Riverbed Technology, Inc.

Opnet Technologies, Inc.

Other

Patrick J Malloy

Antoine D Dunn

Alain J Cohen

John Wilson Strohm

Russell Mark Elsner

Ryan Gehl

Dana Znamova

Steven Niemczyk

Peter Anthony Crosby

Robert Meagher

Marc I Schneider

Alex Chernyakov

Jerome Plun

Mahesh Lavannis

Michael Canney

Marc A Cohen

Eric S Nudelman

Steve Niemczyk

Michael L Cohen

Steven J Baron

Nishant Gupta

Prasanna Sukumar

Seth Martin

Cheryl D Stocks

William E Bardon, Jr

Gehl Ryan

Alexey Shakula

Yevgeny Gurevich

Nicole Andree M Shoblom

Robert C Mollitor

Christopher Hull

Norma J Malloy

Mark I Schneider

Abbas Haider Ali

George Cathey

Mark E C Robinson

Denis J C Ducasse

Aaron R Coble

Sukanya Sreshta

Stephen Pendleton

John McNicholas

Vivek Narayanan

Marius Popa

Daniel Fuentes

Measurement data may be collected for a computing system, where the measurement data may correspond to leaf nodes in a tree that organizes the measurement data into a hierarchy of categories. A score associated with a first node in the tree may be calculated based on the measurement data and a set of weights, where each node in the tree may be associated with a weight in the set of weights, and where a score associated with a node in the tree may be based on scores associated with child nodes of the node. A first score corresponding to the computing system may be reported relative to other scores corresponding to other computing systems, where the other scores are computed based on other measurement data collected from other computing systems and the set of weights.

Computing a digital experience index

A first capture system that captures network communication events related to an application, and a second capture system that captures internal processing events related to the application. A visualization system analyzes the data captured by each of the capture systems, synchronizes and correlates the data, and presents an integrated display of these communication and processing events. In a preferred embodiment, the communicated messages include an identifier of the application, and the processing components also associate an identifier of the application to each recorded processing event. To facilitate the integrated display of the events, the visualization system synchronizes the recorded communication and processing events to a common time base.

Capture, analysis, and visualization of concurrent system and network behavior of an application

To evaluate a network's performance in processing communications related to a target transaction, a set of 'reference' communications corresponding to the target transaction are compared to a larger set of communications in the network in a 'production' environment, to identify the occurrence of the target transaction in the production environment. Preferably, the reference communications are recorded in a laboratory environment that models the production environment, or recorded from the production environment during a period of minimal other activities. A variety of filters are used to eliminate communications in the production environment that are apparently unrelated to the target transaction, including filters based on the time-order of communications among the nodes, the size of the packets being communicated, and the content of the communications. If necessary, after eliminating the apparently unrelated communications from consideration, the remaining production communications are compared to the reference communications to identify the most likely production communications corresponding to the reference communications.

Packet tracing

A network analysis system provides for a user-definable display of information related to messages communicated on the network. The network analysis system includes one or more display formats that provide a display of message exchanges between nodes of a network, and a display augmenter that provides additional information on the display based on a user-defined visualization. The user defined visualization includes augmenting the display based on user-defined coloring characteristics and/or augmenting the display with user-defined labels. To further facilitate user control of the augmentation of the display, the system accepts user-defined programs for discriminating among messages, for controlling the labeling of messages, and for controlling the coloring of messages and labels. Commonly used user-defined characteristics and labels are stored in a library, for use via a selection from among the library entries.

User-configurable network performance monitors

The present invention relates to correlating requests between a client and a server to a particular transaction. In one embodiment, transactions in a system of clients and servers are monitored and traced. From this information, a context comprising sets or groupings of transaction call sequences are determined. For example, a sequence of method calls on a client process is traced to a socket carrying data for transmission of a request message to a server. In response to this request message, the server then executes a set of method calls that can be correlated to the request message and the socket. This set of actions is considered part of a causally related grouping, and thus, associated together. In one embodiment, HTTP requests from a client may be comprise a unique custom header that is readily identified and traced. For other protocols, a client socket is associated with a corresponding server socket or to data received over a socket receive call.

Correlating input and output requests between client and server components in a multi-tier application

In a network that includes intermediary nodes, such as WAN accelerators, that transform messages between nodes, an end-to-end path of the messages is determined. The determined end-to-end path is used in subsequent analyses of message traces, to identify timing and other factors related to the performance of the network relative to the propagation of these messages, including the propagation of the transformed messages. A variety of techniques are presented for determining the path of the messages, depending upon the characteristics of the collected trace data. Upon determining the message path, the traces are synchronized in time and correlations between the connections along the path are determined, including causal relationships. In a preferred embodiment, a user identifies an application process between or among particular nodes of a network, and the system provides a variety of formats for viewing statistics related to the performance of the application on the network.

