System and method for aggregating and reporting network traffic data

• US 9,014,047 B2
• Filed: 05/07/2008
• Issued: 04/21/2015
• Est. Priority Date: 07/10/2007
• Status: Active Grant

• Current Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.)
• Original Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.)
• Inventors: Alcala, Raoul, Comstedt, Niclas, Whitaker, Jeff
• Primary Examiner(s): CHOUDHRY, SAMINA F
• Application Number:
  US12/116,354
• Publication Number:
  US 20090016236A1
• Time in Patent Office: 2,540 Days
• Field of Search: 370/230, 370/232, 370/252, 370/253, 370/235, 370/231, 370/392, 370/412, 370/428, 370/429, 370/474, 370/477, 370/254, 370/395.31
• US Class Current: 370/253
• CPC Class Codes: H04L 12/5602 Bandwidth control in ATM Networks, e.g. leaky bucket
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

A method for analyzing traffic in a communications network includes sampling data packets at a plurality of network interconnection points, wherein sampling the data packets includes generating a plurality of sampled packet data in one or more standardized formats, converting the sampled packet data from the one or more standardized formats into a neutral format, and aggregating the sampled packet data in the neutral format from the plurality of network interconnection points. A system includes a communications node operable to sample data packets flowing through and generate sample packet data in a specified format, a collector node operable to convert the sampled packet data into a neutral format, the collector node further operable to map IP addresses of the sampled packet data to corresponding prefixes in a routing table; and an aggregator node operable to aggregate neutrally formatted sampled packet data from a plurality of collector nodes.

Claims

1. A method for analyzing traffic in a communications network, the method comprising:

sampling packet data at a plurality of network interconnection points, wherein the communications network is communicatively coupled to a plurality of autonomous systems by the plurality of network interconnection points;

enriching the sampled packet data, wherein enriching the sampled packet data comprises;

mapping IP addresses of the sampled packet data to corresponding IP prefixes associated with the plurality of autonomous systems;

mapping the IP addresses of the sampled packet data to customers; and

generating one or more sampled packet data summaries at a collector node by mapping the sampled packet data to routing table data from communication nodes associated with the collector node;

aggregating the enriched sampled packet data to yield aggregated traffic flow measures associated with one or more customers; and

generating one or more traffic flow reports based on the sampled packet data, wherein the one or more reports are selected from a group consisting of;

a peer distribution report comprising one or more of traffic volume measurements of traffic outbound from a peer network or traffic volume measurements of traffic inbound to the peer network;

a customer distribution report comprising one or more of traffic volume measurements of traffic outbound from one or more customer networks or traffic volume measurements of traffic inbound to the one or more of customer networks;

an autonomous system distribution report comprising one or more of average traffic volume, traffic volume by region, on-net traffic volume, off-net traffic volume, direction of traffic, next hop autonomous systems, and upstream autonomous systems associated with one or more autonomous systems;

an applications report comprising average traffic volume and region to region traffic volume associated with network applications;

an on-net distribution report comprising traffic volume measurements of traffic outbound from a peer network that was also inbound to the peer network;

an off-net distribution report comprising traffic volume measurements of traffic outbound from a peer network that was not also inbound to the peer network;

a region distribution report comprising average traffic volume inbound to or outbound from selected regions; and

a city distribution report comprising average traffic volume from one or more source cities to one or more destination cities.

2. The method of claim 1, wherein the IP prefixes are obtained from a routing table.

3. The method as recited in claim 1 further comprising converting the sampled packet data from one or more standardized formats into a neutral format.

4. The method as recited in claim 1, wherein enriching the sampled packet data comprises mapping the IP addresses of the sampled packet data to geographic locations, the method further comprising:

aggregating the enriched sampled packet data to yield aggregated traffic flow measures associated with one or more geographic locations.

5. The method as recited in claim 3, wherein the one or more standardized formats comprise sFlow format, Netflow format and cflowd format.

6. The method as recited in claim 4, wherein the one or more geographic locations comprise one or more of a city, a country, a continent or a region.

7. The method as recited in claim 1, further comprising communicating the one or more sampled packet data summaries from the collector node to an aggregator node configured to perform the aggregating.

