Deep path analysis of application delivery over a network

• US 9,985,858 B2
• Filed: 08/24/2016
• Issued: 05/29/2018
• Est. Priority Date: 05/21/2012
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: ThousandEyes, Inc. (Cisco Systems, Inc.)
• Inventors: Lad, Mohit V., Oliveira, Ricardo V., Meisel, Michael, Braud, Ryan
• Primary Examiner(s): Mehrmanesh, Elmira
• Application Number:
  US15/246,443
• Publication Number:
  US 20170026262A1
• Time in Patent Office: 643 Days
• Field of Search: 714 41, 714 471- 473
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/042 comprising distributed management centres cooperatively managing the network
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0852 Delays

Abstract

Techniques for deep path analysis of application delivery over a network are disclosed. In some embodiments, deep path analysis of application delivery over a network includes monitoring a network path between an agent and a destination; determining the network path between the agent and the destination; and generating a graphical visualization of the network path.

Claims

1. A system, comprising:

a processor configured to;

monitor a network path between an agent and a destination;

determine the network path between the agent and the destination, wherein the agent performs one or more active measurements to determine the network path and to measure transit delays of packets from the agent to the destination across an Internet Protocol (IP) network using Transmission Control Protocol synchronise (TCP SYN) packets, wherein the network path includes a data path between the agent and the destination, and wherein the agent performs one or more active measurements to determine the network path and to measure transit delays of packets from the agent to the destination across the IP network using TCP SYN packets further includes;

send a plurality of probes from the agent to the destination with increasing Time To Live (TTL) limited TCP SYN packets, wherein a TCP SYN acknowledgement (ACK) packet from the destination is used as a reference if an Internet Control Message Protocol (ICMP) TTL Exceeded message is not received from an intermediate node or a final node, and the final node corresponds to the destination, wherein if there are non-responsive hops after a first intermediate hop and if the TCP SYN ACK packet is received from the destination, then it is determined that one or more intermediate hops after the first intermediate hop do not send ICMP TTL Exceeded messages and there is no packet loss along the network path; and

characterize one or more nodes along the network path including one or more intermediate nodes, wherein characterize the one or more nodes along the network path further includes;

determine one or more network metrics; and

generate a graphical visualization of the network path to facilitate deep path analysis of application delivery over the IP network, wherein the graphical visualization of the network path includes each node in an expandable topology of a hop-by-hop view of the network path between the agent and the destination, wherein each of the one or more intermediate nodes corresponds to an interface or a physical router, and wherein the one or more nodes along the network path are associated with the one or more network metrics; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1, wherein the destination is selected from an application endpoint, a service endpoint, a network device, and a host.

3. The system recited in claim 1, wherein the network path between the agent and the destination is determined through active network monitoring.

4. The system recited in claim 1, wherein the network path between the agent and the destination is determined through active network probing.

5. The system recited in claim 1, wherein characterize the one or more nodes along the network path further includes:

annotate the one or more nodes in the network path with the one or more network metrics.

6. The system recited in claim 1, wherein the one or more network metrics includes one or more of packet loss and latency, and wherein characterize the one or more nodes along the network path further includes:

annotate the one or more nodes in the network path with the one or more network metrics.

7. The system recited in claim 1, wherein the one or more network metrics includes one or more of packet loss and latency, and wherein characterize the one or more nodes along the network path further includes:

annotate the one or more nodes in the network path with the one or more network metrics using one or more visual indicators.

8. The system recited in claim 1, wherein the processor is further configured to:

simplify the expandable topology of the hop-by-hop view of the network path between the agent and the destination by reducing at least one node of the network path.

9. The system recited in claim 1, wherein the processor is further configured to:

simplify the topology of the hop-by-hop view of the network path between the agent and the destination by reducing at least one node of the network path, wherein simplify the topology of the network path further includes;

determine if the at least one node is associated with a packet loss or if the at least one node is part of an existing node.

10. The system recited in claim 1, wherein the processor is further configured to:

simplify the topology of the hop-by-hop view of the network path between the agent and the destination by reducing at least one node of the network path, wherein simplify the topology of the network path further includes;

determine that the at least one node fails to reply to a probe.

11. The system recited in claim 1, wherein the processor is further configured to:

simplify the topology of the hop-by-hop view of the network path between the agent and the destination by reducing at least one node of the network path, wherein simplify the topology of the network path further includes;

group a plurality of nodes.

12. The system recited in claim 1, wherein the processor is further configured to:

simplify the topology of the hop-by-hop view of the network path between the agent and the destination by reducing at least one node of the network path, wherein simplify the topology of the network path further includes;

group a plurality of nodes, wherein the plurality of nodes are determined to be associated with a network device or a virtual network device.

13. The system recited in claim 1, wherein the processor is further configured to:

output the graphical visualization of the network path.

14. The system recited in claim 1, wherein the processor is further configured to:

output the graphical visualization of the network path, wherein the graphical visualization of the network path supports a time based navigation through the graphical visualization of the network path to track route changes over time for the network path.

15. The system recited in claim 1, wherein the graphical visualization of the network path is generated by a web tier.

16. The system recited in claim 1, wherein the agent is controlled by an agent controller, and the agent performs a plurality of tests that are configurable.

17. The system recited in claim 1, wherein the agent is controlled by an agent controller, wherein the agent is configurable to perform a plurality of tests between the agent and the destination, and wherein the plurality of tests include testing a plurality of application delivery layers including a network layer, a transport layer, and an application layer.

