• 专利附录
  • 专利说明
  • 权利要求
  • 类似技术
  • 同族专利
  • 引用文献
  • 法律状态
  • 优先权
    • 专利摘要:
    A method of monitoring data on a first communication line. Data is received from the first communication line (402) and a plurality of packets (406) are extracted (416) from the data. Statistics are then recursively generated (408), the statistics corresponding to the plurality of packets.
    公开号:SE534943C2
    申请号:SE0501119
    申请日:2005-05-19
    公开日:2012-02-28
    发明作者:Parag Pruthi；Andrew Heybey；Varugis Kurien Thekkthalackal
    申请人:Niksun Inc；
    IPC主号:
    专利说明:

    534 943 2 communication among companies, individuals and other users of such networks.
    This need to send and receive data over such networks generates so-called "traffic", ie a volume or "load" of digitally coded information, which travels over suitable paths in the network. Unfortunately, traffic over the network often leads to congestion or "problem points" at certain points or along certain roads in the network. Such aggregation may take the form of annoying slow data transmission or, in the worst case, complete inability to send or receive the required information over such networks. This problem is accentuated by the fact that traffic in some network architectures generally only continues as fast as the slowest link or road allows.
    Such traffic congestion is of course not desirable for a number of different reasons. Users who are “stuck” in such traffic can blame the congestion on their network service providers, which can cause such providers to possibly lose business. Such network delays will also have a negative effect, both directly and indirectly, on the productivity of network users.
    An attempt to remedy such network accumulation or other "problem points" in networks is to obtain reliable information in a timely manner regarding the accumulation or problem point. Previously known attempts to sort out the intricacies of computer networks and remedy the congestion are unfortunately associated with various disadvantages. Known network monitoring tools can, for example, be difficult to adapt and may thus lack the necessary tools to analyze network congestion or problem points.
    Such "network snoopers" are often limited to "dumping" traffic according to certain special protocols, which in turn may lack the ability to reliably describe or point out the reason for the network cluster. In other words, most known network monitors and "snoopers" have limited ability. to tabulate real-time data or record data over long periods of time.
    Well-known network monitors usually gain access to the network to evaluate or evaluate the Reference “TCP / IP Illustrated, Volume I - The Protocols”, Chapters 7 and 8, available from Addison-Wesley Publishing Co., 1994, and requesting - writes such a technique. To estimate tour times network performance. for “information packets” on the Internet, the network monitor submits additional packets to the network and follows their journey. The process of determining network performance thus in itself further degrades performance by adding additional information packets to the traffic.
    The method described above is not only based on access to the network, generally inaccurate. In particular, one-way times are evaluated, but it is also by usually dividing the test package's round trip delay by two; however, half of a round trip time is generally not equivalent to a one-way delay, which is partly based on asymmetries in the network (discussed below).
    To compensate for this inaccuracy, test packets are delivered more frequently to the network according to certain known procedures, but this is a solution that may further degrade the performance of the network being tested or monitored.
    Network performance can be further improved if more network traffic flow or network bandwidth dimensioning could be modulated more reliably. More specifically, traffic does not necessarily flow symmetrically over a given network path. This is especially true when the path ends at an end user over an Internet connection. Such a road is asymmetrical, as the end user usually loads more cargo or traffic than he or she loads. Known network monitors usually do not detect or modulate such asymmetries, with the result that greater network resources are allocated to certain paths than would otherwise be required. This costs extra money and wastes computer resources.
    There is thus a need to improve network performance and remedy the accumulation of network traffic.
    There is also a need for tools, access to the flow of traffic, analysis of different traffic parameters or types of "packages" that do not prepare that can be adapted to and that collects and tabulates required statistics quickly and reliably.
    Through the increasing use of data networks, companies and individuals are increasingly interested in collecting, filtering or "profiling" data regarding the users or the traffic from these on such networks.
    Advertising companies or other sales organizations can be particularly fascinated by demographic or other data, which can be gathered through reliable registration and analysis of network traffic. Unfortunately, many Internet advertisers obtain customer profiles by requiring users to fill out forms and forms. Advertisers miss out on most of this customer information, as customers often do not want to bother answering such questions. There is thus a need to obtain "customer profiles" in a less intrusive way.
    The increased use of networks has similarly increased the possibilities for “hackers” or other harmful intruders, who carry out racketeering or even criminal activities in private or protected networks.
