Xangati, Inc

Virtual Instruments Worldwide, Inc.

Other

Sun Microsystems, Inc.

Kishor Kakatkar

Rosanna Lee

Rangaswamy Jagannathan

Derek Sanders

Xiaohong Pan

Jing Liu

Hong Zhu

Sridatta Viswanath

Roy Nakashima

James Shuder

Shailesh Prakash

Darek Sanders

Jing Lui

David Messina

A monitoring device responds to status data to detect storms, analysis, and to attempt to remediate those storms. The monitoring device several types of storms, for each of which it has a technique for analysis of the storm. The monitoring device can determine if the storm is due to resource contention, excess or unbalanced performance activity, or network degradation. Once analyzed, the monitoring device analyzes the storm, and attempts to remediate the cause of the storm.

Storm detection, analysis, remediation, and other network behavior

Network monitoring views can be recorded, replayed and shared. A monitoring system receives monitoring data, in response to which a monitoring view can be constructed. The monitoring data is maintained in memory or mass storage. One or more monitoring views can later be constructed in response to user preferences, even if those users would not have known to select those particular preferences or construct those particular monitoring views at the time. The monitoring views constructed in response to that monitoring data can be presented to users in a simulation of the problem, as if it were occurring at that time. Users can send particular monitoring views to others, with both the effects that the monitoring view can be preserved as part of a trouble report, and the persons receiving the monitoring view can have useful insight into what problem the user has pointed to.

Recording, replay, and sharing of live network monitoring views

One network monitoring system maintains both information regarding historical activity and emergent activity of the network. Comparison of recent activity of the network with historical activity allows the system to determine whether recent network activity is within the realm of normal. The system maintains data structures representing a p.d.f. for observable values of network parameters. Such data structures are maintained both for historical and for emergent activity of the network. Recent activity can be compared with the p.d.f. for historical activity to aid in determining whether that recent activity is within the realm of normal. Network activity not within the realm of normal can include values of observable network parameters too high or too low to be consistent with historical activity of the network, or other values too unlikely to be consistent with historical activity at the network. Another network monitoring device includes data structures for maintaining information regarding historical activity of a network and emergent activity of a network. Those data structures include multiple types of observable values as well as multiple types of combinations of multiple observable values. The network monitoring device maintains those data structures including information regarding historical activity of a network and emergent activity of a network only for those source/destination pairs, and only for those nodes, for which maintaining that information would be substantially meaningful. Yet another network monitoring system includes data structures for maintaining information regarding historical activity of a network and emergent activity of a network. Those data structures include observable values for multiple profile dimensions, including source/destination address, application, location, and time. The data structures also include observable values for combinations of more than one of those multiple profile dimensions, including, e.g., (source address)&#xd7;(application), and the like. It is expected that only a relatively sparse set of combinations of more than one of those multiple profile dimensions would have meaningful information associated therewith. The network monitoring system maintains those data structures only for those combinations of more than one of those multiple profile dimensions for which maintaining that information would be substantially meaningful.

Symptom detection using behavior probability density, network monitoring of multiple observation value types, and network monitoring using orthogonal profiling dimensions

One network monitoring system maintains information regarding historical activity and emergent activity of the network. Comparison of recent with historical activity allows the system to determine whether recent activity is within the realm of normal. The system maintains data structures representing a p.d.f. for observable values of network parameters. Another network monitoring device includes data structures for maintaining information regarding historical and emergent activity of a network. This network monitoring device maintains those data structures including information regarding historical and emergent activity of a network only for those source/destination pairs, and only for those nodes, for which maintaining that information would be substantially meaningful. Yet another network monitoring system includes data structures for maintaining information regarding historical and emergent activity of a network that maintains those data structures only for those combinations of more than one of those multiple profile dimensions for which maintaining that information would be substantially meaningful.