18. The system recited in claim 1, wherein the agent is controlled by an agent controller, wherein the agent is configurable to perform a plurality of tests between the agent and the destination, wherein the plurality of tests include testing a plurality of application delivery layers including a network layer, a transport layer, and an application layer, and wherein the processor is further configured to:

collect results of the plurality of tests, wherein the graphical visualization provides a visualization of an application delivery state for the application delivery layers based on the results of the plurality of tests.

19. A method, comprising:

monitoring a network path between an agent and a destination;

determining the network path between the agent and the destination, wherein the agent performs one or more active measurements to determine the network path and to measure transit delays of packets from the agent to the destination across an Internet Protocol (IP) network using Transmission Control Protocol synchronise (TCP SYN) packets, wherein the network path includes a data path between the agent and the destination, and wherein the agent performs one or more active measurements to determine the network path and to measure transit delays of packets from the agent to the destination across the IP network using TCP SYN packets further includes;

sending a plurality of probes from the agent to the destination with increasing Time To Live (TTL) limited TCP SYN packets, wherein a TCP SYN acknowledgement (ACK) packet from the destination is used as a reference if an Internet Control Message Protocol (ICMP) TTL Exceeded message is not received from an intermediate node or a final node, and the final node corresponds to the destination, wherein if there are non-responsive hops after a first intermediate hop and if the TCP SYN ACK packet is received from the destination, then it is determined that one or more intermediate hops after the first intermediate hop do not send ICMP TTL Exceeded messages and there is no packet loss along the network path; and

characterizing one or more nodes along the network path including one or more intermediate nodes, wherein characterizing the one or more nodes along the network path further includes;

determining one or more network metrics; and

generating a graphical visualization of the network path using a processor to facilitate deep path analysis of application delivery over the IP network, wherein the graphical visualization of the network path includes each node in an expandable topology of a hop-by-hop view of the network path between the agent and the destination, wherein each of the one or more intermediate nodes corresponds to an interface or a physical router, and wherein the one or more nodes along the network path are associated with the one or more network metrics.

20. The method recited in claim 19, wherein the one or more network metrics includes one or more of packet loss and latency, and wherein characterizing the one or more nodes along the network path further includes:

annotating the one or more nodes in the network path with the one or more network metrics.

21. The method recited in claim 19, wherein the one or more network metrics includes one or more of packet loss and latency, and wherein characterizing the one or more nodes along the network path further includes:

annotating the one or more nodes in the network path with the one or more network metrics using one or more visual indicators.

22. The method recited in claim 19, further comprising:

simplifying the topology of the hop-by-hop view of the network path between the agent and the destination by reducing at least one node of the network path, wherein simplifying the topology of the network path further includes;

determining if the at least one node is associated with a packet loss or if the at least one node is part of an existing node.

23. The method recited in claim 19, further comprising:

simplifying the topology of the hop-by-hop view of the network path between the agent and the destination by reducing at least one node of the network path, wherein simplifying the topology of the network path further includes;

determining that the at least one node fails to reply to a probe.

24. The method recited in claim 19, further comprising:

simplifying the topology of the hop-by-hop view of the network path between the agent and the destination by reducing at least one node of the network path, wherein simplifying the topology of the network path further includes;

grouping a plurality of nodes, wherein the plurality of nodes are determined to be associated with a network device or a virtual network device.

25. The method recited in claim 19, further comprising:

outputting the graphical visualization of the network path, wherein the graphical visualization of the network path supports a time based navigation through the graphical visualization of the network path to track route changes over time for the network path.

26. The method recited in claim 19, wherein the agent is controlled by an agent controller, wherein the agent is configurable to perform a plurality of tests between the agent and the destination, and wherein the plurality of tests include testing a plurality of application delivery layers including a network layer, a transport layer, and an application layer.

27. The method recited in claim 19, wherein the agent is controlled by an agent controller, wherein the agent is configurable to perform a plurality of tests between the agent and the destination, wherein the plurality of tests include testing a plurality of application delivery layers including a network layer, a transport layer, and an application layer, and further comprising:

collecting results of the plurality of tests, wherein the graphical visualization provides a visualization of an application delivery state for the application delivery layers based on the results of the plurality of tests.

28. A computer program product, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:

monitoring a network path between an agent and a destination;

determining the network path between the agent and the destination, wherein the agent performs one or more active measurements to determine the network path and to measure transit delays of packets from the agent to the destination across an Internet Protocol (IP) network using Transmission Control Protocol synchronise (TCP SYN) packets, wherein the network path includes a data path between the agent and the destination, and wherein the agent performs one or more active measurements to determine the network path and to measure transit delays of packets from the agent to the destination across the IP network using TCP SYN packets further includes;

sending a plurality of probes from the agent to the destination with increasing Time To Live (TTL) limited wherein a TCP SYN acknowledgement (ACK) packet from the destination is used as a reference if an Internet Control Message Protocol (ICMP) TTL Exceeded message is not received from an intermediate node or a final node, and the final node corresponds to the destination, wherein if there are non-responsive hops after a first intermediate hop and if the TCP SYN ACK packet is received from the destination, then it is determined that one or more intermediate hops after the first intermediate hop do not send ICMP TTL Exceeded messages and there is no packet loss along the network path; and

characterizing one or more nodes along the network path including one or more intermediate nodes, wherein characterizing the one or more nodes along the network path further includes;

determining one or more network metrics; and

generating a graphical visualization of the network path to facilitate deep path analysis of application delivery over the IP network, wherein the graphical visualization of the network path includes each node in an expandable topology of a hop-by-hop view of the network path between the agent and the destination, wherein each of the one or more intermediate nodes corresponds to an interface or a physical router, and wherein the one or more nodes along the network path are associated with the one or more network metrics.