Netscout Systems, Inc.

Netscout Service Level Corporation

Bruce A Kelley, Jr

Rajeev Nadkarni

Anil K Singhal

Narendra Byrapuram

Abhishek Saraswati

John Peter Curtin

Tauras Liubinskas

Gregory Mayo

Ashwani Singhal

Bruce Sweet

Sandeep Prasad

Gev F Daruwalla

Erdem Uysal

Gregory Pegram

Andrew M Levin

Yuming Huang

John Fulreader

A system having a network monitor communicating with U and C probes monitoring SGW-U and SGW-Cs. The U probes buffer captured user plane packets from which they determine new sessions and send new session data to the network monitor, the new session data including an IP address pair of the corresponding U probe and SGW-U. The C probes inspect captured control plane packets, determine control plane packets having a same IP address as an SGW-U in the new session data, and send associated control data to a particular U probe having the IP address paired with the IP address of the SGW-U, wherein the particular U probe correlates the control data with buffered user plane packets and generates associated monitoring data.

Matching user and control plane data in a network system using control and user plane separation

A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable network probe devices arranged in a cluster format. A ciphered packet is received from one or more MMEs at a packet switching device. The packet switching device in turn sends all the ciphered packets to each of the plurality of clustered probes. Each of the network probes then in turn deciphers the packets received from the MME and extracts metadata from the deciphered packet to identify subscriber session information contained in the received packet. Each of the network probes then selectively retains deciphered packet information relating to a subscriber session and/or other prescribed criteria designated for that particular network probe and discards the remaining deciphered packet or portions of the packet so as to balance the load amongst the plurality of probes based upon prescribed load balancing criteria. KPI and other session related data is generated in a network probe associated with a subscriber session from the retained deciphered packet information. Subscriber session related data from each clustered network probe is then aggregated with at least one monitoring device operably coupled to the clustered probes such that a user of the monitoring device is provided with the perception that the monitoring device is coupled to a single probe.

System and method for load balancing of network packets received from a MME with smart filtering

A system for performing computer network service chain analytics includes network-connected devices containing a plurality of virtual network functions having elements and a data model for storing a plurality of metrics related to the plurality of virtual network functions and a service chain intelligence engine in communication with the one or more network-connected devices and the data model. The memory device contains a set of instructions that causes a processor to analyze the plurality of virtual network functions to automatically identify one or more service chains, to automatically determine, using the data model, performance behavior characteristics of each element for each of the identified service chains and to automatically generate an alarm, in response to determining that the performance behavior characteristics of one or more elements of at least one of the identified one or more service chains does not meet a predefined set of the performance behavior characteristics.

Systems and methods for performing computer network service chain analytics

Method for monitoring network performance in a telecommunication network coupled with a plurality of Virtual Machines (VM) arranged in a cluster format is disclosed. A packet is received at a VM smart cluster device. Metadata is extracted from the packet. The packet can be distributed to one of the plurality of VMs. Key performance indicator (KPI) session related data associated with a subscriber in one of the plurality of VMs that receives the distributed packet can be generated.

System and method for monitoring network performance

A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable Virtual Machines (VM)/probes arranged in a cluster format. A ciphered packet is received from a MME at a smart cluster device/probe whereby data is aggregated from the individual clustered VMs/probes for distribution to a monitoring device. The smart cluster device/probe is preferably configured to decipher the ciphered packet received from the MME and extract metadata from the deciphered packet to identify subscriber information for the received packet. The deciphered packet is then distributed to one of the plurality of clustered probes to balance the load amongst the plurality of clustered probes. The balancing of loads is based upon prescribed load balancing criteria such that each packet received for an identified subscriber is sent to a same probe such that load balancing is performed on a per subscriber basis and/or with other state-based criteria. KPI session related data associated with a subscriber is generated in a clustered probe that receives the distributed packet from the smart cluster device/probe. Subscriber related data from each clustered probe is then aggregated with at least one monitoring device operably coupled to the clustered probes such that a user of the monitoring device is provided with the perception that the monitoring device is coupled to a single probe.

System and method for load balancing of network packets received from a MME with smart clustering

A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.

Real-time adaptive processing of network data packets for analysis

A system for selective user plane (UP) monitoring includes a service gateway (SGW) having a plurality of units. The system further includes a network packet broker (NPB) configured to receive packets including UP data from tunnels created to enable transmission of the UP packets from UE to the plurality of SGW units. The NPB is also configured to receive packets including control plane (CP) data from channels enabling transmission of the CP packets from a base transceiver station to the SGW. The system also includes a plurality of probes operatively coupled to the NPB. The probes are configured to generate first metrics associated with the received CP packets and to selectively generate second metrics associated with the received UP packets based on one or more identifiers. The NPB is configured to forward UP packets being processed by a particular SGW unit to a particular probe of the plurality of probes.

Selective user plane monitoring multiple monitoring probes when a serving gateway has multiple IP addresses

A system and method to aggregate subscriber-perspective data from live data packets of network traffic. The method includes inspecting live packets of network traffic exchanged with a plurality of subscriber end devices. Network traffic exchanged with a subscriber end device can include network traffic exchanged with a different subscriber end device or with an application server. The packet inspection is performed at a location of interception of the live packets, each subscriber end device being an end device correlated with a subscriber. The method further includes selecting, at the location, content data of the inspected packets that correspond to packets exchanged with a selected subscriber end device of the plurality of subscriber end devices, aggregating, at the location, the content data selected, wherein the content data has not been previously aggregated, and outputting, at the location, results of the aggregation.

System and method for aggregating subscriber perspective data

A system and method is provided for calculating session initiation protocol (SIP) key performance indicators (KPIs) for multimedia communication in a network accessing network packets monitored over time. The method includes accessing network packets monitored over time, detecting a SIP response message of the monitored network packets, and accounting for the detected SIP response message in a time window of a series of consecutive time windows that includes the SIP response message's associated observed time. The SIP response message has an associated observed time at which the monitored SIP message was observed during monitoring. The method further includes pairing a SIP request message expected to be paired with the detected SIP response message with the detected SIP response message and accounting for the paired SIP request message in the time window with which the detected SIP response message is accounted. The method further includes calculating a KPI for the time window using the detected SIP response message and its paired SIP request message that are accounted for in the time window.

System and method for calculating SIP KPIs for a time window

Internet protocol packets are statelessly identified as associated with a particular session-instance by identifying a key, or session-instance identifier, within the data (or payload) portion of a user plane packet. This identifier is specific to the session-instance and remains constant throughout the session-instance. Using this stateless identification, transmitted user plane packets are automatically routed at the transmission speed of the transmission link using a method that automatically balances the analysis processing load between network probes. The load is balanced by routing the user plane packet to a network probe that is either already analyzing the session-instance or by routing the user plane packet to a system that has processing capacity to analyze a new session-instance. The network probe then analyzes the user plane packet and the session-instance to measure the quality of the user experience of the session-instance and performance of the network.

Growing community of inventors

Westford, MA, United States of America

Bruce A Kelley, Jr