Foundry Networks, Inc.

Xangati, Inc

Virtual Instruments Worldwide, Inc.

Other

Virtual Instruments Corporation

Xiaohong Pan

Rosanna Lee

Rangaswamy Jagannathan

Derek Sanders

Kishor Kakatkar

Nicholas York

Vishal Neema

Jing Liu

David B Cheung

Hong Zhu

An example method comprises receiving flow packets from network traffic analyzing platforms, for each particular flow packet: identify the particular flow packet as belonging to one of at least two flow packet types based on a format, if the particular flow packet is sFlow, determine if the particular flow packet is an sFlow sample, counter record, or a third packet type, if the particular flow packet is the sFlow sample or counter record, identify a flow source of the particular flow packet and at least one metric, and update a flow source data structure else ignore the particular flow packet, and if the particular flow packet is a second flow packet type: if the particular flow packet is of a format that matches a template, identify the flow source, and update the flow source data structure to include the identified flow source and the at least one metric.

System and method of flow source discovery

One network monitoring system maintains both information regarding historical activity and emergent activity of the network. Comparison of recent activity of the network with historical activity allows the system to determine whether recent network activity is within the realm of normal. The system maintains data structures representing a p.d.f. for observable values of network parameters. Such data structures are maintained both for historical and for emergent activity of the network. Recent activity can be compared with the p.d.f. for historical activity to aid in determining whether that recent activity is within the realm of normal. Network activity not within the realm of normal can include values of observable network parameters too high or too low to be consistent with historical activity of the network, or other values too unlikely to be consistent with historical activity at the network. Another network monitoring device includes data structures for maintaining information regarding historical activity of a network and emergent activity of a network. Those data structures include multiple types of observable values as well as multiple types of combinations of multiple observable values. The network monitoring device maintains those data structures including information regarding historical activity of a network and emergent activity of a network only for those source/destination pairs, and only for those nodes, for which maintaining that information would be substantially meaningful. Yet another network monitoring system includes data structures for maintaining information regarding historical activity of a network and emergent activity of a network. Those data structures include observable values for multiple profile dimensions, including source/destination address, application, location, and time. The data structures also include observable values for combinations of more than one of those multiple profile dimensions, including, e.g., (source address)&#xd7;(application), and the like. It is expected that only a relatively sparse set of combinations of more than one of those multiple profile dimensions would have meaningful information associated therewith. The network monitoring system maintains those data structures only for those combinations of more than one of those multiple profile dimensions for which maintaining that information would be substantially meaningful.

Symptom detection using behavior probability density, network monitoring of multiple observation value types, and network monitoring using orthogonal profiling dimensions

One network monitoring system maintains information regarding historical activity and emergent activity of the network. Comparison of recent with historical activity allows the system to determine whether recent activity is within the realm of normal. The system maintains data structures representing a p.d.f. for observable values of network parameters. Another network monitoring device includes data structures for maintaining information regarding historical and emergent activity of a network. This network monitoring device maintains those data structures including information regarding historical and emergent activity of a network only for those source/destination pairs, and only for those nodes, for which maintaining that information would be substantially meaningful. Yet another network monitoring system includes data structures for maintaining information regarding historical and emergent activity of a network that maintains those data structures only for those combinations of more than one of those multiple profile dimensions for which maintaining that information would be substantially meaningful.

A network monitoring device includes a flow processing element, disposed to receive flow information relating to network flows, and to generate a set of virtual packets, each representing a portion of a network flow. The virtual packets are maintained in a time-sequential order, and read by elements of the network monitoring device to generate information relating to network traffic, such as symptoms affecting the communication network, problems affecting the communication network, and otherwise. The network monitoring device randomly samples virtual packets, with at least one of two effects: (1) flow information from traffic reporting devices that are themselves sampling a differing rates can be equalized, with the effect of standardizing information from all of them; (2) the network monitoring device itself can restrict its attention to a fraction of all virtual packets, with the effect of keeping up with a relatively large number of virtual packets.

