System and method for detecting dropped aggregated traffic metadata packets

Patent metadata

Field	Value
Publication number	US-11265237-B2
Application number	US-202016885000-A
Country	US
Kind code	B2
Filing date	May 27, 2020
Priority date	May 29, 2019
Publication date	Mar 1, 2022
Grant date	Mar 1, 2022

Abstract

A method includes receiving summary messages summarizing respective aggregated traffic metadata packets output from the at least one traffic management device and an engine. Each summary message identifies an origination pair having a traffic management device and an aggregation engine and a sequence number. The method further includes tracking per subinterval of a series of sub-intervals, highest and lowest sequence numbers and a count of summary messages received for each unique origination pair from the beginning of the subinterval. The method further includes accumulating, per interval, accumulated highest and lowest sequence numbers and an accumulated count of summary messages for each unique origination pair from the beginning of the interval and for all previous subintervals for tracking dropped aggregated traffic metadata packets for the interval. The method further includes estimating a number of dropped aggregated traffic metadata packets for the interval based on the accumulated highest and lowest sequence numbers and the count of summary messages.

First claim

What is claimed is:

1. A method of determining dropped aggregated traffic metadata packets that were output from at least one traffic management device to at least one collector device, the method comprising:
receiving summary messages summarizing respective aggregated traffic metadata packets output from the at least one traffic management device and an engine, wherein each traffic management device includes at least one engine, each summary message corresponding to one of the aggregated traffic metadata packets and identifying an origination pair and a sequence number assigned by the origination pair, the origination pair including a traffic management device of the at least one traffic management device and an engine of the traffic management device from which the aggregated traffic metadata packet was output;
tracking per subinterval of a series of sub-intervals, highest and lowest sequence numbers and a count of summary messages received for each unique origination pair from the beginning of the subinterval, each series of subintervals being included within a respective interval of a series of intervals;
accumulating per interval of the series of intervals accumulated highest and lowest sequence numbers and an accumulated count of summary messages for each unique origination pair from the beginning of the interval and for all previous subintervals of the series of subintervals included in the interval for tracking dropped aggregated traffic metadata packets for the interval; and
estimating a number of dropped aggregated traffic metadata packets for the interval based on the accumulated highest and lowest sequence numbers and the count of summary messages.

2. The method of claim 1 , further comprising:
receiving a data lost notification for one of the subintervals, the data lost notification indicating a data lost event in which information regarding one or more aggregated traffic metadata packets was knowingly discarded from one of the received summary messages due to a full condition of a channel by which the summary messages are received;
adjusting the tracked highest and lowest sequence numbers and a count of summary messages for the subinterval to indicate that the aggregated traffic metadata packets were not dropped during the subinterval.

3. The method of claim 2 , further comprising changing states of a state machine to handle and recover from receiving a data lost indication.

4. The method of claim 1 , wherein tracking during a current subinterval of a series of subintervals includes attributing a received aggregated traffic metadata packet to either the current subinterval or a previous subinterval of the series of subintervals that precedes the current subinterval based on a comparison of the sequence number of the aggregated traffic metadata packet to the highest sequence number of any of the previous subintervals of the series of subintervals.

5. The method of claim 1 , wherein accumulating during a current interval of the series of intervals for a unique origination pair includes updating the accumulated highest and lowest sequence numbers and the accumulated count of summary messages using the highest and lowest sequence numbers and a count of summary messages at the end of each subinterval of the series of subintervals included in the current interval that is not a first subinterval of the series of subintervals included in the current interval.

6. The method of claim 1 , wherein accumulating during a current interval of the series of intervals for a unique origination pair includes clearing the accumulated highest and lowest sequence numbers and the accumulated count of summary messages at the end of a first subinterval of the series of subintervals included in the current interval.

7. The method of claim 1 , wherein estimating the number of dropped aggregated traffic metadata packets for the interval includes:
setting, for a unique origination pair, an expected summary messages value to equal a difference between the accumulated highest and lowest sequence numbers incremented by one of the unique origination pair; and
totaling, for the unique origination pair, for the subintervals included in the interval, a difference between the expected summary messages value and the accumulated count of summary messages.

8. The method of claim 1 , further comprising:
processing the summary messages received;
outputting telemetry data about the aggregated traffic metadata packets based on information determined by processing the summary messages; and
adjusting an action applied for managing or monitoring network traffic based on the telemetry data.

9. A system to estimate dropped aggregated traffic metadata packets that were output from at least one traffic management device to at least one collector device, the system comprising:
a memory configured to store a plurality of programmable instructions; and
at least one processing device in communication with the memory, wherein the at least one processing device, upon execution of the plurality of programmable instructions is configured to:
receive summary messages output by a summary message generator, the summary messages summarizing respective aggregated traffic metadata packets output from the at least one traffic management device and an engine, wherein each traffic management device includes at least one engine, each summary message corresponding to one of the aggregated traffic metadata packets and identifying an origination pair and a sequence number assigned by the origination pair, the origination pair including a traffic management device of the at least one traffic management device and an engine of the traffic management device from which the aggregated traffic metadata packet was output;
track per subinterval of a series of sub-intervals, highest and lowest sequence numbers and a count of summary messages received for each unique origination pair from the beginning of the subinterval, each series of subintervals being included within a respective interval of a series of intervals;
accumulate per interval of the series of intervals accumulated highest and lowest sequence numbers and an accumulated count of summary messages for each unique origination pair from the beginning of the interval and for all previous subintervals of the series of subintervals included in the interval for tracking dropped aggregated traffic metadata packets for the interval; and
estimate a number of dropped aggregated traffic metadata packets for the interval based on the accumulated highest and lowest sequence numbers and the count of summary messages.

10. The system of claim 9 , wherein the at least one processing device, upon execution of the plurality of programmable instructions is further configured to:
receive a data lost notification for one of the subintervals, the data lost notification indicating a data lost event in which information regarding one or more aggregated traffic metadata packets was knowingly discarded from one of the received summary messages due to a full condition of a channel by which the summary messages are received; and
adjust the tracked highest and lowest sequence numbers and a count of summary messages for the subinterval to indicate that the aggregated traffic metadata packets were not dropped during the subinterval.

11. The system of claim 10 , wherein the at least one processing device, upon execution of the plurality of programmable instructions is further configured to change states of a state machine to handle and recover from receiving a data lost indication.

12. The system of claim 9 , wherein tracking during a current subinterval of a series of subintervals includes attributing

Assignees

• Arbor Networks Inc
• Arbor Networks

Inventors

• Adams Andrew Lee
• Hanover Cameron T

Classifications

• H04L43/06

  Generation of reports · CPC title

• H04L43/0876

  Network utilisation, e.g. volume of load or congestion level · CPC title

• H04L41/046

  comprising network management agents or mobile agents therefor · CPC title

• H04L43/067

  using time frame reporting · CPC title

• H04L43/0829 Primary

  Packet loss · CPC title