
• Primary Examiner(s): Dharia, Rupal
• Assistant Examiner(s): Ma, Wing
• Application Number:
  US11/682,433
• Publication Number:
  US 20070208852A1
• Time in Patent Office: 2,814 Days
• Field of Search: 709/223, 709/224, 709/226, 709/219
• US Class Current: 709/226
• CPC Class Codes: G06F 2201/87 Monitoring of transactions
• CPC Class Codes: G06F 9/505 considering the load
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30

Abstract

A network sniffer where the sniffer learns the structure of a web application, monitors the operation of the application, and optionally controls the processing of incoming requests to achieve optimal performance as defined in a service level agreement (SLA). The network sniffer is operative for example in enterprise web applications and in enterprise data centers that deploy web applications and optimally is adapted to maintain a consistent level of service of web applications.

Claims

1. A network sniffer for passively capturing data traffic flows between a plurality of clients and a plurality of web servers, the network sniffer comprising:

a traffic processor for processing data traffic sent from the plurality of clients and from the plurality of web servers, wherein the traffic processor is configured to collect contexts by parsing each request for content from each of the plurality of clients to retrieve a context, wherein the context includes at least one of a web server name and request parameters;

an application learner for identifying transactions sent from the plurality of clients, wherein the application learner is configured to determine if the each request for content belongs to a previously discovered application, and when the each request for content has been determined as belonging to the previously discovered application, the application learner is configured to assign an application identification of the previously discovered application to the context that is retrieved by parsing the each request for content;

a monitor for monitoring and generating statistics respective of the operation of the web servers and their respective web applications; and

a controller for performing a corrective action when a predefined policy has been violated, wherein the predefined policy defines a minimum allowable throughput for an application, wherein the corrective action comprises stalling traffic directed to a server that executes the application, wherein a result of the corrective action is monitored to determine whether at least one monitored parameter is improved due to the corrective action and the controller is updated with a next corrective action to activate when a subsequent request is received based on the monitored result,

wherein at least one of the traffic processor, the application learner and the monitor is implemented in hardware or stored in a memory.

2. The network sniffer of claim 1, further comprising a common bus for providing a communication medium between the traffic processor, the application learner, the monitor, and the controller.

3. The network sniffer of claim 2, wherein the network sniffer is connected to a load balancer through a dedicated port.

4. The network sniffer of claim 3, wherein the dedicated port is a switch port analyzer (SPAN).

5. The network of claim 2, wherein the network sniffer is connected through a dedicated port to a switch, wherein the switch is coupled to the plurality of web servers.

6. The network sniffer of claim 2, wherein the network sniffer is connected to a network tap device to monitor traffic flow between a switch and a load balancer.

7. The network sniffer of claim 3, wherein the network sniffer is coupled to a plurality of traffic probes, wherein each of the traffic probes is connected to a web server.

8. The network sniffer of claim 1, wherein a web server includes a web application, and wherein the network sniffer is configured to send the context to one of the plurality of web servers.

9. The network sniffer of claim 1, wherein the traffic sent from the clients includes at least hypertext protocol (HTTP) requests, and wherein the context includes the web server name, an HTTP method, a URL, the request parameters, HTTP cookies, an HTTP status code, an HTTP server, an HTTP content type, an HTTP content length and an HTML title field.

10. The network sniffer of claim 1, wherein the traffic sent from the plurality of web servers includes at least HTTP replies.

11. The network sniffer of claim 10, the application learner further performing at least one of the following tasks:

discovering transactions executed by the plurality of web servers;

classifying incoming requests to discovered web transactions;

collecting non-classified incoming requests; and

generating a site tree.

12. The network sniffer of claim 11, wherein the site tree includes all identified applications that belong to a designated web site, wherein each identified application includes a list of transaction that construct the application.

13. The network sniffer of claim 11, wherein the collected incoming requests are saved in a first database coupled to the application learner.

14. The network sniffer of claim 13, wherein discovering the transactions further comprises:

processing requests saved in the first database using at least a plurality of application definers; and

saving information related to the discovered web applications in a classify data structure (CDS).

15. The network sniffer of claim 14, wherein the CDS includes a list of identified sites, for each site a list of its web applications, and for each web application a list of transactions and modules that construct the web application.

16. The network sniffer of claim 15, wherein the CDS is saved in a second database, wherein the second database is coupled to the application learner.

