Netscout Systems, Inc.

Netscout Systems Texas, LLC

Tektronix, Inc.

Tektronix Texas, LLC

Telefonaktiebolaget Lm Ericsson (publ)

John Peter Curtin

Vignesh Janakiraman

Bruce A Kelley, Jr

Anil K Singhal

Abhishek Saraswati

Rajeev Nadkarni

Narendra Byrapuram

Tauras Liubinskas

Balaji Ratakonda

Ryan L Pipkin

Aleksey G Ivershen

Adrian Cornel Soncodi

Quenie Qinghua Sun

James Hall

Dipankar Ray

Seshu Dommaraju

Corey A Garrow

Syed Muntaqa Ali

Stephen David Croll

Sonal Pauddar

Pankaj Pobaru

Yen W Chang

Tarun M Tiwari

William Kelly

Brian Haarberg

Daniel Gray

Ryan Lee Pipkin

Stephan David Croll

A method includes identifying, via a kernel application executing in a kernel of a server hosting an application, a handshake operation for a communication session between a client device and the server; retrieving, via the kernel application, a session identifier for the communication session from one or more handshaking messages of the handshake operation for the communication session; storing, via the kernel application, the session identifier in a cache within the kernel; retrieving, via the kernel application, one or more data transfer messages of the communication session after the communication session has been established; correlating, via the kernel application, the one or more data transfer messages of the communication session based on the one or more data transfer messages containing the session identifier; and generating, via the kernel application, a record comprising the one or more correlated data transfer messages.

Systems and methods for correlating decrypted TLS messages with network data in real time

A system having a network monitor communicating with U and C probes monitoring SGW-U and SGW-Cs. The U probes buffer captured user plane packets from which they determine new sessions and send new session data to the network monitor, the new session data including an IP address pair of the corresponding U probe and SGW-U. The C probes inspect captured control plane packets, determine control plane packets having a same IP address as an SGW-U in the new session data, and send associated control data to a particular U probe having the IP address paired with the IP address of the SGW-U, wherein the particular U probe correlates the control data with buffered user plane packets and generates associated monitoring data.

Matching user and control plane data in a network system using control and user plane separation

A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable network probe devices arranged in a cluster format. A ciphered packet is received from one or more MMEs at a packet switching device. The packet switching device in turn sends all the ciphered packets to each of the plurality of clustered probes. Each of the network probes then in turn deciphers the packets received from the MME and extracts metadata from the deciphered packet to identify subscriber session information contained in the received packet. Each of the network probes then selectively retains deciphered packet information relating to a subscriber session and/or other prescribed criteria designated for that particular network probe and discards the remaining deciphered packet or portions of the packet so as to balance the load amongst the plurality of probes based upon prescribed load balancing criteria. KPI and other session related data is generated in a network probe associated with a subscriber session from the retained deciphered packet information. Subscriber session related data from each clustered network probe is then aggregated with at least one monitoring device operably coupled to the clustered probes such that a user of the monitoring device is provided with the perception that the monitoring device is coupled to a single probe.

System and method for load balancing of network packets received from a MME with smart filtering

Method for monitoring network performance in a telecommunication network coupled with a plurality of Virtual Machines (VM) arranged in a cluster format is disclosed. A packet is received at a VM smart cluster device. Metadata is extracted from the packet. The packet can be distributed to one of the plurality of VMs. Key performance indicator (KPI) session related data associated with a subscriber in one of the plurality of VMs that receives the distributed packet can be generated.

System and method for monitoring network performance

A network monitoring system is provided that includes a processor and a memory coupled to the processor. A plurality of services provided by a network operator is identified. A plurality of Key Performance Indicators (KPIs) associated with the identified plurality of services is calculated on a per service basis. Individual services provided by the network operator are characterized based on the calculated plurality of KPIs. A root cause of service level failures for one or more of the plurality of services is identified, in response to determining that at least one of the characterized service levels does not meet predefined service level objectives for the one or more of the plurality of services.

