Identifying related network traffic data for monitoring and analysis

• US 9,049,216 B2
• Filed: 03/08/2012
• Issued: 06/02/2015
• Est. Priority Date: 03/08/2011
• Status: Active Grant

• Current Assignee: Riverbed Technology, LLC (Riverbed Technology Incorporated)
• Original Assignee: Riverbed Technology Incorporated
• Inventors: McCanne, Steven, Degioanni, Loris
• Primary Examiner(s): Weidner, Timothy J
• Application Number:
  US13/415,823
• Publication Number:
  US 20130070608A1
• Time in Patent Office: 1,181 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

Network traffic information from multiple sources, at multiple time scales, and at multiple levels of detail are integrated so that users may more easily identify relevant network information. The network monitoring system stores and manipulates low-level and higher-level network traffic data separately to enable efficient data collection and storage. Packet traffic data is collected, stored, and analyzed at multiple locations. The network monitoring locations communicate summary and aggregate data to central modules, which combine this data to provide an end-to-end description of network traffic at coarser time scales. The network monitoring system enables users to zoom in on high-level, coarse time scale network performance data to one or more lower levels of network performance data at finer time scales. When high-level network performance data of interest is selected, corresponding low-level network performance data is retrieved from the appropriate distributed network monitoring locations to provide additional detailed information.

Claims

1. A method of identifying related network traffic, the method comprising:

receiving a selection of first network traffic data;

identifying a network destination associated with the selected first network traffic data;

retrieving at least one previously stored first data fingerprint attribute associated with the selected first network traffic data;

identifying second network traffic data originating at the network destination;

searching the second network traffic data to identify a subset of the second network traffic data having a previously stored second data fingerprint attribute matching the first data fingerprint attribute, wherein the searching comprises;

accessing a first portion of the second network traffic data including at least one reference to a second portion of the second network traffic data, wherein the first portion of the second network traffic data is stored at a first network location and the second portion of the second network traffic data is stored at a second network location, and wherein the first portion of the second network traffic data is at a first time scale and the second portion of the second network traffic data is at a second time scale coarser than the first time scale;

using the reference, accessing the second portion of the second network traffic to retrieve the second data fingerprint attribute; and

comparing the second data fingerprint attribute with the first data fingerprint attribute;

adding the subset of the second network traffic data to related network traffic data; and

returning the related network traffic data.

2. The method of claim 1, wherein searching the second network traffic data to identify the subset of the second network traffic data comprises:

retrieving at least one previously stored time attribute associated with the selected first network traffic data;

determining a time window based on the time attribute;

identifying an initial subset of the second network traffic data having time attributes within the time window; and

searching the initial subset of the second network traffic data to identify the subset of the second network traffic data having the previously stored second data fingerprint attribute matching the first data fingerprint attribute.

3. The method of claim 1, wherein in response to the second data fingerprint attribute matching the first data fingerprint attribute, the method comprises:

retrieving a third portion of the second network traffic data from a third network location, wherein the second and third portions of the second network traffic data are included in a single end-to-end network connection.

4. The method of claim 1, wherein the first and second data fingerprint attributes are each based at least in part on a hash of at least a portion of a network packet payload.

5. The method of claim 1, wherein the first and second data fingerprint attributes are each based at least in part on a segmentation of at least a portion of a network packet payload.

6. The method of claim 1, comprising:

repeating the steps of receiving the selection, identifying the network destination, retrieving the first data fingerprint attribute, identifying the second network traffic data, searching the second network traffic data, adding the subset of the second network traffic data, and returning the related network traffic data using the subset of the second network traffic data to identify a subset of third network traffic data related to the subset of the second network traffic data.

7. The method of claim 1, wherein the second network traffic data includes network flow traffic data.

8. The method of claim 1, wherein the second network traffic data includes network macroflow traffic data.

9. The method of claim 1, wherein the second network traffic data includes microflow traffic data.

10. The method of claim 1, wherein the second network traffic data includes packet traffic data.

11. The method of claim 1, wherein the selection is received from a user.

12. The method of claim 1, wherein the selection is received from an application.

13. The method of claim 1, wherein the selection is received via an application programming interface.

14. The method of claim 1, wherein the related network traffic data includes an attribute of at least one network packet sent from the network destination in response to an earlier network packet received at the network destination and included in the first network traffic data.

15. The method of claim 14, wherein the attribute is common to at least two network packets sent from the network destination.

16. The method of claim 14, wherein the attribute is an aggregate attribute of at least a portion of the related network traffic data.

17. The method of claim 14, wherein the attribute is a statistical attribute determined from at least a portion of the related network traffic data.

18. The method of claim 14, wherein the attribute is a user-configured attribute of at least a portion of the related network traffic data.

19. The method of claim 18, wherein the user-configured attribute is determined by executing user-provided code.