Real-time adaptive processing of network data packets for analysis

Patent metadata

Field	Value
Publication number	US-10284440-B2
Application number	US-201715603034-A
Country	US
Kind code	B2
Filing date	May 23, 2017
Priority date	Apr 8, 2010
Publication date	May 7, 2019
Grant date	May 7, 2019

Abstract

A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.

First claim

What is claimed is:

1. A method, comprising:
determining first and second sessions associated with data packets received by a network monitoring device at a location in a network;
generating a common header summarizing information in headers of a plurality of data packets in each of the first and second sessions by the network monitoring device; and
generating, for each first and second session, a session record for respectively storing the common header of the first and second session, and storing mapping information representing association of the first session with the second session when the first and second sessions are associated with planes in a same protocol.

2. The method as recited in claim 1 , further including generating a unit of payload metadata summarizing information in payloads of the plurality of the data packets in each of the first and second session by the network monitoring device wherein the generating step further includes storing the payload metadata of each of the first and second session respectively in the session record for each first and second session.

3. The method of claim 2 , further comprising determining a protocol associated with each of the first and second session, information included in the common header or the payload metadata of each first and second session is respectively determined based on a protocol associated with the first and second session.

4. The method of claim 2 , wherein the common header and the payload metadata are generated in real-time responsive to receiving data packets for each of the first and second session from the network.

5. The method of claim 1 , further comprising:
generating performance parameters representing performance of the network for transmitting the plurality of the data packets in each of the first and second sessions; and
adding the performance parameters of the first and second sessions respectively in the first and second session record.

6. The method of claim 5 , wherein the performance parameters comprise at least one of a packet loss rate, a response time, a number of packets or bytes transmitted, parameters indicative of transmission latency, codec parameters, total transfer time for the session, R-Factor (rating factor), MOS (Mean Opinion Score), a file or page size, a file name, sender/receive information, a total transfer time, a user ID, jitter, and phone number.

7. The method of claim 1 , wherein the first session is associated with a first protocol and the second session is associated with a second protocol different than the first protocol.

8. The method of claim 1 , wherein each first and second session record further stores links to the plurality of the data packets respectively in each of the first and second sessions.

9. The method of claim 1 , wherein the common header comprises fields of the headers that remain unchanged throughout each respective first and second session.

10. A network monitoring device for processing network data for analysis, comprising:
a network interface configured to receive data packets at a location in a network; and
a session tracing engine configured to:
determine first and second sessions associated with data packets received by a network monitoring device at a location in a network;
generate a common header summarizing information in headers of a plurality of data packets in each of the first and second sessions by the network monitoring device; and
generate, for each first and second session, a session record for respectively storing the common header of the first and second session, and storing mapping information representing association of the first session with the second session when the first and second sessions are associated with planes in a same protocol.

11. The network monitoring device as recited in claim 10 , wherein the session tracing engine is further configured to generate a unit of payload metadata summarizing information in payloads of the plurality of the data packets in each of the first and second session by the network monitoring device wherein the generating step further includes storing the payload metadata of each of the first and second session respectively in the session record for each first and second session.

12. The network monitoring device as recited in claim 11 , wherein the session tracing engine is further configured to determine a protocol associated with each of the first and second session, information included in the common header or the payload metadata of each first and second session is respectively determined based on a protocol associated with the first and second session.

13. The network monitoring device as recited in claim 11 , wherein the common header and the payload metadata are generated in real-time responsive to receiving data packets for each of the first and second session from the network.

14. The network monitoring device as recited in claim 11 , wherein each first and second session record further stores links to the plurality of the data packets respectively in each of the first and second sessions.

15. The network monitoring device as recited in claim 10 , wherein the session tracing engine is further configured to:
generate performance parameters representing performance of the network for transmitting the plurality of the data packets in each of the first and second sessions; and
add the performance parameters of the first and second sessions respectively in the first and second session record.

16. The network monitoring device as recited in claim 15 , wherein the performance parameters comprise at least one of a packet loss rate, a response time, a number of packets or bytes transmitted, parameters indicative of transmission latency, codec parameters, total transfer time for the session, R-Factor (rating factor), MOS (Mean Opinion Score), a file or page size, a file name, sender/receive information, a total transfer time, a user ID, jitter, and phone number.

17. The network monitoring device as recited in claim 10 , wherein the first session is associated with a first protocol and the second session is associated with a second protocol different than the first protocol.

18. The network monitoring device as recited in claim 10 , wherein the common header comprises fields of the headers that remain unchanged throughout each respective first and second session.

Assignees

• Netscout Systems Inc

Inventors

• Singhal Anil K
• Kelley Jr Bruce A
• Nadkarni Rajeev
• Byrapuram Narendra
• Saraswati Abhishek
• Singhal Ashwani

Classifications

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title

• H04L43/0882

  Utilisation of link capacity · CPC title

• H04L43/16

  Threshold monitoring · CPC title

• H04L43/087

  Jitter · CPC title