Deep path analysis of application delivery over a network

• US 9,455,890 B2
• Filed: 03/13/2014
• Issued: 09/27/2016
• Est. Priority Date: 05/21/2012
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: ThousandEyes, Inc. (Cisco Systems, Inc.)
• Inventors: Lad, Mohit V., Oliveira, Ricardo V., Meisel, Michael, Braud, Ryan
• Primary Examiner(s): Mehrmanesh, Elmira
• Application Number:
  US14/210,128
• Publication Number:
  US 20140280917A1
• Time in Patent Office: 929 Days
• Field of Search: 714 471- 473
• US Class Current: 1/1
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/042 comprising distributed management centres cooperatively managing the network
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0852 Delays

Abstract

Techniques for deep path analysis of application delivery over a network are disclosed. In some embodiments, deep path analysis of application delivery over a network includes monitoring a network path between an agent and a destination; determining the network path between the agent and the destination; and generating a graphical visualization of the network path.

Claims

1. A system for deep path analysis of application delivery over a network, comprising:

a processor configured to;

monitor a network path between an agent and a destination;

determine the network path between the agent and the destination, wherein the agent performs one or more active measurements to determine the network path and to measure transit delays of packets from the agent to the destination across an Internet Protocol (IP) network using TCP SYN packets, wherein the network path includes a data path between the agent and the destination, and wherein the agent performs one or more active measurements to determine the network path and to measure transit delays of packets from the agent to the destination across the IP network using TCP SYN packets further includes;

send a plurality of probes from the agent to the destination with increasing Time To Live (TTL) limited TCP SYN packets, wherein a TCP SYN ACK packet from the destination is used as a reference if an ICMP TTL Exceeded message is not received from an intermediate hop or a final hop, and the final hop corresponds to the destination;

wherein if there are non-responsive hops after a first intermediate hop and if a TCP SYN ACK packet is received from the destination, then it is determined that one or more intermediate hops after the first intermediate hop do not send ICMP TTL Exceeded messages and there is no packet loss along the network path; and

wherein if there are non-responsive hops after the first intermediate hop and if a TCP SYN ACK packet is not received from the destination, then the first intermediate hop is determined to be a last known good hop on the network path and after that point in the network path packets are being dropped; and

generate a graphical visualization of the network path; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1, wherein the graphical visualization of the network path facilitates deep path analysis of application delivery over the network.

3. The system recited in claim 1, wherein the destination is selected from an application endpoint, a service endpoint, a network device, and a host.

4. The system recited in claim 1, wherein the network path between the agent and the destination is determined through active network monitoring.

5. The system recited in claim 1, wherein the network path between the agent and the destination is determined through active network probing.

6. The system recited in claim 1, wherein the processor is further configured to:

characterize one or more nodes along the network path.

7. The system recited in claim 1, wherein the processor is further configured to:

characterize one or more nodes along the network path, wherein characterize the one or more nodes along the network path further includes;

determine one or more network metrics; and

annotate the one or more nodes in the network path with the one or more network metrics.

8. The system recited in claim 1, wherein the processor is further configured to:

characterize one or more nodes along the network path, wherein characterize the one or more nodes along the network path further includes;

determine one or more network metrics, wherein the one or more network metrics includes one or more of packet loss and latency; and

annotate the one or more nodes in the network path with the one or more network metrics.

9. The system recited in claim 1, wherein the processor is further configured to:

characterize one or more nodes along the network path, wherein characterize the one or more nodes along the network path further includes;

determine one or more network metrics, wherein the one or more network metrics includes one or more of packet loss and latency; and

annotate the one or more nodes in the network path with the one or more network metrics using one or more visual indicators.

10. The system recited in claim 1, wherein the processor is further configured to:

simplify a topology of the network path by reducing at least one node of the network path.

11. The system recited in claim 1, wherein the processor is further configured to:

simplify a topology of the network path by reducing at least one node of the network path, wherein simplify the topology of the network path further includes determining if the at least one node is associated with a packet loss or if the at least one node is part of an existing node.

12. The system recited in claim 1, wherein the processor is further configured to:

simplify a topology of the network path by reducing at least one node of the network path, wherein simplify the topology of the network path further includes determining that the at least one node fails to reply to a probe.

13. The system recited in claim 1, wherein the processor is further configured to:

simplify a topology of the network path by reducing at least one node of the network path, wherein simplify the topology of the network path further includes grouping a plurality of nodes.

14. The system recited in claim 1, wherein the processor is further configured to:

simplify a topology of the network path by reducing at least one node of the network path, wherein simplify the topology of the network path further includes grouping a plurality of nodes, wherein the plurality of nodes are determined to be associated with a network device or a virtual network device.

15. The system recited in claim 1, wherein the processor is further configured to:

output the graphical visualization of the network path.

16. The system recited in claim 1, wherein the processor is further configured to:

output the graphical visualization of the network path, wherein the graphical visualization of the network path supports a time based navigation through the graphical visualization of the network path to track route changes over time for the network path.

17. The system recited in claim 1, wherein the agent is controlled by an agent controller, and the agent performs a plurality of tests that are configurable.

