Network General Technology

Venkatesh Ramachandran Iyer

Shilpa Pradeep Bansod

Sanjeevan P Raghavendran

Jeffrey Y Sternin

Michael Richard Valladao

In one embodiment, a network architecture includes a plurality of application monitoring modules for monitoring network traffic data in a plurality of network segments. Network monitoring modules include a staging area that receives network traffic data from a packet capture and analysis engine and an indexing area that stores the data in meta-flow tuples with associated measures divided into time interval buckets. Index tables store dimension-based sorted pointers to the storage locations in the data buckets. HyperLock queries collect time aggregated results for measure based operators with respect to a queried dimension. For each value of the queried dimension, the time interval buckets are traversed compiling a partial result that is finally stored in a stack as the time aggregated value. The stored sorted pointers are used to determine the starting location in each bucket with respect to the next value of the queried dimension.

HyperLock technique for high-speed network data monitoring

According to one embodiment, a network architecture includes a plurality of application monitoring modules for monitoring network traffic data that store the data in meta-flow tuples with associated measures. The meta-flow tuples include a protocol dimension with a value corresponding to a leaf node in a protocol identifier array. The protocol identifier array represents a protocol tree structure based on a set of nodes with pointers to parent, sibling, and child nodes corresponding to the protocol tree. The pointers include protocol identifier values that correspond to memory offset values with respect to the array. For queried protocol dimensions, the protocol identifier array is used to traverse the protocol tree from the leaf node in the meta-flow to a matching node matching the queried protocol. If the queried protocol is found in the protocol lineage of the meta-flow, the measures for the meta-flow are used to satisfy the query.

Minimalist data collection for high-speed network data monitoring based on protocol trees

A system, method and computer program product are provided for calculating application verb response times. Initially, packet data is received after which the packet data is aggregated into either an existent flow, or a new flow. In use, information is collected relating to verbs associated with the flow(s). Such information relating to the verbs is then stored so that it can be used to calculate response times associated therewith.

Growing community of inventors

Cupertino, CA, United States of America

Venkatesh Ramachandran Iyer