A network monitoring device includes a flow processing element, disposed to receive flow information relating to network flows, and to generate a set of virtual packets, each representing a portion of a network flow. The virtual packets are maintained in a time-sequential order, and read by elements of the network monitoring device to generate information relating to network traffic, such as symptoms affecting the communication network, problems affecting the communication network, and otherwise. The network monitoring device randomly samples virtual packets, with at least one of two effects: (1) flow information from traffic reporting devices that are themselves sampling a differing rates can be equalized, with the effect of standardizing information from all of them; (2) the network monitoring device itself can restrict its attention to a fraction of all virtual packets, with the effect of keeping up with a relatively large number of virtual packets.

Network monitoring using virtual packets

A network monitoring device includes a data structure for maintaining information about endpoints involved in network flows. Each endpoint, either a source or a destination for a network flow, has information maintained in a modified binary trie, having a branch for each bit of the source or destination address, but with interior nodes having only a single child node elided. A pruning thread is given a limited amount of time for operation, with the effect that the data structure is maintained available for use except for only that limited amount of time. In the event that the pruning thread is unable to prune the entire data structure, it maintains a marker indicating where last it left off, and returns to that location in the data structure at a later pruning operation.

Network monitoring using bounded memory data structures

A network monitoring system maintains both information regarding historical activity of a network, and information regarding emergent activity of the network. Comparison of historical activity of the network with emergent activity of the network allows the system to determine whether network activity is changing over time. The network monitoring system maintains data structures representing a p.d.f. for observable values of network parameters. Recent activity of the network can be compared with both the p.d.f. for historical activity and for emergent activity to aid in determining whether that recent activity is within the realm of normal, and whether network activity is changing over time. The network monitoring system adjusts that information regarding historical activity of a network in response to emergent activity of that network. The network monitoring device determines information regarding time-dependent activity of that network in response to spectral analysis regarding historical activity of that network.

Network monitoring of behavior probability density

A network monitoring device includes a flow processing element, disposed to receive flow information relating to network flows, and to generate a set of virtual packets, each representing a portion of a network flow. The virtual packets are maintained in a time-sequential order, and read by elements of the network monitoring device to generate information relating to network traffic, such as symptoms affecting the communication network, problems affecting the communication network, and otherwise. The network monitoring device randomly samples virtual packets, with at least one of two effects: (1) flow information from traffic reporting devices that are themselves sampling at differing rates can be equalized, with the effect of standardizing information from all of them; (2) the network monitoring device itself can restrict its attention to a fraction of all virtual packets, with the effect of keeping up with a relatively large number of virtual packets.

A network monitoring system includes devices receiving network traffic information, and generating at least partial results relating to network symptoms. Those partial results are forwarded to devices processing those partial results and generating information relating to problems in response to those symptoms. Problems are reported to users or sent as notifications. In one embodiment, information relating to network traffic is monitored both by a first set of devices associated with source addresses for that network traffic and a second set of devices associated with destination addresses for that network traffic. Information received by that first set of devices includes information relating to both the source address and destination address of network traffic. That first set of devices processes information relating to the source address of network traffic and forwards information relating to the destination address of network traffic to that second set of devices.

Parallel distributed network monitoring

A computer software tool for processing timecard related information representing services to be billed wherein the software tool is part of a purchase order procurement system. The software tool is single software system for procurement services composed of a timecard module integrated with a procurement management module. The timecard process includes a base of functions compatible with existing procurement software systems. The system allows a contractor (buyer) to generate a timecard including services, descriptions and amounts. The generation of the timecard triggers a notification to an approving body which then either approves or declines the timecard. Once approved, timecard information can be exported, e.g., using XML, to a payroll or other external service. The timecard information is processed by the procurement system like any other purchase order item and, moreover, the suites of functionality of the procurement system that relate to purchase order items are also available for timecard information. Approvals can be accomplished by email transmitted notifications and email transmitted forms.

Growing community of inventors

Kothrud, India

Kishor Kakatkar