Network monitoring using virtual packets

A network monitoring device includes a data structure for maintaining information about endpoints involved in network flows. Each endpoint, either a source or a destination for a network flow, has information maintained in a modified binary trie, having a branch for each bit of the source or destination address, but with interior nodes having only a single child node elided. A pruning thread is given a limited amount of time for operation, with the effect that the data structure is maintained available for use except for only that limited amount of time. In the event that the pruning thread is unable to prune the entire data structure, it maintains a marker indicating where last it left off, and returns to that location in the data structure at a later pruning operation.

Network monitoring using bounded memory data structures

A network monitoring system maintains both information regarding historical activity of a network, and information regarding emergent activity of the network. Comparison of historical activity of the network with emergent activity of the network allows the system to determine whether network activity is changing over time. The network monitoring system maintains data structures representing a p.d.f. for observable values of network parameters. Recent activity of the network can be compared with both the p.d.f. for historical activity and for emergent activity to aid in determining whether that recent activity is within the realm of normal, and whether network activity is changing over time. The network monitoring system adjusts that information regarding historical activity of a network in response to emergent activity of that network. The network monitoring device determines information regarding time-dependent activity of that network in response to spectral analysis regarding historical activity of that network.

Network monitoring of behavior probability density

A virtual router spans a number of physical routing devices. A set of physical ports on one of the physical routing devices is logically represented as a trunk. A respective port priority value is associated with each of those ports, and a device priority value is associated with the physical routing device. If a port in the trunk is out-of-service, then the device priority value can be adjusted by the port priority value associated with the out-of-service port. A corrective action can be implemented if the device priority value fails to satisfy a condition. For example, the physical routing device may failover to another one of the physical routing devices spanned by the virtual router.

Virtual router with a priority value per port

A network monitoring device includes a flow processing element, disposed to receive flow information relating to network flows, and to generate a set of virtual packets, each representing a portion of a network flow. The virtual packets are maintained in a time-sequential order, and read by elements of the network monitoring device to generate information relating to network traffic, such as symptoms affecting the communication network, problems affecting the communication network, and otherwise. The network monitoring device randomly samples virtual packets, with at least one of two effects: (1) flow information from traffic reporting devices that are themselves sampling at differing rates can be equalized, with the effect of standardizing information from all of them; (2) the network monitoring device itself can restrict its attention to a fraction of all virtual packets, with the effect of keeping up with a relatively large number of virtual packets.

A virtual router spans a number of physical routing devices. One of the physical routing devices is designated as master, and the other physical routing devices are designated as backups to the master. A failover protocol that includes both a non-dampened state and a dampened state can be implemented. According to the failover protocol, an attempt to designate one of the backups as master in place of the current master is permitted while the virtual router is in the non-dampened state, while such an attempt is suppressed while the virtual router is in the dampened state.

Virtual router failover dampening

A network monitoring system includes devices receiving network traffic information, and generating at least partial results relating to network symptoms. Those partial results are forwarded to devices processing those partial results and generating information relating to problems in response to those symptoms. Problems are reported to users or sent as notifications. In one embodiment, information relating to network traffic is monitored both by a first set of devices associated with source addresses for that network traffic and a second set of devices associated with destination addresses for that network traffic. Information received by that first set of devices includes information relating to both the source address and destination address of network traffic. That first set of devices processes information relating to the source address of network traffic and forwards information relating to the destination address of network traffic to that second set of devices.

Parallel distributed network monitoring

A virtual router spans a number of physical routing devices. One of the physical routing devices is designated as master, and the other physical routing devices are designated as backups to the master. The virtual router may be situated between a first local area network and a second local area network. A virtual router identifier can be associated with multiple interfaces on each of the physical routing devices.

Growing community of inventors

Fremont, CA, United States of America

Xiaohong Pan