8. A system for analyzing traffic flow in a communications network, the system comprising:

a communications node comprising a sampling agent operable to sample packet data flowing through the communications node and generate sample packet data;

a collector node operable to enrich the sampled packet data by mapping IP addresses of the sampled packet data to IP prefixes in a routing table of the communications node, wherein the IP prefixes are associated with respective autonomous systems, and wherein the collector node is further operable to map the sampled packet data to associated autonomous systems; and

an aggregator node operable to aggregate the enriched sampled packet data to yield aggregated traffic flow measures associated with one or more autonomous systems, wherein the aggregator node is further operable to generate one or more traffic flow reports based on the sampled packet data, wherein the one or more reports are selected from a group consisting of;

a peer distribution report comprising one or more of traffic volume measurements of traffic outbound from a peer network or traffic volume measurements of traffic inbound to the peer network;

a customer distribution report comprising one or more of traffic volume measurements of traffic outbound from one or more customer networks or traffic volume measurements of traffic inbound to the one or more of customer networks;

an autonomous system distribution report comprising one or more of average traffic volume, traffic volume by region, on-net traffic volume, off-net traffic volume, direction of traffic, next hop autonomous systems, and upstream autonomous systems associated with the one or more autonomous systems;

an application report comprising average traffic volume and region to region traffic volume associated with network applications;

an on-net distribution report comprising traffic volume measurements of traffic outbound from a peer network that was also inbound to the peer network;

an off-net distribution report comprising traffic volume measurements of traffic outbound from a peer network that was not also inbound to the peer network;

a region distribution report comprising average traffic volume inbound to or outbound from selected regions; and

a city distribution report comprising average traffic volume from one or more source cities to one or more destination cities.

9. The system of claim 8, further comprising an autonomous system registry storing information about the one or more autonomous systems comprising autonomous system identifiers and regions.

10. The system of claim 8, further comprising a customer attributes data store storing customer autonomous system identifiers.

11. The system of claim 9, wherein the aggregator node is further operable to map autonomous system identifiers from the sampled packet data to the regions in the autonomous system registry.

12. The system of claim 8, wherein the aggregator node is further operable to generate traffic flow measurements associated with network applications based on the sampled packet data that was converted from a standardized format into a neutral format.

13. The system of claim 8, wherein the aggregator node is further operable to generate the one or more reports relating traffic flow measurements to one or more of a region, an autonomous system, a community, a network application, or a network protocol.

14. The system of claim 12, wherein at least one of the one or more reports comprises traffic flow measurements for traffic flowing from a selected community to at least one other community.

15. The system of claim 8, wherein the aggregator node is further operable to generate a traffic flow measurement of outbound traffic from a selected autonomous system to each of a plurality of other autonomous systems.

16. The system of claim 8, wherein the aggregator node is further operable to generate a traffic flow measurement of outbound traffic to a selected autonomous system from each of a plurality of other autonomous systems.

17. The system of claim 8, wherein the aggregator node is further operable to generate a traffic flow measurement of on-net traffic and a traffic flow measurement of off-net traffic for a selected autonomous system.

18. A method for analyzing communications traffic through a network, the method comprising:

sampling data packets communicated through the network;

enriching the sampled data packets by categorizing each of the sampled data packets according to one or more network-related attribute categories, wherein the one or more network related attribute categories comprises routing table data;

aggregating the sampled data packets of each of the attribute categories;

determining the sampled data packet transmission statistics associated with each of the one or more attribute categories based on the aggregation; and

generating one or more traffic flow reports based on the sampled packets, wherein the one or more reports are selected from a group consisting of;

a peer distribution report comprising one or more of traffic volume measurements of traffic outbound from a peer network or traffic volume measurements of traffic inbound to the peer network;

a customer distribution report comprising one or more of traffic volume measurements of traffic outbound from one or more customer networks or traffic volume measurements of traffic inbound to the one or more of customer networks;

an autonomous system distribution report comprising one or more of average traffic volume, traffic volume by region, on-net traffic volume, off-net traffic volume, direction of traffic, next hop autonomous systems, and upstream autonomous systems associated with one or more autonomous systems;

an applications report comprising average traffic volume and region to region traffic volume associated with network applications;

an on-net distribution report comprising traffic volume measurements of traffic outbound from a peer network that was also inbound to the peer network;

an off-net distribution report comprising traffic volume measurements of traffic outbound from a peer network that was not also inbound to the peer network;

a region distribution report comprising average traffic volume inbound to or outbound from selected regions; and

a city distribution report comprising average traffic volume from one or more source cities to one or more destination cities.

19. The method of claim 18 wherein the one or more attribute categories comprise one or more of geographic region, network, community, application, protocol, autonomous system, customer, on-net, or off-net.

20. The method of claim 19 wherein determining the sampled data packet transmission statistics comprises determining data packet volume transmitted to or from one or more of a geographic region, a network, a community, an autonomous system, a customer, an on-net provider, or an off-net provider.