Riverbed Technology, Inc.

Opnet Technologies, Inc.

John Wilson Strohm

Patrick J Malloy

Antoine D Dunn

Alain J Cohen

Dana Znamova

Mahesh Lavannis

Russell Mark Elsner

Ryan Gehl

Nishant Gupta

Prasanna Sukumar

William E Bardon, Jr

Gehl Ryan

Steven Niemczyk

Marc I Schneider

Jerome Plun

Michael Canney

Steve Niemczyk

Sukanya Sreshta

Stephen Pendleton

John McNicholas

Abbas Haider Ali

A network analysis system provides for a user-definable display of information related to messages communicated on the network. The network analysis system includes one or more display formats that provide a display of message exchanges between nodes of a network, and a display augmenter that provides additional information on the display based on a user-defined visualization. The user defined visualization includes augmenting the display based on user-defined coloring characteristics and/or augmenting the display with user-defined labels. To further facilitate user control of the augmentation of the display, the system accepts user-defined programs for discriminating among messages, for controlling the labeling of messages, and for controlling the coloring of messages and labels. Commonly used user-defined characteristics and labels are stored in a library, for use via a selection from among the library entries.

User-configurable network performance monitors

A user interface to a network simulator facilitates the use of application layer parameters and application layer logic. The user interface is configured to allow the user to define the input in a graphic form, or a text/programming form, or a combination of both. The user interface provides common graphic forms for both inputting the data to the simulator as well as for displaying the resultant data from the simulator. In response, the simulator and user interface may provide updated information to reflect the impact of changes made to application layer parameters and logic.

Application level interface to network analysis tools

The embodiments provide for analyzing activity of devices in a network. Activity from a device may result from multiple devices translated to a common address, such as a public internet protocol (IP) address. In some embodiments, the activity from a network or device is analyzed to identify if multiple devices communicate via translated addresses from the common address. The devices may be identified based on various criteria, such as a unique identifier, protocol header information, or a media access control (or 'MAC') address. Other criteria may also be employed. Each device that is mapped to common address is then remapped so that each device has its own address. The activity data is then modified so that each device is correlated with its unique address. Alternatively, a new activity data file may be generated so that the activity of each device is indicated.

Mapping virtual internet protocol addresses

Performance metrics related to the processing and propagation of messages related to select applications are collected during a simulation of a network. Each message associated with an application is tagged, and each simulated packet that contains some or all of a tagged message is correspondingly tagged to facilitate the creation of transmit records and receive records. A post processor is configured to collate transmit and receive records of each tagged message to identify delays associated with each node that processes the message, and each link that propagates the message from node to node within the network. The processed timing information is provided to the user via an interactive user interface that allows the user to view the timing information from an application layer perspective.

Tracking, analyzing, and visualizing application delay

A method of identifying differences between activity data files includes determining a difference between the activity data files. Causal analysis may be performed to identify a cause of the difference. The difference and/or the cause of the difference may be rendered based on a rendering template. Tier pairs between the activity data files may be matched and a user may be queried to confirm the tier pair match. Statistical and/or protocol differences between each of the activity files may be presented. Transactions between each of the activity data files may be matched including comparing the content files in each of the activity data files that account for the transactions. Client side differences between each of the activity data files may be identified. A categorization may be assigned to each of the determined differences. Determined differences may be excluded from the rendering.

Identifying and reporting differences in network activity data files

The locations of nodes in a network are determined relative to the location of monitoring devices that collect trace information on the network. By appropriate sorting, filtering, and characterizing the trace information, nodes are identified as being local to or remote from each monitoring device that detects traffic to or from the node. If the trace information is insufficient to determine the relative location of a node, the node is identified as such. By identifying the nodes whose locations can be determined automatically by this analysis of the trace information, the number of nodes whose locations must be determined by more costly manual methods can be substantially reduced.

Automatic estimation of node location based on trace information

Data representing application deployment attributes, network topology, and network performance attributes based on a reduced set of element attributes is utilized to simulate application deployment. The data may be received from a user directly, a program that models a network topology or application behavior, and a wizard that implies the data based on an interview process. The simulation may be based on application deployment attributes including application traffic pattern, application message sizes, network topology, and network performance attributes. The element attributes may be determined from a lookup table of element operating characteristics that may contain element maximum and minimum boundary operating values utilized to interpolate other operating conditions. Application response time may be derived using an iterative analysis based on multiple instances of one or more applications wherein a predetermined number of iterations is used or until a substantially steady state of network performance is achieved.

Network capacity planning

A user interface to a network simulator facilitates the use of application layer parameters and application layer logic. The user interface is configured to allow the user to define the input in a graphic form, or a text/programming form, or a combination of both. Preferably, the user interface provides common graphic forms for both inputting the data to the simulator as well as for displaying the resultant data from the simulator, thereby easing the progression from the analysis of output from one simulation to the generation of new input for a subsequent simulation.

A method for remapping a Media Access Control (MAC) address mapped to a virtual IP address. The method includes examining an activity data file to identify the virtual IP address mapped to the MAC address and remapping the identified MAC address to an IP address. The virtual IP address may be identified utilizing a criteria, such as by determining that the virtual IP address may have two or more mapped MAC addresses. Other criteria may also be suitably employed. A portion of the IP address may be automatically generated. A user may be queried to confirm the generated portion of the IP address. The portion of the IP address may be determined based on prior user entrance of an IP address. The portion of the IP address may be predetermined by a user assigning a naming convention.

A graphic user interface facilitates the hierarchical analysis of timing parameters related to network-based applications. At the top level of the hierarchy, the user is presented a summary of the delays incurred while running an application, or while simulating the running of an application, organized by delay categories, including processing delays at each node, as well as propagation delays at each link between nodes. The interface enables a user to 'drill down' into lower levels of the timing information hierarchy by 'clicking' on currently displayed information. The information is presented in a form most appropriate to the level of analysis. The presentation forms include, for example, pie-charts, multi-variable timing diagrams (in both absolute and relative forms), data exchange charts, and so on, and 'zoom' capabilities are provided as appropriate to the particular display form.

Application delay analysis

Time-varying latency is estimated based on the round-trip time between the time of sending a message and the time of receiving an acknowledgement of receipt of the message. The round-trip time relative to a transmitter is modeled as a combination of known, or determinable, delays, plus an unknown latency, plus a processing/acknowledgement delay at the receiver. The estimated time-varying latency is further refined to give more weight to estimates based on fewer unknowns or a lesser magnitude of unknowns, and to impose physical constraints, such as assuring that the estimate does not imply an unrealizable event. TCP-specific constraints and assumptions are also applied to further refine the latency estimates.

Growing community of inventors

Rockville, MD, United States of America

John Wilson Strohm