Method and apparatus for session reconstruction

• US 20040049576A1
• Filed: 06/09/2003
• Published: 03/11/2004
• Est. Priority Date: 04/20/2000
• Status: Active Grant

• Current Assignee: Amdocs Development Limited (Amdocs Ltd.), Amdocs Ltd.
• Original Assignee: Amdocs Ltd.
• Inventors: Givoly, Tal, Kushnir, Ori, Black, Damian, Schweitzer, Limor
• Granted Patent: US 7,539,749 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0627 by acting on the notification or alarm source
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5029 Service quality level-based billing, e.g. dependent on measured service level customer is charged more or less
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 41/5058 Service discovery by the service manager
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/41 Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/56 for VoIP communications
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/8016 based on quality of service [QoS]
• CPC Class Codes: H04M 15/81 Dynamic pricing, e.g. change of tariff during call
• CPC Class Codes: H04M 2215/0112 Dynamic pricing, e.g. change of tariff during call
• CPC Class Codes: H04M 2215/0164 Billing record, e.g. Call Data Record [CDR], Toll Ticket[TT], Automatic Message Accounting [AMA], Call Line Identifier [CLI], details, i.e. parameters, identifiers, structure
• CPC Class Codes: H04M 2215/0188 Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04M 2215/202 VoIP; Packet switched telephony
• CPC Class Codes: H04M 2215/22 Bandwidth or usage-sensitve billing
• CPC Class Codes: H04M 2215/7414 QoS
• CPC Class Codes: H04M 3/2218 Call detail recording
• CPC Class Codes: H04M 7/006 : Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42
• CPC Class Codes: H04Q 2213/13034 : A/D conversion, code compression/expansion
• CPC Class Codes: H04Q 2213/1305 : Software aspects
• CPC Class Codes: H04Q 2213/13093 : Personal computer, PC
• CPC Class Codes: H04Q 2213/1313 : Metering, billing
• CPC Class Codes: H04Q 2213/13166 : Fault prevention
• CPC Class Codes: H04Q 2213/13175 : Graphical user interface [GUI], WWW interface, visual indication
• CPC Class Codes: H04Q 2213/13196 : Connection circuit/link/trunk/junction, bridge, router, gateway
• CPC Class Codes: H04Q 2213/13204 : Protocols
• CPC Class Codes: H04Q 2213/13209 : ISDN
• CPC Class Codes: H04Q 2213/1325 : Priority service
• CPC Class Codes: H04Q 2213/13337 : Picturephone, videotelephony
• CPC Class Codes: H04Q 2213/13349 : Network management
• CPC Class Codes: H04Q 2213/13389 : LAN, internet
• CPC Class Codes: H04Q 3/0079 : involving restoration of networks, e.g. disaster recovery, self-healing networks

Abstract

A method and apparatus for reconstructing sessions on a network is described. The method allows for monitoring of quality of service at an application level as well as for understanding application specific events. This allows the method to be used to generate service detail records for usage based on application type for use in billing. It also allows the qualitative and quantitative analysis of quality of service based on application specific parameters. For example, for web applications, quality of service can be measured by the time from requesting a link till the close of the session by delivery of the whole page. Similarly, for voice over IP calls, application events like adding participants and removing participants can be detected and billed accordingly. Also, the quality of service can be measured. For example, the actual latency can be compared to a predetermined latency amount set by a provider for voice over IP calls. Additionally, service detail records can be generated based on application specific events instead of generic flows, so usage billing can be performed based on factors such as a price per minute per leg, etc, with application specific events generated each time a leg is added or dropped. Further, because the periodicity of the output can be controlled on a per application basis, output for voice over IP calls can be generated more often than for other applications. Additionally, embodiments of the invention can reconstruct sessions that are flowing across multiple network devices.

