Riverbed Technology, Inc.

Other

Christopher James White

Steven McCanne

Loris Degioanni

Dimitri Stratton Vlachos

Andrew Ratin

Prem K Gopalan

David Paul Doyle

Bryan Thomas Elverson

Dmitri S Vlachos

Network traffic information from multiple sources, at multiple time scales, and at multiple levels of detail are integrated so that users may more easily identify relevant network information. The network monitoring system stores and manipulates low-level and higher-level network traffic data separately to enable efficient data collection and storage. Packet traffic data is collected, stored, and analyzed at multiple locations. The network monitoring locations communicate summary and aggregate data to central modules, which combine this data to provide an end-to-end description of network traffic at coarser time scales. The network monitoring system enables users to zoom in on high-level, coarse time scale network performance data to one or more lower levels of network performance data at finer time scales. When high-level network performance data of interest is selected, corresponding low-level network performance data is retrieved from the appropriate distributed network monitoring locations to provide additional detailed information.

Distributed network traffic data collection and storage

A network health monitoring application computes aggregate reports of network health by combining status results from a group of segments to render a summary health status indicative of the entire group. Individual status values result from policies, which monitor various segments and metrics, or performance parameters (such as byte counts or retransmissions), concerned with providing a particular service. The policies form a hierarchy defining the general or specific nature of the segments included in the policy according to a range of attributes, in which the attributes define a scope of the segments included in the policy group. Multiple metrics gathered on each segment allow filtering by polices based on the metric, rather than the attribute (hierarchy level), thus lending a hierarchy filtering based on 'vertical' slices of the hierarchy, allowing the user flexibility to filter on specific attribute values while still computing aggregate health at a particular attribute level.

Policy aggregation for computing network health

Multilevel network monitoring system architecture

An automated service discovery and monitoring utility employs automatically generated policies (rules) for monitoring network health of a service based on network discovery using flow data derived from transmissions sent over segments between computing components defining the service. An interactive discovery application employs flow data based on transmissions associated with a service. Analysis of the flow data identifies associated components from inspection of the transmissions. Iterative component selection allows network traversal of components based on flow data of the segments used for providing the service. The interactive service discovery therefore identifies associated components (servers) and segments based on flow data, rather than topology, rendering the flow data to allow a user to make an informed selection of segments and components for inclusion in a service, and generates a set of policies (rules) based on the discovered service dependencies for monitoring various metrics for the components providing the monitored service.

Service network discovery

Some embodiments of the present invention provide systems and methods for detecting anomalies in network traffic. Some embodiments detect anomalies based on time-series activity in network traffic. Upon detection of an anomaly, significant changes can be analyzed to identify abnormal changes in network traffic across different network entities. The identified changes can then be used to determine the cause and the impact of the detected anomaly on the network traffic.

Impact scoring and reducing false positives

Growing community of inventors

Boston, MA, United States of America

Christopher James White