System and method for automatically identifying failure in services deployed by mobile network operators

A system and method for monitoring one or more Mobility Management Entities (MMEs) with a plurality of scalable Virtual Machines (VM)/probes arranged in a cluster format. A ciphered packet is received from a MME at a smart cluster device/probe whereby data is aggregated from the individual clustered VMs/probes for distribution to a monitoring device. The smart cluster device/probe is preferably configured to decipher the ciphered packet received from the MME and extract metadata from the deciphered packet to identify subscriber information for the received packet. The deciphered packet is then distributed to one of the plurality of clustered probes to balance the load amongst the plurality of clustered probes. The balancing of loads is based upon prescribed load balancing criteria such that each packet received for an identified subscriber is sent to a same probe such that load balancing is performed on a per subscriber basis and/or with other state-based criteria. KPI session related data associated with a subscriber is generated in a clustered probe that receives the distributed packet from the smart cluster device/probe. Subscriber related data from each clustered probe is then aggregated with at least one monitoring device operably coupled to the clustered probes such that a user of the monitoring device is provided with the perception that the monitoring device is coupled to a single probe.

System and method for load balancing of network packets received from a MME with smart clustering

A network monitoring system is provided that includes a processor, a memory coupled to the processor and a database that includes session data of one or more transactions in a multiprotocol wireless communication system. The network monitoring system further includes a rule engine configured and operable to store rules associated with at least one rule set. The network monitoring system also includes an analysis engine configured to identify a root cause of a failure for one or more of the transactions based on at least one rule in the rule set.

Multi cause correlation in wireless protocols

A network monitoring system is provided that includes a processor, a memory coupled to the processor and a database that includes key performance indicator (KPI) records for monitoring a wireless communication system. The network monitoring system further includes a rules engine configured and operable to store in the memory KPI rules associated with at least one rule set. The network monitoring system also includes an analysis engine configured and operable to identify a list of root causes identifying failure events based on the at least one KPI rule in the at least one rule set.

Multi KPI correlation in wireless protocols

A stream based storage system includes a plurality of storage nodes configured to provide storage and retrieval of at least a time-based portion of one or more data streams in response to a receipt of a data storage/retrieval request associated with the one or more data streams. Each of the one or more data streams includes a plurality of time-ordered items. The stream based storage system further includes a plurality of applications communicatively coupled to the plurality of storage nodes. The plurality of applications is configured to issue the data storage/retrieval request associated with the one or more data items.

Stream-based object storage solution for real-time applications

A fully-connected mesh network includes a plurality of switches. A first switch receives a packet traveling through the mesh network from an external source node to an external destination node specified by the packet. A plurality of links, which are all included in a mesh link aggregation group (LAG), couple each possible pair of the switches by a respective single link. Each of the respective links is included individually in an individual LAG. Each of the switches is configured to receive a packet from another switch of the plurality of switches via only the mesh LAG, and each switch that receives a packet via the mesh LAG is configured to transmit the packet to another switch of the plurality of switches via only one of the individual LAGs. The packet travels to the destination node at most two hops across the plurality of switches.

Fully connected network

A system and method for monitoring a communication network is provided. The method includes capturing network data from network traffic of the communication network by a plurality of probes monitoring the communication network. The method further includes detecting by lightweight analysis a data packet of the captured network data that includes information related to a transactional procedure failure transacted by an end-user device and determining an identity of the end-user device. The method further includes sharing the identity of the end-user device with other probes of the plurality of probes, adding the end-user device's identity to respective whitelists associated with the probes of the plurality of probes, and performing, for end-user device identities included in the respective whitelists, detailed analysis of network data during a predetermined time period.

Reducing an amount of captured network traffic data to analyze

A system compatible for use with ATCA includes a chassis comprising a first and a second plurality of slots for receiving circuit boards. The chassis further includes a midplane having a front surface and a back surface. The midplane extends between the first plurality of slots and the second plurality of slots. The midplane has a first plurality of connectors affixed to the front surface and has a second plurality of connectors affixed to the back surface. Each connector is arranged to accept a circuit board. The midplane forms an interconnection scheme such that one of the first plurality of slots is directly connected to one of the second plurality of slots. The one of the first plurality of slots and the one of the second plurality of slots extend in opposite directions from their respective connections on the midplane.

Growing community of inventors

Richardson, TX, United States of America

John Peter Curtin