17. The network sniffer of claim 1, wherein the statistics respective of the operation of the web servers are generated for each transaction and include the following measures:

throughput, response time, number of errors, latency, and hits per second.

18. The network sniffer of claim 17, wherein the generated statistics are saved in a third database that is coupled to the monitor.

19. The network sniffer of claim 1, wherein the monitor produces a plurality of reports and a plurality of alerts based on the generated statistics.

20. The network sniffer of claim 1, wherein the controller performs corrective actions according to a plurality of predefined policies, wherein the corrective actions include scheduling requests to reduce response time, shaping traffic to balance the load, and recovery actions on web servers when one of the web servers fails.

21. The network sniffer of claim 20, wherein each of the plurality of predefined policies defines at least one corrective action to be preformed.

22. The network sniffer of claim 21, wherein a policy is determined for a web server, a web application, a module, and a transaction.

23. The network sniffer of claim 21, wherein each policy is assigned with a priority and time periods to be activated.

24. The network sniffer of claim 1, wherein when the corrective action has not made a difference to the at least one monitored parameter, the controller is less likely to activate the corrective action when the subsequent request is received.

25. A method for passively capturing data traffic flows between a plurality of clients and a plurality of web servers, the method comprising:

processing data traffic sent from the plurality of clients and from the plurality of web servers, comprising collecting contexts by parsing each request for content from each of the plurality of clients to retrieve a context, wherein the context includes at least one of a web server name and request parameters;

identifying transactions sent from the plurality of clients, comprising determining if the each request for content belongs to a previously discovered application, and when the each request for content has been determined as belonging to the previously discovered application, assigning an application identification of the previously discovered application to the context that is retrieved by parsing the each request for content;

monitoring and generating statistics respective of the operation of the web servers and their respective web applications;

performing a corrective action when a predefined policy has been violated, wherein the predefined policy defines a minimum allowable throughput for an application, wherein performing the corrective action comprises stalling traffic directed to a server that executes the application; and

monitoring a result of the corrective action to determine whether at least one monitored parameter is improved due to the corrective action and activating a next corrective action when a subsequent request is received based on the monitored result.

26. The method of claim 25, wherein the method comprises performing load balancing or performing traffic probing.

27. The method of claim 25, wherein a web server includes a web application, and wherein the method comprises sending the context to one of the plurality of web servers.

28. The method of claim 25, wherein the traffic sent from the clients includes at least hypertext protocol (HTTP) requests, and wherein the context includes the web server name, an HTTP method, a URL, the request parameters, HTTP cookies, an HTTP status code, an HTTP server, an HTTP content type, an HTTP content length and an HTML title field.

29. The method of claim 25, wherein the traffic sent from the plurality of web servers includes at least HTTP replies.

30. The method of claim 25, wherein identifying the transactions sent from the plurality of clients comprises at least one of:

discovering transactions executed by the plurality of web servers;

classifying incoming requests to discovered web transactions;

collecting non-classified incoming requests; and

generating a site tree.

31. The method of claim 30, wherein the site tree includes all identified applications that belong to a designated web site, and wherein each identified application includes a list of transaction that construct the application.

32. The method of claim 30, wherein identifying the transactions sent from the plurality of clients comprises saving the collected incoming requests in a first database.

33. The method of claim 32, wherein discovering the transactions comprises:

processing requests saved in the first database using at least a plurality of application definers; and

saving information related to the discovered web applications in a classify data structure (CDS).

34. The method of claim 33, wherein the CDS includes a list of identified sites, for each site a list of its web applications, and for each web application a list of transactions and modules that construct the web application.

35. The method of claim 34, wherein identifying the transactions sent from the plurality of clients comprises saving the CDS in a second database.

36. The method of claim 25, wherein monitoring and generating the statistics respective of the operation of the web servers and their respective web applications comprises generating the statistics respective of the operation of the web servers for each transaction, and wherein the statistics comprise:

throughput, response time, number of errors, latency, and hits per second.

37. The method of claim 36, wherein the method comprises saving the generated statistics in a third database.

38. The method of claim 25, wherein the method comprises producing a plurality of reports and a plurality of alerts based on the generated statistics.

39. The method of claim 25, wherein performing the corrective action comprises performing corrective actions according to a plurality of predefined policies, wherein the corrective actions include scheduling requests to reduce response time, shaping traffic to balance the load, and recovery actions on web servers when one of the web servers fails.

