Method and system for network monitoring using signature packets

• US 9,141,506 B2
• Filed: 02/15/2013
• Issued: 09/22/2015
• Est. Priority Date: 02/15/2012
• Status: Active Grant

• Current Assignee: Viavi Solutions, Inc. (Lumentum Holdings Inc.)
• Original Assignee: JDS Uniphase Corporation (Lumentum Holdings Inc.)
• Inventors: Stevens, Michael, D'Eletto, Robert
• Primary Examiner(s): Riad, Amine
• Application Number:
  US13/768,846
• Publication Number:
  US 20130212439A1
• Time in Patent Office: 949 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3065 Monitoring arrangements determined by the means or processing involved in reporting the monitored data error or fault reporting or logging G06F11/0766
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method of monitoring a network with a test device connected to the network includes monitoring a plurality of packets which pass through the test device, comparing a predefined field of each of the plurality of packets to a predefined pattern so as to identify signature packets, evaluating whether the signature packets satisfy a predefined condition, and, if the predefined condition is satisfied, sending a notification to a user. A system implementing the method is provided.

Claims

1. A method of monitoring a network with a test device connected to the network, comprising:

monitoring a plurality of packets which pass through the test device, comparing a predefined field of each of the plurality of packets to a predefined pattern so as to identify signature packets, evaluating whether the signature packets satisfy a predefined condition, and, when the predefined condition is satisfied, sending a notification to a user, wherein each of the signature packets includes at least two QoS fields, and the evaluating step comprises determining whether a combination of values in the QoS fields is a permitted combination.

2. The method as defined in claim 1 wherein the signature packets are MPLS packets.

3. The method as defined in claim 1 wherein the signature packets are VLAN packets.

4. The method as defined in claim 3 wherein the signature packets are MPLS/VLAN packets.

5. A method of monitoring a network with a test device connected to the network, comprising:

monitoring a plurality of packets which pass through the test device, comparing a predefined field of each of the plurality of packets to a predefined pattern so as to identify signature packets, evaluating whether the signature packets satisfy a predefined condition, and, when the predefined condition is satisfied, sending a notification to a user, wherein the step of evaluating comprises determining whether a difference between a number of the signature packets identified at the test device and a number of signature packets identified at another test device is above a predefined threshold.

6. A method of monitoring a network with a test device connected to the network, comprising:

monitoring a plurality of packets which pass through the test device, comparing a predefined field of each of the plurality of packets to a predefined pattern so as to identify signature packets, evaluating whether the signature packets satisfy a predefined condition, and, when the predefined condition is satisfied, sending a notification to a user, wherein the step of evaluating comprises determining whether a delay between receiving one of the signature packets at the test device and at another test device is above a predefined threshold.