Virtual Instruments Worldwide, Inc.

Xangati, Inc

Virtual Instruments Corporation

Other

Rosanna Lee

Rangaswamy Jagannathan

Derek Sanders

Xiaohong Pan

Kishor Kakatkar

Vishal Neema

Jing Liu

Nicholas York

Ryan E Perkowski

Hong Zhu

Sureshbabu Murugesan

Roy Nakashima

David Messina

Darek Sanders

Jing Lui

Rangaswamy Jaganathan

An example method comprises receiving flow packets from network traffic analyzing platforms, for each particular flow packet: identify the particular flow packet as belonging to one of at least two flow packet types based on a format, if the particular flow packet is sFlow, determine if the particular flow packet is an sFlow sample, counter record, or a third packet type, if the particular flow packet is the sFlow sample or counter record, identify a flow source of the particular flow packet and at least one metric, and update a flow source data structure else ignore the particular flow packet, and if the particular flow packet is a second flow packet type: if the particular flow packet is of a format that matches a template, identify the flow source, and update the flow source data structure to include the identified flow source and the at least one metric.

System and method of flow source discovery

A method comprising: receiving network traffic data from a network traffic monitoring platform, the network traffic data identifying communication between entities of an enterprise network and storage monitoring data from a server-based SAN monitoring platform, the storage monitoring data identifying communication between a software-only server-based SAN and entities of the enterprise network, parsing the received traffic data and storage monitoring data to identify object data and/or metric data, creating a metric table entry from metric data, creating an object table entry from object data linking metric table entries with object table entries, creating a link table entry from the linking of metric table entries with object table entries, for each link table entry, assigning an object performance threshold, comparing each metric table entries to the assigned object performance threshold, if an alarm trigger condition is satisfied based on the comparison, then triggering an alarm event and outputting an alarm notification.

System and method of cross-silo discovery and mapping of storage, hypervisors and other network objects

A monitoring device responds to status data to detect storms, analysis, and to attempt to remediate those storms. The monitoring device several types of storms, for each of which it has a technique for analysis of the storm. The monitoring device can determine if the storm is due to resource contention, excess or unbalanced performance activity, or network degradation. Once analyzed, the monitoring device analyzes the storm, and attempts to remediate the cause of the storm.

Storm detection, analysis, remediation, and other network behavior

A monitoring device responds to status data pushed from a network device, and also manages a link with another network device, the link allowing the monitoring device to pull status data from the second network device. The monitoring device receives packets including status, the data indicating activity for one or more clock ticks. The monitoring device can compute statistical measures, rather than the network device. The monitoring device maintains the status data in a buffer. The monitoring device lags actual activity, but has is more likely to capture delayed packets. The network device sends packets as wrappers, each wrapper indicating sets of status information. When the information in a wrapper crosses a clock tick boundary, the monitoring device allocates reported activity among clock ticks, assuming that activity follows a uniform distribution.

Cross silo time stitching

Push pull data collection

For example, as indicated in the Incorporated Disclosures, rapid change from relatively little use of network bandwidth, to heavy overuse of network bandwidth (combined with a large number of endpoints attempting to access that network bandwidth) can often indicate an email virus or other maladjusted use of the system. In such cases, it could be appropriate to generate an alert, and bring the change to the attention of a human expert, or otherwise escalate the problem. In this Application, the phrase 'best practices,' and variants thereof, can generally refer to business preferences (and to business rules imposed by management, or law or regulation), such as high utilization preferences often expressed by management. In such cases, one or more operators can enter descriptors of rules the system that it is desired the system follow, such as 'processor cycle utilization &#x3e;90%.' When these best practices are not followed, it could be appropriate to generate an alert, bring the change to the attention of a human expert, or otherwise escalate the problem. In this Application, the phrase &#x201c;profiling and alerting,&#x201d; and variants thereof, can generally refer to maintaining a profile of how the system normally behaves, absent stressors, and to identify any substantial changes from that profile. When a profile is seriously violated, it could be appropriate to generate an alert, bring the change to the attention of a human expert, or otherwise escalate the problem. In such cases, it can be appropriate to escalate the severity of the alert with increased severity of violation, increased time duration of the violation, and increased trajectory in the direction of further violation. In this Application, the phrase &#x201c;absolute capacity,&#x201d; and variants thereof, can refer to an objective measure of system capacity, such as whether the system has 1 TB or 4 TB of memory. The phrase &#x201c;relative capacity,&#x201d; and variants thereof, can refer to a subjective measure of system capacity, such as when the system has 4 TB of physical memory, but 3.5 TB of that memory are allocated to a high-priority task whose interruption or pause would be untoward.

