System and method for accurately displaying communications traffic information

• US 9,026,674 B1
• Filed: 03/22/2010
• Issued: 05/05/2015
• Est. Priority Date: 03/22/2010
• Status: Active Grant

• Current Assignee: Ciena Corporation
• Original Assignee: Packet Design, LLC
• Inventors: Kanna, Satish K, Alaettinoglu, Cengiz, Palasdeokar, Roopesh
• Primary Examiner(s): Pollack, Melvin H
• Application Number:
  US12/661,769
• Time in Patent Office: 1,870 Days
• Field of Search: 709/242
• US Class Current: 709/242
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps

Abstract

A system and method uses path information to project traffic information from flow- or IPFix-type messages onto one or more paths that may have been taken by packets corresponding to such messages. Traffic information from a message is projected from the router interface from which the message was received, along the path or paths the packets corresponding to the message may have taken, but only to the next router interface that provides such messages.

Claims

1. A method of displaying traffic information for a network, comprising:

receiving routing information for the network, wherein the routing information comprises at least one of at least one timestamped routing message, at least one IP address, and at least one interface index;

receiving a plurality of traffic information for the network from a plurality of interfaces of a plurality of routers in the network, the traffic information comprising a plurality of flow messages each describing at least one packet that transited the network, at least one flow message describing a packet different from at least one other flow message;

identifying at least one potential path for each of the at least one packet with at least one of the at least one timestamped routing message, the path for one of the at least one packet starting from at least nearby one of the plurality of router interfaces from which one of the plurality of flow messages was received; and

projecting information from at least some of the plurality of flow messages onto at least one data structure representing each of said at least one potential path identified for said at least one timestamped routing message, such that, for at least one of the plurality of flow messages projected, any effects said projection of said at least some of the plurality of flow messages go not farther than a different router interface from which a different flow message was received.

2. The method of claim 1, wherein the timestamp is associated with the date and time at which the routing message was retrieved.

3. The method of claim 1, wherein at least one of the at least one IP address and at least one interface index is retrieved from a system administrator.

4. The method of claim 1, wherein the routing information is updated occasionally or periodically.

5. The method of claim 1, wherein each of the at least one potential path is at least one snapshot, further wherein the snapshot comprises at least one potentially applicable routing messages of the at least one timestamped routing message created each time said one of the plurality of flow messages is received.

6. The method of claim 1, wherein at least one node of the each of said at least one potential path and serial numbers of the at least some of the plurality of flow messages are associated and stored together.

7. A system for displaying traffic information for a network, comprising:

a routing message manager having an input coupled for receiving routing information for the network, the routing message manager for providing at an output the routing information;

a flow/ipfix message manager having an input coupled for receiving a plurality of traffic information for the network from a plurality of interfaces of a plurality of routers in the network, the traffic information comprising a plurality of flow messages each describing at least one packet that transited the network, at least one flow message describing a packet different from at least one other flow message, the flow/ipfix message manager for providing at an output the traffic information;

a path identification manager having an input coupled to the routing message manager output and to the flow/ipfix message manager output, for identifying and providing at an output at least one potential path for each of the at least one packet with at least one of the at least one timestamped routing message, the path for one of the at least one packet starting from at least nearby one of the plurality of router interfaces from which one of the plurality of flow messages was received; and

a projection manager having an input coupled to the path identification manager output for receiving at least one of the at least one potential path, and to the flow/ipfix message manager for receiving at least some of the plurality of traffic information, the projection manager for projecting via an output, information from at least some of the plurality of flow messages onto at least one data structure representing the each of said at least one potential path identified for said at least one timestamped routing message, such that, for at least one of the plurality of flow messages projected, any effects said projection of said at least some of the plurality of flow messages go not farther than a different router interface from which a different flow message was received.

8. The system of claim 7, wherein the timestamp is associated with the date and time at which the routing message was retrieved.

9. The system of claim 7, wherein at least one of the at least one IP address and at least one interface index is retrieved from a system administrator.

10. The system of claim 7, wherein the routing information is updated occasionally or periodically.

11. The system of claim 7, wherein each of the at least one potential path is at least one snapshot, further wherein the snapshot comprises at least one potentially applicable routing messages of the at least one timestamped routing message created each time said one of the plurality of flow messages is received.

12. The system of claim 7, wherein at least one node of the each of said at least one potential path and serial numbers of the at least some of the plurality of flow messages are associated and stored together.

13. A computer program product comprising a computer useable medium having computer readable program code embodied therein for displaying traffic information for a network, the computer program product comprising computer readable program code devices configured to cause a computer system to:

receive routing information for the network, wherein the routing information comprises at least one of at least one timestamped routing message, at least one IP address, and at least one interface index;

receive a plurality of traffic information for the network from a plurality of interfaces of a plurality of 10 routers in the network, the traffic information comprising a plurality of flow messages each describing at least one packet that transited the network, at least one flow message describing a packet different from at least one other flow message;

identify at least one potential path for each of the at least one packet with at least one of the at least one timestamped routing message, the path for one of the at least one packet starting from at least nearby one of the plurality of router interfaces from which one of the plurality of flow messages was received; and

project information from at least some of the plurality of flow messages onto at least one data structure representing each of said at least one potential path identified for said at least one timestamped routing message, such that, for at least one of the plurality of flow messages projected, any effects said projection of said at least some of the plurality of flow messages go not farther than a different router interface from which a different flow message was received.

14. The computer program product of claim 13, wherein the timestamp is associated with the date and time at which the routing message was retrieved.

15. The computer program product of claim 13, wherein at least one of the at least one IP address and at least one interface index is retrieved from a system administrator.

16. The computer program product of claim 13, wherein the routing information is updated occasionally or periodically.

17. The computer program product of claim 13, wherein each of the at least one potential path is at least one snapshot, further wherein the snapshot comprises at least one potentially applicable routing messages of the at least one timestamped routing message created each time said one of the plurality of flow messages is received.

18. The computer program product of claim 13, wherein at least one node of the each of said at least one potential path and serial numbers of the at least some of the plurality of flow messages are associated and stored together.