Network monitoring using virtual packets

• US 8,451,731 B1
• Filed: 07/25/2008
• Issued: 05/28/2013
• Est. Priority Date: 07/25/2007
• Status: Active Grant

• Current Assignee: Virtual Instruments Worldwide, Inc.
• Original Assignee: Xangati Incorporated (Virtana Corp.)
• Inventors: Lee, Rosanna, Jagannathan, Rangaswamy, Sanders, Derek, Zhu, Hong, Pan, Xiaohong, Kakatkar, Kishor, Liu, Jing
• Primary Examiner(s): Faroul, Farah
• Application Number:
  US12/180,193
• Time in Patent Office: 1,768 Days
• Field of Search: 370/235, 370/253, 709/224
• US Class Current: 370/235
• CPC Class Codes: H04L 41/0645 by additionally acting on or stimulating the network after receiving notifications
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

A network monitoring device includes a flow processing element, disposed to receive flow information relating to network flows, and to generate a set of virtual packets, each representing a portion of a network flow. The virtual packets are maintained in a time-sequential order, and read by elements of the network monitoring device to generate information relating to network traffic, such as symptoms affecting the communication network, problems affecting the communication network, and otherwise. The network monitoring device randomly samples virtual packets, with at least one of two effects: (1) flow information from traffic reporting devices that are themselves sampling at differing rates can be equalized, with the effect of standardizing information from all of them; (2) the network monitoring device itself can restrict its attention to a fraction of all virtual packets, with the effect of keeping up with a relatively large number of virtual packets.

Claims

1. A method, including steps of:

sampling, at a first predetermined rate, first flow information;

generating first virtual packets in response thereto,

said first virtual packets being equally distributed over a time reported for said first flow information;

sampling, at a second predetermined rate, second flow information;

generating second virtual packets in response thereto; and

recording, at a network monitoring device, only some of the first and second virtual packets whereby the recorded virtual packets represent equivalent sampling for both the first flow information and the second flow information.

2. A method as in claim 1, including steps of reordering either the first or second virtual packets in a time sequential order.

3. A method as in claim 1, including steps of writing the recorded virtual packets to a buffer in a time sequential order.

4. A method as in claim 1, wherein

the predetermined rate is selected dynamically in response to the flow information.

5. A method as in claim 1, further including:

profiling the recorded virtual packets.

6. A method as in claim 1, wherein

either the first or the second flow information comprises crosspoints.

7. A method as in claim 6, wherein

the crosspoints comprise one or more of either an identifier, application, location, interface or time periods.

8. A method as in claim 7, wherein

the crosspoint information is stored for later operation.

9. A method as in claim 1, wherein

said first virtual packets include no payload information.

10. A system comprising:

a first device having;

a flow processor for receiving flow information from a set of flow information gathering devices,

said flow processor configured to generate a sequence of virtual packets for each said flow, said sequence of virtual packets being equally distributed over a time for said flow, said time being reported after an end of said flow;

wherein a first sequence of virtual packets for a first flow is responsive to a first sampling rate of real packets reported in said flow information for said first flow,

wherein a second sequence of virtual packets for a second flow is responsive to a second sampling rate of real packets reported in said flow information for said second flow,

wherein said first and second sequences of virtual packets have equivalent sampling rates relative to real packets in said first and second flows;

a virtual packet buffer for storing virtual packets received from the flow processor;

a virtual bus coupled to the virtual packet buffer through either a discovery engine, a monitoring engine, a profiling engine or a detection engine.

11. The system of claim 10 wherein

the virtual bus is connected to a problem identification device for communicating symptom and user information.

12. The system of claim 10 wherein

the virtual bus is connected to the virtual bus of at least a second device having a flow processor and virtual packet buffer.

13. The system of claim 12 wherein

each device is assigned to monitor a subset of locations.

14. The system of claim 13 wherein

the locations are associated with a set of endpoints and a equal subset of applications and time intervals.

15. A system as in claim 10, wherein

said first sequence of virtual packets include no payload information.

16. A non-transitory processor readable storage device having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method including steps of:

sampling, at a first predetermined rate, first flow information;

generating first virtual packets in response thereto,

said first virtual packets being equally distributed over a time reported for said first flow information;

sampling, at a second predetermined rate, second flow information;

generating second virtual packets in response thereto; and

recording some of the virtual packets whereby the recorded virtual packets represent equivalent sampling for both the first flow information and the second flow information.

17. The non-transitory processor readable storage device of claim 16, wherein

the method further includes steps of reordering those virtual packets in a time sequence.

18. The non-transitory processor readable storage device of claim 16, wherein

the method further includes steps of writing those the virtual packets to a buffer in a time sequential order.

19. The non-transitory processor readable storage device of claim 16, wherein

the method further includes steps of recording only some of the virtual packets generated in response to either the first or the second flow information, whereby at least one element of a network monitoring device receives recorded virtual packets equivalent to sampling of either the first or the second flow information.

20. The non-transitory processor readable storage device of claim 16, wherein

the method further includes profiling the recorded virtual packets.