Network Physics, Inc.

Opnet Technologies, Inc.

Riverbed Technology, Inc.

Riverbad Technology, Inc.

Networks Physics, Inc.

Han C Wen

Tomas J Pavel

Minh Duong-van

Mark E Crane

Ian Adam

George Zioulas

Gilbert Grosdidier

Masood Ahmed

Dimitris Stassinopoulos

Joe Sapsford

Richard Blankenbecler

Stephen Guarini

Erik Seilnacht

George Zloulas

Richard Blanckenbecler

Thomas J Pavel

Client network traffic data and server network traffic data regarding a number of network nodes is collected and then grouped by IP address. The network nodes are divided into logical groupings and the network traffic data is presented in the aggregate for all IP addresses in each logical group. The logical groupings may be further divided by protocol, application, port and/or logical group-to-group. Each logical group can be further generalized as either a set of IP addresses (e.g., a business group) or a specific logical link between one set of IP addresses to another set of IP addresses (e.g., a business group link). Either or both of these 'groups' may be divided in further logical sub-groups: for example, by protocol, application, port and in the case of business groups, group-to-group. The logical groups provide facilities for initial problem detection and identification while the logical sub-groups provide facilities for troubleshooting and problem isolation.

Method and system for grouping diagnostic information

During monitoring of IP network traffic, network application monitoring metrics are extracted, aggregated into logical group types and subsequently analyzed by identifying group sets of the logical group types, correlating anomalous conditions across the logically grouped and aggregated metrics, and isolating the anomalous conditions to one or more related members of the logical group types. The metrics may include usage metrics, network performance metrics and application performance metrics.

Method for discovery and troubleshooting of network application usage and performance issues

Network traffic information for nodes of a first logical hierarchy is stored at a monitoring device according to ranks of the nodes within the logical hierarchy as determined by each node's position therein and user preferences. At least some of the network traffic information stored at the network monitoring device may then be reported to another network monitoring device, where it can be aggregated with similar information from other network monitoring devices. Such reporting may occur according to rankings of inter-node communication links between nodes of different logical hierarchies of monitored nodes.

Method and system for managing a distributed network of network monitoring devices

A system and method to visually navigate hierarchical data groups are provided. If a user wishes to graphically view network traffic data for a particular business group of network nodes, a network topology navigation tool may be provided to display to the user such information that is relevant to the selected business group and the corresponding hierarchy level. The user may also be permitted to access more detailed connection information through appropriate drill-downs.

Method and system for topological navigation of hierarchical data groups

A control node of a communication network is operated at a packet bandwidth determined according to observations of performance metrics of the network at the control point. These performance metrics may be one or more of throughput, average fetch time and packet loss. The control node is operated so as to set a control bandwidth to corresponding resonance points of the performance metrics. The resonance points are determined by scanning across a range of control bandwidths, until one or more of the performance metrics is/are optimized. The packet bandwidth is set by varying an inter-packet delay time over selected communication links at the control node.

Method of reducing packet loss by resonance identification in communication networks

A system and method to visually navigate hierarchical data groups are provided. If a user wishes to graphically view network traffic for a particular business group of network nodes, a network topology navigation tool may be provided to display to the user such information that is relevant to the selected business group and the corresponding hierarchy level. The user may also be permitted to access more detailed connection information through appropriate drill-downs.

For each of a number of network performance metrics, an associated value rthat represents a difference between a first correlation coefficient rcomputed for a baseline data set and a second correlation coefficient rcomputed for a second data set that includes the baseline data set and other data points classified as duration outliers is computed. The first and second correlation coefficients for each network performance metric represent correlation between that network performance metric and durations of network connections. The network performance metric that has a largest associated rvalue of all statistically significant rvalues computed is selected as representing the probable root cause of the duration outliers. Statistical significance is measured through comparison of an rvalue with a statistical property of a set of Bayesian correlation coefficients computed for each performance metric.

Bayesian approach to correlating network traffic congestion to performance metrics

Nodes of a network may be allocated to a number of logical groups thereof, and storage space within a network traffic monitoring device coupled to the network then allocated so as to ensure network traffic data for at least a minimum number of the nodes of each of the logical groups is stored.

