Managing captured network traffic data

• US 8,601,122 B2
• Filed: 03/19/2012
• Issued: 12/03/2013
• Est. Priority Date: 08/19/2005
• Status: Active Grant

• Current Assignee: Riverbed Technology, LLC (Riverbed Technology Incorporated)
• Original Assignee: Riverbed Technology Incorporated
• Inventors: Malloy, Patrick J., Canney, Michael S., Gehl, Ryan, Cohen, Marc A., Nudelman, Eric S., Elsner, Russell Mark, Schneider, Mark I.
• Primary Examiner(s): NANO, SARGON N
• Application Number:
  US13/424,005
• Publication Number:
  US 20120179816A1
• Time in Patent Office: 624 Days
• Field of Search: 717/127, 717/128, 717/131, 709/223, 709/224, 709/225, 709/226
• US Class Current: 709/224
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps

Abstract

A system and method for managing captured network traffic data is provided. The invention comprises a plurality of capture agents, each being configured to capture the network traffic associated with one or more applications. Each application is associated with one or more capture agents according to an application profile that is stored and maintained in a capture server. When analysis of an application'"'"'s network traffic is required, the capture server contacts the corresponding capture agents according to the application profile. The capture server then effects the identification and archiving of the network traffic that corresponds to a user-defined capture condition. A database at the capture server maintains a record that associates the corresponding network traffic with the user-defined capture condition such that the corresponding network traffic can later be retrieved and analyzed using an analysis engine.

Claims

1. A method of managing traffic information captured by a plurality of capture agents running on points within a network, said method comprising:

receiving, from a user via a graphical user interface, input information linking an application running on the network to a set of the plurality of capture agents;

creating, in a database, an application profile based on the input information mapping the set of the plurality of capture agents to the application;

selecting a portion of the traffic information captured by the plurality of capture agents based on the application profile; and

archiving the selected portion of the traffic information.

2. The method of claim 1, wherein receiving, from the user via the graphical user interface, input information comprises receiving a hostname for at least one of the capture agents.

3. The method of claim 1, wherein receiving, from the user via the graphical user interface, input information comprises receiving an address in the network for at least one of the capture agents.

4. The method of claim 1, wherein receiving, from the user via the graphical user interface, input information comprises receiving a port number for at least one of the capture agents.

5. The method of claim 1, wherein the traffic information is continuously recorded by the plurality of capture agents and traffic information is discarded after a predetermined threshold of traffic information has been reached.

6. The method of claim 1, wherein the traffic information is captured by the capture agents in response to a request by the user.

7. The method of claim 6, further comprising determining a time window for capturing traffic information by the plurality of capture agents.

8. The method of claim 7, wherein determining the time window comprises determining the time window based on a padding factor.

9. The method of claim 8, wherein determining the time window based on the padding factor comprises determining the padding factor based on the application running on the network.

10. The method of claim 8, wherein determining the time window based on the padding factor comprises determining the padding factor based on a problem reported by the user.

11. The method of claim 1, wherein archiving the selected portion of the traffic information comprises archiving snapshots of the traffic information from the set of capture agents responsive to the input information by the user.

12. The method of claim 11, further comprising discarding archived snapshots after a predetermined threshold of snapshots has been reached.

13. A system for managing traffic information captured by a plurality of capture agents running on points within a network, said system comprising:

a database interface coupled to a database of traffic information captured by the plurality of capture agents running on points within the network;

a graphical user interface configured to receive input information from a user linking an application running on the network to a set of the plurality capture agents; and

an analysis processor, configured by executable program code, to create an application profile based on the input information mapping the set of plurality of capture agents to the application, select a portion of the traffic information captured by the plurality of capture agents based on the application profile, and archive the selected portion of the traffic information.

14. The system of claim 13, wherein the analysis processor is configured to discard traffic information after a predetermined threshold of traffic information has been reached.

15. The system of claim 13, wherein the analysis processor is configured to overwrite old traffic information with new traffic information after a threshold in the database of traffic information has been reached.

16. The system of claim 13, wherein the database interface is coupled to a database of traffic information from capture agents that continuously record traffic information.

17. The system of claim 13, wherein the database interface is coupled to a database of traffic information from capture agents that record traffic information responsive to a user input.

18. The system of claim 13, wherein the analysis processor is configured to archive snapshots of traffic information captured by the set of capture agents.

19. A system comprising:

a plurality of capture components that are each configured to record snapshots of network traffic in response to a user request, wherein new snapshots of network traffic overwrites old snapshots of network traffic after a storage threshold is reached,

a database that includes a plurality of profiles, each profile including a set of capture components of the plurality of capture components associated with a particular capture condition, and

a management component that is configured to;

receive information from which a capture condition can be identified,

retrieve, from the database, the set of capture components associated with the identified capture condition, and

effect an archiving of at least a portion of the network traffic that has already been recorded by the set of capture components after the capture condition has been identified.

20. The system of claim 19, further comprising a trouble ticketing component that is configured to manage a plurality of trouble tickets corresponding to a plurality of problems.

21. The system of claim 20, wherein the management component includes a notification component that is configured to transmit a notification message to the trouble ticketing component.