    A system that can determine the origin of security breaches would, as such, be valuable to law enforcement agencies, such as the FBI, in stopping the flow of computer-related crimes and offenders. Prior art generally again fails to analyze, tabulate, monitor or record the flow of data over a network in an optimal way to facilitate security activities. Companies or individuals involved in network monitoring not only need to receive large amounts of 534 943 of information and statistics in a timely manner, but they also need to be able to view such data quickly, easily and in a comprehensible format. Known solutions are again often limited to providing “dumps”, often chronological, with deficient statistical compilations or graphical representations of such data. It is therefore not only desirable to compile information regarding network traffic but also to perform certain frequently requested calculations and graphically represent such calculations in a user-friendly and flexible format.
    A new method for monitoring a communication line is proposed to address the shortcomings of conventional methods and systems for monitoring data communication. An object of the present invention is to provide a network monitor for collecting and analyzing communication data. Another object is to provide a method for collecting and analyzing communication data.
    SUMMARY OF THE INVENTION In order to achieve these and other objects, and in view of its objects, the present invention provides a method for monitoring data on a first communication line. Data is received from the first communication line, and a number of packets are extracted from this data. Thereafter, statistics are generated in a recursive manner, where the statistics correspond to the said plurality of packages.
    It should be emphasized that both the above general description and the following detailed description only exemplify the invention without limiting it.
    Brief description of the drawings The invention is best understood from the following detailed description, when read in conjunction with the accompanying drawings. It should be emphasized that the various elements in the drawings are not to scale, in accordance with standard practice. On the contrary, the dimensions of the various elements have been expanded or reduced arbitrarily for reasons of clarity. The following figures are included in the drawings: Fig. 1 shows a network monitor according to the present invention, connected to a communication line; Fig. 2 illustrates an example of a protocol hierarchy; Fig. 3 is a block diagram of an exemplary network monitor according to the present invention; Fig. 4 is a flow chart illustrating an exemplary method of monitoring a communication line according to the present invention; Fig. 5 is a data flow chart illustrating the many permutations of the data acquisition and analysis methods of a network monitor according to the present invention; Fig. 6 is a flowchart illustrating a method for identifying server computers in trouble; Fig. 7 shows a network utilizing network monitors according to the present invention, connected to two separate communication lines in a network; Fig. 8 is a flow chart illustrating a method for determining transmission delay; Fig. 9A is a flowchart illustrating the operation of a host computer for synchronization with an interface computer; Fig. 9B is a flow chart illustrating the operation of an interface computer for synchronization with a host computer; and Figs. 10-28 are screenshots, user interfaces for receiving monitoring parameters which illustrate one meter and which illustrate methods for presenting and providing information regarding communication analysis.
    Detailed Description of the Invention Referring to the drawings, in which like reference numerals generally refer to like elements, Fig. 1 illustrates an exemplary network monitor 534 943 7 102 according to the present invention, which is connected to an exemplary network N1106 via a first communication line 104. The network monitor 102 takes receives (monitors) data communication (traffic) on communication line 104 and provides real-time measurements or statistics for data traffic on communication line 104.
    The communication line 104 may use a simple data link layer protocol to transport traffic or a plurality of different layer protocols at a higher hierarchical level. Such a hierarchical protocol structure 200 is illustrated in Fig. 2. The link layer protocol 202, "Ethernet" in this exemplary case, for traffic between the network N1 106 and the router 108 may include encapsulated IPX, IP, ARP traffic or other traffic in the network layer 204. IP ICMP traffic or other traffic in the transport layer 206. TCP traffic FTP, traffic or other traffic in the application layer 208. the traffic may include encapsulated UDP, TCP, may include encapsulated web, domain name service- The network monitor 102 according to the present invention finning includes hardware and software (discussed below), which collects and analyzes network traffic in such a way that the network monitor can generate various real-time statistics for such traffic regarding one or more protocol layers. generated real-time statistics provide the ability to analyze the service quality and quantity of the network monitor 102, charge based on service quality and quantity, allocate and plan dynamic network resources, customer profiling based on data content, analysis of network security and session playback. Examples of statistics include byte counters, bit counters, one-way or round trip delays, response times, retransmitted bytes, incoming bytes per host, closing bytes per host, counters for emerging-closing host pairs, web interrupt rate, throughput, " goodput ”and the proportion of retransmissions due to delays or losses.These statistics can be provided selectively on the basis of traffic on the first communication line 104 over one or more protocol layers between the link layer and the application layer.