End-to-end analysis of transactions in networks with traffic-altering devices

A network capture element is embodied on a virtual machine, and a utility function is embodied on the actual device, preferably within the virtual machine manager. Both the utility function and the traffic capture element are configured to monitor communication events. To minimize the overhead imposed, the utility function is configured to merely store the time that the event occurred on the actual machine, corresponding to an identifier of the event. The network capture element, on the other hand, performs the time consuming tasks of filtering the communications, selectively storing some or all of the data content of the communications, characterizing the data content, and so on. Instead of storing the virtual time that the communication event occurred at the virtual machine, the network capture element uses the identifier of the communication event to retrieve the actual time that the communication event occurred on the actual machine.

Correcting packet timestamps in virtualized environments

Embodiments provide methods for managing data generated by software transactions, such as event tracing software. In one embodiment, data generated by event tracing software is monitored. The throughput of the data generated may then be modulated based on various criteria, such as a target data rate. The throughput target may be specified on a per-system basis or individual basis. Based on the throughput, the level of detail recorded is modulated. Individual processes may determine a limit or quota depending on their contribution to the throughput. In one embodiment, the method calls for a trace are modified with different property specifications to meet a desired throughput of event tracing data.

Overhead management for event tracing

The performance of a monitored system is profiled based on sampling a portion of its operations. In one embodiment, the monitored system allocates memory for objects created as instances of classes and automatically performs regular garbage collection to reclaim memory. A variety of sampling techniques are used to minimize the impact on the performance of the monitored system. Characteristic memory utilization patterns can then be estimated for classes based on the samples. The patterns may be presented to a user for review and analysis. Characteristics of the monitored system's performance may be presented in an interactive interface that allows the user to trace the cause of the presented memory utilization patterns, and provides statistics regarding memory allocation and release to guide the user in this analysis.

Memory utilization analysis

Individual network activities are correlated to interactions with a target web page to facilitate an analysis of the performance of the web page. This correlation is preferably performed using a combination of heuristics and rules developed to filter network activities into those activities that are likely to have been caused by the particular transaction, and those that are unlikely to be associated with that transaction. The activities that are identified as being associated with the transaction are subsequently organized to identify a time-flow of these activities within the transaction, from which performance statistics can be determined and presented to a user. Because the individual activities within the transaction are identified and time-ordered, an analysis of the effects of each activity on the overall performance of the web page can be performed to identify potential problem areas, or to diagnose reported problems.

Web transaction analysis

A user interface to a network simulator facilitates the use of application layer parameters and application layer logic. The user interface is configured to allow the user to define the input in a graphic form, or a text/programming form, or a combination of both. The user interface provides common graphic forms for both inputting the data to the simulator as well as for displaying the resultant data from the simulator. In response, the simulator and user interface may provide updated information to reflect the impact of changes made to application layer parameters and logic.

Application level interface to network analysis tools

A system and method for managing captured network traffic data is provided. The invention comprises a plurality of capture agents, each being configured to capture the network traffic associated with one or more applications. Each application is associated with one or more capture agents according to an application profile that is stored and maintained in a capture server. When analysis of an application's network traffic is required, the capture server contacts the corresponding capture agents according to the application profile. The capture server then effects the identification and archiving of the network traffic that corresponds to a user-defined capture condition. A database at the capture server maintains a record that associates the corresponding network traffic with the user-defined capture condition such that the corresponding network traffic can later be retrieved and analyzed using an analysis engine.

Managing captured network traffic data

The embodiments provide for analyzing activity of devices in a network. Activity from a device may result from multiple devices translated to a common address, such as a public internet protocol (IP) address. In some embodiments, the activity from a network or device is analyzed to identify if multiple devices communicate via translated addresses from the common address. The devices may be identified based on various criteria, such as a unique identifier, protocol header information, or a media access control (or 'MAC') address. Other criteria may also be employed. Each device that is mapped to common address is then remapped so that each device has its own address. The activity data is then modified so that each device is correlated with its unique address. Alternatively, a new activity data file may be generated so that the activity of each device is indicated.

Mapping virtual internet protocol addresses

Performance metrics related to the processing and propagation of messages related to select applications are collected during a simulation of a network. Each message associated with an application is tagged, and each simulated packet that contains some or all of a tagged message is correspondingly tagged to facilitate the creation of transmit records and receive records. A post processor is configured to collate transmit and receive records of each tagged message to identify delays associated with each node that processes the message, and each link that propagates the message from node to node within the network. The processed timing information is provided to the user via an interactive user interface that allows the user to view the timing information from an application layer perspective.

Tracking, analyzing, and visualizing application delay

A method of identifying differences between activity data files includes determining a difference between the activity data files. Causal analysis may be performed to identify a cause of the difference. The difference and/or the cause of the difference may be rendered based on a rendering template. Tier pairs between the activity data files may be matched and a user may be queried to confirm the tier pair match. Statistical and/or protocol differences between each of the activity files may be presented. Transactions between each of the activity data files may be matched including comparing the content files in each of the activity data files that account for the transactions. Client side differences between each of the activity data files may be identified. A categorization may be assigned to each of the determined differences. Determined differences may be excluded from the rendering.

Identifying and reporting differences in network activity data files

Growing community of inventors

Washington, DC, United States of America

Patrick J Malloy