System, method and apparatus for troubleshooting an IP network

• US 9,577,895 B2
• Filed: 09/12/2014
• Issued: 02/21/2017
• Est. Priority Date: 07/12/2006
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: Naim, Ghassan, Kurapati, Srikrishna
• Primary Examiner(s): SERRAO, RANODHI N
• Application Number:
  US14/485,486
• Publication Number:
  US 20150006879A1
• Time in Patent Office: 893 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present invention provides a system, method and apparatus for troubleshooting one or more communications between a first device and a second device. A monitoring device disposed between the first device and the second device receives a message associated with the communication(s), analyzes the received message and stores the analyzed message whenever the analyzed message satisfies one or more troubleshooting criteria. The one or more troubleshooting criteria may include one or more data element criteria, one or more event-based criteria, one or more time-based criteria, one or more logical operators or a combination thereof. The method can be implemented using a computer program embodied on a computer readable medium having one or more code segments to perform the method steps.

Claims

1. A method for troubleshooting one or more communications between a first device and a second device, comprising the steps of:

receiving a message associated with the communication(s) at a monitoring device disposed between the first device and the second device;

decoding the received message;

analyzing the decoded message;

storing the analyzed message in a history buffer whenever the analyzed message does not satisfy one or more troubleshooting criteria;

storing the analyzed message in an existing log file whenever the analyzed message satisfies the troubleshooting criteria and the analyzed message is part of one or more active troubleshooting sessions;

creating a new log file and storing the analyzed message in the new log file whenever the analyzed message satisfies the troubleshooting criteria and the analyzed message is not part of the active troubleshooting sessions;

determining whether the existing log files exceed one or more capacity levels; and

performing one or more predetermined actions based on the exceeded capacity level.

2. The method as recited in claim 1, further comprising the step of extracting one or more messages stored in the history buffer and storing the extracted messages in the new log file after the new log file is created.

3. The method as recited in claim 2, wherein the extracted messages relate to a specified message or a specified communication session or a combination thereof.

4. The method as recited in claim 1, further comprising the steps of:

establishing a secure communication channel between the monitoring device and a security device;

receiving the security key from the security device via the secure communication channel;

storing the security key;

decrypting the received message using a security key whenever the received message is encrypted; and

receiving a new security key and storing the new security key whenever the security key associated with the communication(s) between the first device and the second device is changed.

5. An apparatus for troubleshooting one or more communications between a first device and a second device comprising:

a first network interface;

a second network interface;

a third network interface;

a data storage; and

a microprocessor communicably coupled to the first network interface, the second network interface, the third network interface, and the data storage wherein the microprocessor receives a message associated with the communication(s) via the first network interface, analyzes the received message and stores the analyzed message in the data storage whenever the analyzed message satisfies one or more troubleshooting criteria, wherein the microprocessor receives the one or more troubleshooting criteria from a control center via the second network interface communicably coupled to the microprocessor and wherein the microprocessor receives a security key via the third network interface, stores the security key in the data storage and decrypts the received message using the security key whenever the received message is encrypted.

6. The apparatus as recited in claim 5, wherein the one or more troubleshooting criteria comprise one or more data element criteria, one or more event-based criteria, one or more time-based criteria, one or more logical operators or a combination thereof.

7. The apparatus as recited in claim 5, wherein a new security key is received and stored whenever the security key associated with the communication(s) between the first device and the second device is changed.

8. An apparatus for troubleshooting one or more communications between a first device and a second device comprising:

a first interface;

a second interface;

a data storage; and

a microprocessor communicably coupled to the first interface, the second interface and the data storage wherein the microprocessor receives a message associated with the communication(s) at a monitoring device disposed between the first device and the second device, decodes the received message, analyzes the decoded message, stores the analyzed message in a history buffer whenever the analyzed message does not satisfy one or more troubleshooting criteria, stores the analyzed message in an existing log file whenever the analyzed message satisfies the troubleshooting criteria and the analyzed message is part of one or more active troubleshooting sessions, creates a new log file and stores the analyzed message in the new log file whenever the analyzed message satisfies the troubleshooting criteria and the analyzed message is not part of the active troubleshooting sessions, determines whether the existing log files exceed one or more capacity levels, and performs one or more predetermined actions based on the exceeded capacity level.

9. The apparatus as recited in claim 8, further comprising wherein the microprocessor extracts one or more messages stored in the history buffer and stores the extracted messages in the new log file after the new log file is created.

10. The apparatus as recited in claim 8, wherein the extracted messages relate to a specified message or a specified communication session or a combination thereof.

11. The apparatus as recited in claim 8, wherein the microprocessor:

establishes a secure communication channel between the monitoring device and a security device;

receives the security key from the security device via the secure communication channel;

stores the security key;

decrypts the received message using a security key whenever the received message is encrypted; and

receives a new security key and stores the new security key whenever the security key associated with the communication(s) between the first device and the second device is changed.

12. A method for troubleshooting one or more communications between a first device and a second device comprising:

receiving, by a microprocessor, a message associated with the communication(s) via a first hardware network interface;

analyzing, by the microprocessor, the received message;

storing, by the microprocessor, the analyzed message in a data storage whenever the analyzed message satisfies one or more troubleshooting criteria, wherein the microprocessor receives the one or more troubleshooting criteria from a control center via a second hardware network interface and wherein the microprocessor receives a security key via a third hardware network interface;

storing, by the microprocessor, the security key in the data storage; and

decrypting the received message using the security key whenever the received message is encrypted.

13. The method of claim 12, wherein the one or more troubleshooting criteria comprise one or more data element criteria, one or more event-based criteria, one or more time-based criteria, one or more logical operators, or a combination thereof.

14. The method of claim 12, wherein a new security key is received and stored whenever the security key associated with the communication(s) between the first device and the second device is changed.