    The operation of an exemplary network monitor 302 shown in Figure 3 is described with reference to the flow chart of Figure 4. The network monitor 302 includes a first network interface 304, which is connected to a first communication line 308 via a first connection 312, and a second network interface 306. , which is connected to a second communication line 310 via a second connection 314. first data The first interface 304 receives (one bitstream) from the first communication line 308 (step 402), after which the bitstream is divided into packets (step 404 ). to mean that previously defined packets are extracted from bit- The term division is used here for the stream. The bitstream can be divided into packets by either the interface 304 or the host computer 316. a memory 318, The packets are stored in which are hierarchical in this embodiment and include a short-term memory 320 and at least one long-term memory 322. A processor and interrogator 316, which may optionally be controlled by a user interface 324, then processes the packets, as described below with reference to Fig. 4.
    In an exemplary embodiment, the network monitor 302 is connected to the first communication line 308 in a non-intrusive manner. The network monitor thus does not directly obstruct the traffic flow on the communication line. The network monitor 302 can be connected to the communication line 308 by, for example, connecting the first connection 312 to a port or socket on a switch or router, by disconnecting the communication line 308 and installing a Y-connector to which the first connection 312 is connected. by connecting the first connection to a network hub, by means of an optical splitter, or by connecting the network monitor 302 to a monitoring socket in a central office. 534 943 9 A processing and query machine 316 converts the packets into records and stores them in memory (steps 414-422).
    The processing and querying machine 316 includes appropriate programming to generate statistics corresponding to the package (steps 406-412). Although the generation of statistics for the packets can be achieved in many different ways, according to a preferred approach, a set of packets, received during a predetermined time interval or a sampling time (step 406), is processed to generate corresponding statistics (step 408). Processing is then repeated recursively for subsequent packet sets, which are received during subsequent time periods (step 410). In such processing, appropriate programming stores the generated statistics in memory at appropriate time intervals, where such intervals are preferably of the same order of magnitude as the time intervals corresponding to the packet sets.
    The conversion of packages into items enables the generation of a wide range of additional statistics, which will now be described. The records are generated by first (414) and then filtering the packets (step 416) based on their established types. An index is generated (step 418) then the packets are converted to an indexed record (step 420) and stored in memory (step 422). Additional statistics are then generated to determine the type of each packet for each packet, and (step 426) using statistics previously generated for the packets, after which the records are delivered to one or more applications such as a display device (428), a router for dynamically adjust network routing based on the additional statistics (step 430) and a billing service to charge clients based on service quality or service quantity, as determined on the basis of the generated statistics (step 432).
    An application of the process shown in Fig. 4 will now be described for an Ethernet communication line, including encapsulated IP packets, which encapsulate TCP packets, 534 943 which encapsulate web traffic (see Fig. 2).
    The Ethernet bitstream is received from the communication line (step 402) and divided into packets (step 404). The packets are divided into sets, each set containing packets received during one of a number of consecutive time periods of 1 s time periods) during each is calculated (exemplifying (step 406). The number of bits received time period of 1 s ( exemplary statistics) (Step 408) Successive statistics are generated for consecutive time periods by receiving the next packet set, corresponding to the next time period of 1 s (step 412), and then calculating the number of bits in these packets (step 408). time intervals if ls are stored in memory (step 412), when generated.
    One type of packet (steps (eg IP, ARP, m) is determined for each 414). If a user only wants to analyze the traffic of IP packets, the packets are filtered so that only IP packets pass (416). The time when the network monitor received each IP packet is used as an index for each respective IP packet (418). Then, an indexed entry for each IP packet is generated (step 420) and stored in memory (step 422). first field is illustrated An exemplary entry with index as an F1 and the packet as a second field F2 below. íFl: Index (reception time) íf2: (packet or part of packet)) In addition to the filtering (step 416), which only passes IP packets, the filter can also be used to let only part of a packet, for example only IP packets the part, by cutting off the part for Ethernet administration, in the second a plurality of IP packet, address, and or more, the entry above only containing the IP part field F2. Alternatively, the record may contain fields, for example a source address or destination - each of which corresponds to a part of filtering can be conducted on the basis of one of said plurality of fields. 534 943 ll Any form of statistics can be generated from the stored records alone or in combination with statistics for the packets, which are generated in steps 406-412. An additional statistic known in the art includes in this example the relationship between the number of bits in received IP packets and the number of bits in all packets received for each subsequent minute (step 426). The calculation of these statistics is facilitated according to the present invention, since the stored packets are all already IP packets and are indexed at the time of receipt. The calculation as such is performed by sorting the records by index, reading the set of records for each subsequent minute and adding the number of bits in each record set. The number of bits in all packets per minute can be calculated by summing the previously calculated bit counters, generated per second, in groups of 60 (which is equivalent to 1 min). The additional statistics are thus generated using both stored records and stored statistics, which reduces the number of additional calculations required and the time to generate such additional statistics.
