Network monitoring using virtual packets

• US 9,397,880 B1
• Filed: 05/24/2013
• Issued: 07/19/2016
• Est. Priority Date: 07/25/2007
• Status: Active Grant

• Current Assignee: Virtual Instruments Worldwide, Inc.
• Original Assignee: Xangati Incorporated (Virtana Corp.)
• Inventors: Zhu, Hong, Lee, Rosanna, Jagannathan, Rangaswamy, Pan, Xiaohong, Sanders, Derek, Kakatkar, Kishor, Liu, Jing
• Primary Examiner(s): Faroul, Farah
• Application Number:
  US13/902,230
• Time in Patent Office: 1,152 Days
• Field of Search: 370/216
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0645 by additionally acting on or stimulating the network after receiving notifications
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

A network monitoring device includes a flow processing element, disposed to receive flow information relating to network flows, and to generate a set of virtual packets, each representing a portion of a network flow. The virtual packets are maintained in a time-sequential order, and read by elements of the network monitoring device to generate information relating to network traffic, such as symptoms affecting the communication network, problems affecting the communication network, and otherwise. The network monitoring device randomly samples virtual packets, with at least one of two effects: (1) flow information from traffic reporting devices that are themselves sampling a differing rates can be equalized, with the effect of standardizing information from all of them; (2) the network monitoring device itself can restrict its attention to a fraction of all virtual packets, with the effect of keeping up with a relatively large number of virtual packets.

Claims

1. A method, including steps of

receiving flow information from one or more flow information gathering devices, after each particular flow associated with said flow information is complete;

generating virtual packets in response to said flow information, said virtual packets being equally distributed over a time duration indicated by said flow information;

receiving said virtual packets at a network monitoring device;

entering said virtual packets into a first buffer in an order in which said virtual packets are generated;

reordering said virtual packets into an order in which said virtual packets are sequentially distributed over each said time duration by each said flow information;

entering said virtual packets into a second buffer in response to said steps of reordering.

2. A method as in claim 1, wherein

said steps of receiving said virtual packets are responsive to an order of said virtual packets in said second buffer.

3. A method as in claim 1, including steps of recording only some of said virtual packets,

wherein said steps of receiving said virtual packets are with respect to a sampling of said flow information.

4. A method as in claim 3, wherein

said steps of recording only some of said virtual packets include steps of selecting particular virtual packets for recording in response to a randomizing parameter.

5. A method as in claim 1, wherein

said steps of generating provide virtual packets at a selected rate with respect to said time duration.

6. A method as in claim 5, wherein

said selected rate is determined dynamically in response to said flow information.

7. A method as in claim 1, wherein

said steps of receiving flow information include steps of receiving first flow information at a first sampling rate;

said steps of receiving flow information include steps of receiving second flow information at a second damping rate; and

said steps or receiving said virtual packets include receiving only some of the virtual packets provided by said steps of generating;

wherein said virtual packets represent equivalent sampling for said first flow information and said second flow information.

8. A method as in claim 1, wherein

said virtual packets have no useful payload information.

9. A method, including steps of

receiving flow information from one or more reporting devices;

generating virtual packets in response to said flow information for a particular flow, said virtual packets being representative of an amount of traffic reported for said particular flow;

coupling said virtual packets to a network monitoring device;

entering said virtual packets into a first buffer in an order in which said virtual packets are generated;

reordering said virtual packets into an order in which said virtual packets are sequentially distributed over said time duration indicated by said flow information for a particular flow, as if generated during said particular flow;

entering said virtual packets into a second buffer in response to said steps of reordering.

10. A method as in claim 9, including steps of recording only some of said virtual packets,

wherein said steps of receiving said virtual packets are with respect to a sampling of said flow information.

11. A method as in claim 9, including steps of recording only some of said virtual packets for a particular flow, wherein said steps of recording only some of virtual packets allow said virtual packets to be representative of an amount of traffic reported for said particular flow,

when recording all of said virtual packets associated with a said particular flow would be infeasible.

12. A method as in claim 11, wherein

said steps of recording only some of said virtual packets include steps of selecting particular virtual packets for recording in response to a randomizing parameter.

13. A method as in claim 9, wherein said steps of generating include steps of

providing said virtual packets equally distributed over a time duration reported for the start and end of said particular flow.

14. A method as in claim 9, wherein said steps of generating include steps of

providing said virtual packets in a predetermined distribution, said predetermined distribution being representative of a number of packets reported for said particular flow.

15. A method as in claim 9, wherein

said steps of generating provide virtual packets at a rate with respect to a said time duration.

16. A method as in claim 15, wherein

said selected rate is determined dynamically in response to said flow information.