18. The system recited in claim 1, wherein the graphical visualization of the network path is generated by a web tier.

19. A method of deep path analysis of application delivery over a network, comprising:

monitoring a network path between an agent and a destination;

determining the network path between the agent and the destination using a processor, wherein the agent performs one or more active measurements to determine the network path and to measure transit delays of packets from the agent to the destination across an Internet Protocol (IP) network using TCP SYN packets, wherein the network path includes a data path between the agent and the destination, and wherein the agent performs one or more active measurements to determine the network path and to measure transit delays of packets from the agent to the destination across the IP network using TCP SYN packets further includes;

sending a plurality of probes from the agent to the destination with increasing Time To Live (TTL) limited TCP SYN packets, wherein a TCP SYN ACK packet from the destination is used as a reference if an ICMP TTL Exceeded message is not received from an intermediate hop or a final hop, and the final hop corresponds to the destination;

wherein if there are non-responsive hops after a first intermediate hop and if a TCP SYN ACK packet is received from the destination, then it is determined that one or more intermediate hops after the first intermediate hop do not send ICMP TTL Exceeded messages and there is no packet loss along the network path; and

wherein if there are non-responsive hops after the first intermediate hop and if a TCP SYN ACK packet is not received from the destination, then the first intermediate hop is determined to be a last known good hop on the network path and after that point in the network path packets are being dropped; and

generating a graphical visualization of the network path.

20. The method of claim 19, wherein the graphical visualization of the network path facilitates deep path analysis of application delivery over the network.

21. The method of claim 19, wherein the destination is selected from an application endpoint, a service endpoint, a network device, and a host.

22. The method of claim 19, wherein the network path between the agent and the destination is determined through active network monitoring.

23. The method of claim 19, wherein the network path between the agent and the destination is determined through active network probing.

24. The method of claim 19, further comprising:

characterizing one or more nodes along the network path.

25. The method of claim 19, further comprising:

characterizing one or more nodes along the network path, wherein characterizing the one or more nodes along the network path further includes;

determining one or more network metrics; and

annotating the one or more nodes in the network path with the one or more network metrics.

26. The method of claim 19, further comprising:

characterizing one or more nodes along the network path, wherein characterizing the one or more nodes along the network path further includes;

determining one or more network metrics, wherein the one or more network metrics includes one or more of packet loss and latency; and

annotating the one or more nodes in the network path with the one or more network metrics.

27. The method of claim 19, further comprising:

characterizing one or more nodes along the network path, wherein characterizing the one or more nodes along the network path further includes;

determining one or more network metrics, wherein the one or more network metrics includes one or more of packet loss and latency; and

annotating the one or more nodes in the network path with the one or more network metrics using one or more visual indicators.

28. The method of claim 19, further comprising:

simplifying a topology of the network path by reducing at least one node of the network path.

29. The method of claim 19, further comprising:

simplifying a topology of the network path by reducing at least one node of the network path, wherein simplify the topology of the network path further includes determining if the at least one node is associated with a packet loss or if the at least one node is part of an existing node.

30. The method of claim 19, further comprising:

simplifying a topology of the network path by reducing at least one node of the network path, wherein simplify the topology of the network path further includes determining that the at least one node fails to reply to a probe.

31. The method of claim 19, further comprising:

simplifying a topology of the network path by reducing at least one node of the network path, wherein simplify the topology of the network path further includes grouping a plurality of nodes.

32. The method of claim 19, further comprising:

simplifying a topology of the network path by reducing at least one node of the network path, wherein simplify the topology of the network path further includes grouping a plurality of nodes, wherein the plurality of nodes are determined to be associated with a network device or a virtual network device.

33. The method of claim 19, further comprising:

outputting the graphical visualization of the network path.

34. The method of claim 19, further comprising:

outputting the graphical visualization of the network path, wherein the graphical visualization of the network path supports a time based navigation through the graphical visualization of the network path to track route changes over time for the network path.

35. The method of claim 19, wherein the agent is controlled by an agent controller, and the agent performs a plurality of tests that are configurable.

36. The method of claim 19, wherein the graphical visualization of the network path is generated by a web tier.

37. A computer program product for deep path analysis of application delivery over a network, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:

monitoring a network path between an agent and a destination;

determining the network path between the agent and the destination, wherein the agent performs one or more active measurements to determine the network path and to measure transit delays of packets from the agent to the destination across an Internet Protocol (IP) network using TCP SYN packets, wherein the network path includes a data path between the agent and the destination, and wherein the agent performs one or more active measurements to determine the network path and to measure transit delays of packets from the agent to the destination across the IP network using TCP SYN packets further includes;

sending a plurality of probes from the agent to the destination with increasing Time To Live (TTL) limited TCP SYN packets, wherein a TCP SYN ACK packet from the destination is used as a reference if an ICMP TTL Exceeded message is not received from an intermediate hop or a final hop, and the final hop corresponds to the destination;

wherein if there are non-responsive hops after a first intermediate hop and if a TCP SYN ACK packet is received from the destination, then it is determined that one or more intermediate hops after the first intermediate hop do not send ICMP TTL Exceeded messages and there is no packet loss along the network path; and

wherein if there are non-responsive hops after the first intermediate hors and if a TCP SYN ACK packet is not received from the destination, then the first intermediate hop is determined to be a last known good hop on the network path and after that point in the network path packets are being dropped; and

generating a graphical visualization of the network path.