Utilizing packet headers to monitor network traffic in association with a client device

• US 9,838,292 B2
• Filed: 10/27/2014
• Issued: 12/05/2017
• Est. Priority Date: 09/19/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Polychronis, Konstantinos
• Primary Examiner(s): LAM, YEE F
• Application Number:
  US14/524,748
• Publication Number:
  US 20160088125A1
• Time in Patent Office: 1,135 Days
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Various methods and systems for facilitating network traffic monitoring in association with an application running on a client device are provided. In this regard, aspects of the invention facilitate monitoring network traffic being transmitted to and/or from a client device, such as a mobile device, so that network performance can be analyzed. In various implementations, packet headers of data packets are read to obtain or extract desired network metrics that indicate network performance. Packet headers are generally read to the extent necessary to identify various network data. As such, by avoiding examination of a packet payload and, in some cases, examination of the entire header, the efficiency of monitoring network traffic at a client device is improved.

Claims

1. A method for monitoring network traffic, the method comprising:

obtaining a packet being communicated to or from an application running on a mobile device, the packet having a packet header including network data and non-network data, wherein the network data indicates network performance associated with the application running on the mobile device;

at the mobile device, reading the packet header of the obtained packet to identify whether at least a portion of the network data corresponds with a predetermined set of types of network data, wherein

when identified that the at least the portion of network data corresponds with each of the predetermined set of types of network data in the packet header of the obtained packet, discontinue reading a remainder of the obtained packet, and

when identified that the at least the portion of network data does not correspond with each of the predetermined set of types of network data in the packet header of the obtained packet, reading a payload of the obtained packet to identify at least one network data corresponding with each type of network data not in the packet header of the obtained packet; and

providing the network data that corresponds with the predetermined set of types of network data to a remote server for use in analyzing performance of the application running on the mobile device.

2. The method of claim 1, wherein the application is a mobile application running on the mobile device.

3. The method of claim 1, wherein the packet is being communicated to a remote application server associated with the application or from the remote application server associated with the application.

4. The method of claim 1 further comprising:

determining that each of the predetermined set of types of network data are in the packet header; and

based on the determination that each of the predetermined set of types of network data are in the packet header, discontinuing reading the remainder of the packet and proceeding to read a next packet header associated with another packet.

5. The method of claim 1 further comprising:

determining that each of the predetermined set of types of network data are not in the packet header; and

based on the determination that each of the predetermined set of types of network data are not in the packet header, reading the payload of the packet to identify the at least one of the predetermined set of network data not in the packet header.

6. The method of claim 5, wherein the payload of the packet is only read when the at least one of the predetermined set of types of network data comprises a packet size.

7. The method of claim 5, wherein the payload is read only to the extent necessary to obtain the at least one network data corresponding with each type of network data not in the packet header.

8. The method of claim 1, wherein the identified network data that corresponds with the predetermined set of types of network data is provided to an analytics server.

9. The method of claim 8, wherein the analytics server uses the identified network data that corresponds with the predetermined set of types of network data to generate one or more network metrics indicating performance of the network in association with the application.

10. The method of claim 9, wherein at least one of the one or more network metrics indicate a latency, a bandwidth, a throughput, a jitter variation, or an error rate.

11. The method of claim 1 further comprising determining whether each of the predetermined set of types of network data are in the packet header, wherein

when each of the predetermined set of network data are in the packet header, proceeding to read a next packet header associated with another packet, and

when at least one of the predetermined set of network data is not in the packet header, reading the payload of the packet to obtain the at least one of the predetermined set of network data not in the packet header.

12. The method of claim 1, wherein one or more classes are used to facilitate the method of claim 1, each of the one or more classes being a custom class incorporated with the application via a plug-in.

13. The method of claim 12, wherein the plug-in is initiated via the application in accordance with a network monitor trigger that triggers activation of the plug-in.

14. The method of claim 13, wherein the network monitor trigger comprises one line of code that triggers activation of the plug-in in accordance with the application being launched.

15. The method of claim 1, wherein the predetermined set of types of network data comprises a uniform resource locator (URL), a connection type, a connection start time, a connection end time, a http status code, a request length, a response length, a request headers, a response headers, or a combination thereof.

16. The method of claim 1, wherein the mobile device includes an Android-based platform.

17. The method of claim 1, wherein the packet comprises a HTTP packet or a HTTPS packet.

18. The method of claim 1 further comprising:

determining that each of the predetermined set of types of network data is not in the packet header, wherein the at least one of the predetermined set of types of network data comprises a packet size; and

based on the determination that each of the predetermined set of types of network data is not in the packet header, reading the payload of the packet to identify the size of the packet.

19. A system for monitoring network traffic, the system comprising:

one or more data processors; and

one or more computer-readable storage media containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including;

obtaining a packet being communicated to or from an application running on a mobile device, the packet having a packet header including network data and non-network data, wherein the network data indicates network performance associated with the application running on the mobile device;

at the mobile device, reading the packet header of the obtained packet to identify whether at least a portion of the network data corresponds with a predetermined set of types of network data, wherein

when identified that the at least the portion of network data corresponds with each of the predetermined set of types of network data in the packet header of the obtained packet, discontinue reading a remainder of the obtained packet, and

when identified that the at least the portion of network data does not correspond with each of the predetermined set of types of network data in the packet header of the obtained packet, reading a payload of the packet to identify at least one network data corresponding with each type of network data not in the packet header of the obtained packet; and

providing the network data that corresponds with the predetermined set of types of network data to a remote server for use in analyzing performance of the application running on the mobile device.

20. The system of claim 19 further comprising:

determining that each of the predetermined set of types of network data are in the packet header; and

based on the determination that each of the predetermined set of types of network data are in the packet header, discontinuing reading a remainder of the packet and proceeding to read a next packet header associated with another packet.

21. The system of claim 19 further comprising:

determining that each of the predetermined set of types of network data are not in the packet header; and

based on the determination that each of the predetermined set of types of network data are not in the packet header, reading the payload of the packet to obtain the at least one of the predetermined set of network data not in the packet header.

22. One or more non-transitory computer-storage media storing computer-executable instructions that, when executed by a computing device, perform a method for monitoring network traffic, the method comprising:

obtaining a packet being communicated to or from an application running on a mobile device, the packet having a packet header including network data and non-network data, wherein the network data indicates network performance associated with the application running on the mobile device;

at the mobile device, reading the packet header of the obtained packet to identify whether at least a portion of the network data corresponds with a predetermined set of types of network data, wherein

when identified that the at least the portion of network data corresponds with each of the predetermined set of types of network data in the packet header of the obtained packet, discontinue reading a remainder of the packet, and

when identified that the at least the portion of network data does not correspond with each of the predetermined set of types of network data in the packet header of the obtained packet, reading a payload of the obtained packet to identify at least one network data corresponding with each type of network data not in the packet header of the obtained packet; and

providing the network data that corresponds with the predetermined set of types of network to a emote server for use in analyzing performance of the application running on the mobile device.