40. The method of claim 39, wherein each of the plurality of predefined policies defines at least one corrective action to be preformed.

41. The method of claim 40, wherein the method comprises determining a policy for a web server, a web application, a module, and a transaction.

42. The method of claim 40, wherein the method comprises assigning each policy with a priority and time periods to be activated.

43. The method of claim 25, wherein when the corrective action has not made a difference to the at least one monitored parameter, the corrective action is less likely to be activated when the subsequent request is received.

44. A computer program product including a non-transitory computer-readable medium comprising software instructions operable to enable a computer to perform a method for passively capturing data traffic flows between a plurality of clients and a plurality of web servers, the method comprising:

processing data traffic sent from the plurality of clients and from the plurality of web servers, comprising collecting contexts by parsing each request for content from each of the plurality of clients to retrieve a context, wherein the context includes at least one of a web server name and request parameters;

identifying transactions sent from the plurality of clients, comprising determining if the each request for content belongs to a previously discovered application, and when the each request for content has been determined as belonging to the previously discovered application, assigning an application identification of the previously discovered application to the context that is retrieved by parsing the each request for content;

monitoring and generating statistics respective of the operation of the web servers and their respective web applications;

performing a corrective action when a predefined policy has been violated, wherein the predefined policy defines a minimum allowable throughput for an application, wherein performing the corrective action comprises stalling traffic directed to a server that executes the application; and

monitoring a result of the corrective action to determine whether at least one monitored parameter is improved due to the corrective action and activating a next corrective action when a subsequent request is received based on the monitored result.

45. The computer program product of claim 44, wherein the method comprises performing load balancing or performing traffic probing.

46. The computer program product of claim 44, wherein a web server includes a web application, and wherein the method comprises sending the context to one of the plurality of web servers.

47. The computer program product of claim 44, wherein the traffic sent from the clients includes at least hypertext protocol (HTTP) requests, and wherein the context includes the web server name, an HTTP method, a URL, the request parameters, HTTP cookies, an HTTP status code, an HTTP server, an HTTP content type, an HTTP content length and an HTML title field.

48. The computer program product of claim 44, wherein the traffic sent from the plurality of web servers includes at least HTTP replies.

49. The computer program product of claim 44, wherein identifying the transactions sent from the plurality of clients comprises at least one of:

discovering transactions executed by the plurality of web servers;

classifying incoming requests to discovered web transactions;

collecting non-classified incoming requests; and

generating a site tree.

50. The computer program product of claim 49 wherein the site tree includes all identified applications that belong to a designated web site, and wherein each identified application includes a list of transaction that construct the application.

51. The computer program product of claim 49, wherein identifying the transactions sent from the plurality of clients comprises saving the collected incoming requests in a first database.

52. The computer program product of claim 51, wherein discovering the transactions comprises:

processing requests saved in the first database using at least a plurality of application definers; and

saving information related to the discovered web applications in a classify data structure (CDS).

53. The computer program product of claim 52, wherein the CDS includes a list of identified sites, for each site a list of its web applications, and for each web application a list of transactions and modules that construct the web application.

54. The computer program product of claim 53, wherein identifying the transactions sent from the plurality of clients comprises saving the CDS in a second database.

55. The computer program product of claim 44, wherein monitoring and generating the statistics respective of the operation of the web servers and their respective web applications comprises generating the statistics respective of the operation of the web servers for each transaction, and wherein the statistics comprise:

throughput, response time, number of errors, latency, and hits per second.

56. The computer program product of claim 55, wherein the method comprises saving the generated statistics in a third database.

57. The computer program product of claim 44, wherein the method comprises producing a plurality of reports and a plurality of alerts based on the generated statistics.

58. The computer program product of claim 44, wherein performing the corrective action comprises performing corrective actions according to a plurality of predefined policies, wherein the corrective actions include scheduling requests to reduce response time, shaping traffic to balance the load, and recovery actions on web servers when one of the web servers fails.

59. The computer program product of claim 58, wherein each of the plurality of predefined policies defines at least one corrective action to be preformed.

60. The computer program product of claim 59, wherein the method comprises determining a policy for a web server, a web application, a module, and a transaction.

61. The computer program product of claim 59, wherein the method comprises assigning each policy with a priority and time periods to be activated.

62. The computer program product of claim 44, wherein when the corrective action has not made a difference to the at least one monitored parameter, the corrective action is less likely to be activated when the subsequent request is received.