Method for prioritizing grouped data reduction

A baseline for internet traffic duration is established by (i) collecting internet traffic data regarding file size, server response time, packet loss and round trip time, (ii) removing from this data outliers associated with file size, server response time and packet loss per client type, and (iii) organizing any remaining data into round trip time bins according to median values of round trip time per client type. Thereafter, historical or newly collected Internet traffic data is compared against threshold values for each round trip time bin to locate duration outliers. These duration outliers are indicators of congestion and congestion episodes may be identified by the continued presence of such outliers over successive time intervals.

Method for detecting congestion in internet traffic

Predictions of congestion conditions for a traffic stream in a communication network are applied to modify an initial congestion window size for the traffic stream; and dynamic bandwidth control is thereafter applied to the traffic stream. This dynamic bandwidth control may include modulating inter-packet bandwidths of the traffic stream according to a capacity of a bottleneck in a communication path through which the traffic stream passes in the communication network. The predictions of congestion conditions may be based on monitoring packet losses and/or round trip times within the communication network for a selected period of time. The monitoring may be performed on at least one of a traffic stream-by traffic stream basis, a connection-by-connection basis, a link-by-link basis, or a destination-by-destination basis.

Method for accelerating TCP flows in communication networks with dynamic control

A moving window of data is used to determine a local baseline as a moving average of the data weighted by the number of measurements in each time interval. A next measurement associated with a next time interval is compared to a value associated with the baseline to determine an outlier. In some cases, for example where the time series of the data shows small variability around a local mean, the next measurement is compared to a multiple of the weighted moving average to determine an outlier. In other cases, for example where the time series of the data shows significant variability around the local mean, the next measurement is compared to the sum of the weighted moving average and a multiple of a moving root mean square deviation value weighted by the number of measurements in each time interval and in some cases, a damping factor.

Method for real-time auto-detection of outliers

Packet round trip times (RTT) within a communication network are measured and from those measurements information regarding congestion conditions within the network is extracted. The RTT measurements are organized into an invariant distribution (a histogram) and an analytical tool which is designed to reveal periodicity information (such as a Fourier or wavelet transform, etc.) is applied to the distribution to obtain a period plot. From this period plot, bandwidth information (indicative of the congestion conditions and/or link capacities within the network) can be obtained.

Method for determining network congestion and link capacities

Congestion within a traffic stream of interest in a communication network is characterized as self-induced congestion or cross-induced congestion by analyzing a correlation result of a time series of throughput data of the traffic stream of interest and making the characterization based on power spectrum features found in the correlation result. The correlation result may be obtained through a Fourier analysis, a wavelet analysis or any mathematical process based on locating periodicities in the time series. In some cases, the characterization is made at a node in the communication network that is downstream from the congestion, while in other cases, the characterization is made at a node in the communication network that is upstream of the congestion.

Method for dynamical identification of network congestion characteristics

Congestion within a communication is controlled by rate limiting packet transmissions over selected communication links within the network and modulating the rate limiting according to buffer occupancies at control nodes within the network. Preferably, though not necessarily, the rate limiting of the packet transmissions is performed at an aggregate level for all traffic streams utilizing the selected communication links. The rate limiting may also be performed dynamically in response to measured network performance metrics; such as the throughput of the selected communication links input to the control points and/or the buffer occupancy level at the control points. The network performance metrics may be measured according to at least one of: a moving average of the measured quantity, a standard average of the measured quantity, or another filtered average of the measured quantity. The rate limiting may be achieved by varying an inter-packet delay time over the selected communication links at the control points. The control points themselves may be located upstream or even downstream (or both) of congested nodes within the network and need only be located on only a few of a number of communication links that are coupled to a congested node within the network. More generally, the control points need only be associated with a fraction of the total number of traffic streams applied to a congested node within the network.

Method for reducing fetch time in a congested communication network

End-to-end packet losses of one or more traffic streams transmitted across a congested network may be reduced by setting the bandwidths of the corresponding traffic streams at critical values thereof at one or more control points along the network topology. The critical value of the bandwidths may be determined by monitoring buffer occupancy at the control point(s). Buffer occupancy may be determined by periodically sweeping down from a maximum bandwidth value according to a monotonically decaying exponential function.

Growing community of inventors

San Jose, CA, United States of America

Han C Wen