Self-learning and best-practice profiling and alerting with relative and absolute capacity

Network monitoring views can be recorded, replayed and shared. A monitoring system receives monitoring data, in response to which a monitoring view can be constructed. The monitoring data is maintained in memory or mass storage. One or more monitoring views can later be constructed in response to user preferences, even if those users would not have known to select those particular preferences or construct those particular monitoring views at the time. The monitoring views constructed in response to that monitoring data can be presented to users in a simulation of the problem, as if it were occurring at that time. Users can send particular monitoring views to others, with both the effects that the monitoring view can be preserved as part of a trouble report, and the persons receiving the monitoring view can have useful insight into what problem the user has pointed to.

Recording, replay, and sharing of live network monitoring views

A network monitoring device responds to network status data (whether 'pushed' from the network device or 'pulled' from the network device) to maintain a buffer of saved status data. The network status data is reordered, manipulated, and presented to users of the network monitoring device in order. The monitoring device can provide a status report of the network environment. When network status data is delayed too long, the monitoring device can discard the network status data, or reduce its weighted consideration. The monitoring device attempts to balance accuracy and latency by adjusting wait time for network status data. The monitoring device maintains a record of the amount of network status data it receives and processes from each network device and each network device's ability to provide accurate and complete information to operators and users in a distributed network monitoring environment.

Enhanced flow processing

One network monitoring system maintains both information regarding historical activity and emergent activity of the network. Comparison of recent activity of the network with historical activity allows the system to determine whether recent network activity is within the realm of normal. The system maintains data structures representing a p.d.f. for observable values of network parameters. Such data structures are maintained both for historical and for emergent activity of the network. Recent activity can be compared with the p.d.f. for historical activity to aid in determining whether that recent activity is within the realm of normal. Network activity not within the realm of normal can include values of observable network parameters too high or too low to be consistent with historical activity of the network, or other values too unlikely to be consistent with historical activity at the network. Another network monitoring device includes data structures for maintaining information regarding historical activity of a network and emergent activity of a network. Those data structures include multiple types of observable values as well as multiple types of combinations of multiple observable values. The network monitoring device maintains those data structures including information regarding historical activity of a network and emergent activity of a network only for those source/destination pairs, and only for those nodes, for which maintaining that information would be substantially meaningful. Yet another network monitoring system includes data structures for maintaining information regarding historical activity of a network and emergent activity of a network. Those data structures include observable values for multiple profile dimensions, including source/destination address, application, location, and time. The data structures also include observable values for combinations of more than one of those multiple profile dimensions, including, e.g., (source address)&#xd7;(application), and the like. It is expected that only a relatively sparse set of combinations of more than one of those multiple profile dimensions would have meaningful information associated therewith. The network monitoring system maintains those data structures only for those combinations of more than one of those multiple profile dimensions for which maintaining that information would be substantially meaningful.

Symptom detection using behavior probability density, network monitoring of multiple observation value types, and network monitoring using orthogonal profiling dimensions

For example, as indicated in the Incorporated Disclosures, rapid change from relatively little use of network bandwidth, to heavy overuse of network bandwidth (combined with a large number of endpoints attempting to access that network bandwidth) can often indicate an email virus or other maladjusted use of the system. In such cases, it could be appropriate to generate an alert, and bring the change to the attention of a human expert, or otherwise escalate the problem. Best practices In this Application, the phrase 'best practices,' and variants thereof, can generally refer to business preferences (and to business rules imposed by management, or law or regulation), such as high utilization preferences often expressed by management. In such cases, one or more operators can enter descriptors of rules the system that it is desired the system follow, such as 'processor cycle utilization &#x3e;90%.' When these best practices are not followed, it could be appropriate to generate an alert, bring the change to the attention of a human expert, or otherwise escalate the problem. Profiling and alerting In this Application, the phrase &#x201c;profiling and alerting,&#x201d; and variants thereof, can generally refer to maintaining a profile of how the system normally behaves, absent stressors, and to identify any substantial changes from that profile. When a profile is seriously violated, it could be appropriate to generate an alert, bring the change to the attention of a human expert, or otherwise escalate the problem. In such cases, it can be appropriate to escalate the severity of the alert with increased severity of violation, increased time duration of the violation, and increased trajectory in the direction of further violation. Relative and absolute capaci-ty In this Application, the phrase &#x201c;absolute capacity,&#x201d; and variants thereof, can refer to an objective measure of system capacity, such as whether the system has 1 TB or 4 TB of memory. The phrase &#x201c;relative capacity,&#x201d; and variants thereof, can refer to a subjective measure of system capacity, such as when the system has 4 TB of physical memory, but 3.5 TB of that memory are allocated to a high-priority task whose interruption or pause would be untoward.

Growing community of inventors

Palo Alto, CA, United States of America

Rosanna Lee