Claims

1. A method of reconstructing a session, the method comprising:

receiving a plurality of packets over a network interface;

analyzing the plurality of packets to identify at least a first flow;

identifying an application for the at least a first flow;

selecting a corresponding application flow identifier for the application;

using the corresponding application flow identifier to identify a plurality of flows in the plurality of packets corresponding to the session.

2. The method of claim 1 further comprising generating a quality of service report for the session based on the application.

3. The method of claim 1 wherein the session is associated with an end user experience occurring within a definite time bound.

4. The method of claim 3 wherein the session is comprised of one or more additional sessions.

5. The method of claim 1 further comprising filtering the plurality of packets received over the network interface prior to the analyzing, the filtering comprising removing one or more packets from the plurality of packets according to one or more packet capture language rules.

6. The method of claim 1 further comprising outputting a plurality of service detail records at predetermined intervals for the application, each service detail record including a billing identifier and a usage information, the usage information derived from the number of packets in the session during the corresponding predetermined interval.

7. The method of claim 1 further comprising sending a command to a network device to control the session based on a policy, the policy defining a quality of service for the application.

8. The method of claim 1 further comprising sending a command to a network device to control the session based on a policy, the policy defining the amount of resources available to the session.

9. The method of claim 1 further comprising sending a command to a network device to stop the session based on a policy, the policy specifying a cost for use of resources and the policy triggering the transmission of the command upon the cost exceeding a predetermined amount.

10. A system for reconstructing a session, the system comprising:

a packet source, the packet source generating a plurality of packets;

a flow manager coupled to the packet source, the flow manager identifying at least one flow in the plurality of packets;

an application recognizer coupled to the flow manager, the application recognizer identifying an application corresponding to the at least one flow;

a session streamer coupled to the flow manager, the session streamer identifying a plurality of flows in the plurality of packets corresponding to the session based on the application.

11. The system of claim 10, wherein each of the plurality of packets includes a plurality of header elements and the at least one flow includes one or more packets with a common packet header element:

12. The system of claim 10, wherein the application recognizer can identify at least one of a file transfer protocol (FTP), a hypertext transfer protocol (HTTP), a simple mail transport protocol (SMTP), a domain name service (DNS), a telnet protocol, a post office protocol (POP), an Internet message access protocol (IMAP), a network time protocol (NTP), a Netbios protocol, a network news transport protocol (NNTP), a network time protocol (NTP), a simple network management protocol (SNMP), an Internet Relay Chat (IRC) protocol, a H.323 protocol, a voice over IP protocol, a NetMeeting(TM) protocol, a Quicktime(TM) protocol, a server message block (SMB) protocol, a RealAudio(TM) protocol, a real time streaming protocol (RTSP), and a real-time transport protocol (RTP).

13. The system of claim 10, wherein the application recognizer signals to the session streamer to treat the at least one flow as a session when the application recognizer cannot identify an application for the at least one flow:

14. The system of claim 10, further comprising a data collector coupled to the session streamer, the data collector for producing service detail records at predetermined intervals for the application corresponding to the session, each service detail record including a billing identifier and a usage information.

15. An apparatus for reconstructing a session, the apparatus comprising:

means for receiving a plurality of packets;

means for identifying at least a first flow in the plurality of packets;

means for identifying an application for the at least a first flow;

means for selecting a corresponding application flow identifier for the application;

means for identifying a plurality of flows in the plurality of packets corresponding to the session using the corresponding application flow identifier.

16. The apparatus of claim 15, further comprising means for reporting application appropriate performance characteristics for the session.

17. The apparatus of claim 15, further comprising means for controlling a network device according to a policy, the policy defining the amount of resources available to the session.

18. The apparatus of claim 15, further comprising means for charging at least one account for resources used during the session.

19. A computer data signal embodied in a carrier wave comprising:

a computer program for session reconstruction;

a first set of instructions for identifying at least one flow in a plurality of packets;

a second set of instructions for analyzing the at least one flow to identify an application corresponding to the flow; and

a third set of instructions for identifying a plurality of flows in the plurality of packets corresponding to the session based on the application.