Riverbed Technology, Inc.

Opnet Technologies, Inc.

Russell Mark Elsner

Patrick J Malloy

Ryan Gehl

Alain J Cohen

Antoine D Dunn

Dana Znamova

Steven Niemczyk

Michael Canney

Eric S Nudelman

Marc A Cohen

John Wilson Strohm

Alex Chernyakov

Steve Niemczyk

Marc I Schneider

Eric Rogner

David Berman

Mark I Schneider

Laura Harrison

Abbas Haider Ali

Systems, methods, and computer program embodiments are disclosed for adaptively displaying application performance data. In an embodiment, a plurality of performance monitoring data sources may be identified based on an application model that defines the topological structure of a software application. A request may be received for performance data associated with the application. One or more content options may then be determined based on the received request, and each content option may include one or more target performance metrics. Each content option may also be associated with one or more data sources. For each content option, the associated data sources may be queried to identify available data sources containing relevant performance data. A content option may be selected from the determined content options based on a priority associated with the content option. The performance data corresponding to the selected content option may subsequently be retrieved and presented for display.

Displaying adaptive content in heterogeneous performance monitoring and troubleshooting environments

In a network that includes intermediary nodes, such as WAN accelerators, that transform messages between nodes, an end-to-end path of the messages is determined. The determined end-to-end path is used in subsequent analyses of message traces, to identify timing and other factors related to the performance of the network relative to the propagation of these messages, including the propagation of the transformed messages. A variety of techniques are presented for determining the path of the messages, depending upon the characteristics of the collected trace data. Upon determining the message path, the traces are synchronized in time and correlations between the connections along the path are determined, including causal relationships. In a preferred embodiment, a user identifies an application process between or among particular nodes of a network, and the system provides a variety of formats for viewing statistics related to the performance of the application on the network.

End-to-end analysis of transactions in networks with traffic-altering devices

A system and method for managing captured network traffic data is provided. The invention comprises a plurality of capture agents, each being configured to capture the network traffic associated with one or more applications. Each application is associated with one or more capture agents according to an application profile that is stored and maintained in a capture server. When analysis of an application's network traffic is required, the capture server contacts the corresponding capture agents according to the application profile. The capture server then effects the identification and archiving of the network traffic that corresponds to a user-defined capture condition. A database at the capture server maintains a record that associates the corresponding network traffic with the user-defined capture condition such that the corresponding network traffic can later be retrieved and analyzed using an analysis engine.

Managing captured network traffic data

The embodiments facilitate the analysis of application delays, including delays that occur on multiple paths. A trace file of an application's network events is processed to categorize the causes of delays incurred in the propagation and processing of these events. The system identifies the amount of delay that can be eliminated by eliminating each of the components of delay individually, as well as the amount of delay that can be eliminated by eliminating combinations of the delay components. A user interface displays the amount of reduction that can be achieved by eliminating various delays alone or in combination. The interface also allows the user to view the individual delay components contained in combinations of delay components. In this manner, the user is provided a view of each of the delay components that would need to be addressed, either individually or in combination, to improve the overall application delay.

Network delay analysis including parallel delay effects

In a network that includes intermediary nodes, such as WAN accelerators, that transform messages between nodes, an end-to-end path of the messages is determined. The determined end-to-end path is used in subsequent analysis of message traces, to identify timing and other factors related to the performance of the network relative to the propagation of these messages, including the propagation of the transformed messages. A variety of techniques are presented for determining the path of the messages, depending upon the characteristics of the collected trace data. Upon determining the message path, the traces are synchronized in time and correlations between the connections along the path are determined, including causal relationships. In a preferred embodiment, a user identifies an application process between or among particular nodes of a network, and the system provides a variety of formats for viewing statistics related to the performance of the application on the network.

End-to end analysis of transactions in networks with traffic-altering devices

Data representing application deployment attributes, network topology, and network performance attributes based on a reduced set of element attributes is utilized to simulate application deployment. The data may be received from a user directly, a program that models a network topology or application behavior, and a wizard that implies the data based on an interview process. The simulation may be based on application deployment attributes including application traffic pattern, application message sizes, network topology, and network performance attributes. The element attributes may be determined from a lookup table of element operating characteristics that may contain element maximum and minimum boundary operating values utilized to interpolate other operating conditions. Application response time may be derived using an iterative analysis based on multiple instances of one or more applications wherein a predetermined number of iterations is used or until a substantially steady state of network performance is achieved.

Network capacity planning

A multi-functional graphical user interface facilitates the analysis and assessment of application delays, including delays that occur on multiple paths. A trace file of an application's network events is processed to categorize the causes of delays incurred in the propagation and processing of these events. The system identifies the amount of delay ('component delay') that can be eliminated by eliminating each of the components of delay individually, as well as the amount of delay ('parallel delay') that can be eliminated by eliminating combinations of the delay components. A user interface displays the amount of reduction that can be achieved by eliminating each component delay individually and the amount of reduction that can be achieved by eliminating combinations of the individual component delays. To facilitate the analysis and assessment of these potential reductions, the interface allows the user to &#x2018;drill down&#x2019; to view the individual delay components contained in each combination forming the parallel delays. In this manner, the user is provided a view of each of the delay components that would need to be addressed, either individually or in combination, to improve the overall application delay.

Multiple parent-dependencies are identified for messages that are received on a network that includes nodes that are configured to avoid the conventional strictly-sequential communications techniques and protocols, in order to accelerate network performance. If a network is known, or assumed, to include intermediate/proxy nodes that are configured to provide acceleration, access control, and other services, the system that analyzes traffic on the network is configured to assume that these nodes may/will provide such features, and thereby introduce multiple dependencies among the messages communicated across the network. For each message transmitted from a forwarding node, messages received at the forwarding node are assessed to distinguish messages from the destination node and messages from an other node, and a dependency is defined for each.

Discovery of multiple-parent dependencies in network performance analysis

A graphic user interface facilitates the hierarchical analysis of timing parameters related to network-based applications. At the top level of the hierarchy, the user is presented a summary of the delays incurred while running an application, or while simulating the running of an application, organized by delay categories, including processing delays at each node, as well as propagation delays at each link between nodes. The interface enables a user to 'drill down' into lower levels of the timing information hierarchy by 'clicking' on currently displayed information. The information is presented in a form most appropriate to the level of analysis. The presentation forms include, for example, pie-charts, multi-variable timing diagrams (in both absolute and relative forms), data exchange charts, and so on, and 'zoom' capabilities are provided as appropriate to the particular display form.

Application delay analysis

Application messages are segregated into message paths, and the delays of the transmitted packets associated with each message path are independently analyzed to distinguish propagation, bandwidth, congestion, and protocol delays. To further distinguish the congestion delays, all of the paths of the application messages are assessed to identify delays induced by the application, including self-congestion delay, corresponding to pre-congestion delays caused by attempting to send data from a source device faster than the bandwidth of the channel allows, and cross-congestion delay, corresponding to post-congestion delays caused by varying delays beyond a bottleneck link in the channel. The remaining congestion delay is identified as network congestion delay, corresponding to delays caused by network devices other than the source device. After identifying each of the components of delay, the effect of each component on the overall delay is determined to identify where improvements can best be made.

Growing community of inventors

Bethesda, MD, United States of America

Russell Mark Elsner