    A specific example of the filtering and storage methods performed by a network monitor according to the present invention was described above with reference to Fig. 4. The flexibility in data collection and analysis methods of a network monitor 500 according to the present invention is described below with reference to to the data flow chart of Fig. 5.
    An incoming bitstream is packaged by a packer 502. Decoding of the bitstream can be performed automatically for known protocols or can be performed according to user-specified parameters for custom or private protocols. For example, if a new link layer protocol is introduced, the network monitor 500 includes appropriate programming to respond to user-defined protocols, which are entered using the user interface 520. The network monitor 500 according to the invention thus recognizes packet structures according to the new protocol. to package an incoming bitstream. The network monitor can then perform its data collection and analysis methods through the higher protocol layers. This flexibility is not limited to the link layer. In other words, the network monitor 500 of the present invention can collect and analyze data communications for custom protocols at other protocol layers.
    The packets can be stored directly in the short-term memory 510 by means of path A. This is useful for storing all the data, the time memory 508 can periodically transfer data to a long-term memory 510 to prevent overfilling. Although the present invention is illustrated only by a single short-term memory 508 and a single long-term memory 510 received from the communication line. Briefly, the teachings of the invention are applied to other hierarchical memory structures, which include a plurality of memory devices. The memory may include, for example, a read and write memory (RAM), a disk memory, and a tape memory. When the RAM is full, data is transferred to the disk memory. When the disk memory is full, data is transferred to the tape memory. When the tape memory is filled, tapes are replaced for continuous or long-term data storage for, for example, archive purposes.
    As indicated by a double arrow at the short-term memory 508 510, data stored in the memories can later be retrieved for analysis or for any of the applications 522-530 discussed below. and between memories 508, It may be desirable to store all packets directly in memory for security applications 528. For example, the network monitor may be programmed to store all communications for a period of one week and then overwrite the oldest stored data. If a security breach is detected within one week of its occurrence, stored data may be analyzed by the network monitor to determine the origin and extent of the security breach.
    Packaged data can alternatively be delivered by the packeter 502 to an index creator 504. The index creator 504 534 943 13 generates an index corresponding to one or more received packets. Examples of an index corresponding to a packet include a timestamp to indicate the time the packet was received by the network monitor, the type of packets (protocol and / or layer), the size of the packet, a packet number (1, 2, 3,), a interface number, an application and an associated session. A record creator 506 receives the packet and generated index and creates a record containing the generated index. Alternatively, the mail creator 506 may combine the received packet and received index with an existing record, 510. directly via path C and generate an unindexed record containing the packet, or the mail creator may combine the packet into an existing record, 508, 510.
    An individual entry can, for example, be created corresponding to an ATM session. previously stored in memory 508, The record creator can also receive a packet previously stored in memory When a first cell (a fixed size packet) corresponding to the ATM session is received, it can be indexed, whereby an indexed record can be generated and stored in memory 508, 510. re for the ATM session, for example. When additional cells corresponding to the ATM session are received, Index can be an identifier- not necessarily in order, mail creator 506 can directly receive these cells via path C, read the previously stored and indexed 510, recently received cell with the indexed record.
    In addition to simply combining packets belonging to a common ATM session in a common record, the mail creator can record the record from memory 508, and then combine it 506 also the received ATM cells within the record in the correct order.
    A record / packet type identifier 512 receives packets or records from either the record creator 506 or the memory 508 and then classifies the received records or packets by identifying their corresponding "type" or "property". The type or property of a packet or record is a versatile identifier and can be programmed via the user interface 520. Examples of types or properties of packets or records include the number of bits or bytes, its protocol layer, its protocol type at a particular protocol layer, a source address, a destination address, an end - user identity and an application identity. The records or packets are then filtered in a packet type filter 516 based on the property or type, packet identifier 512. identified by record / - The filtered records or packets are then indexed and converted to records, or stored directly in memory 508, 510.
    A time period filter 514 receives records or packets from the recorder or memory 508, 510 and filters them based on the time they were received from the communication line by the network monitor. The records or packets are then divided into groups corresponding to packets received by the network monitor during successive time periods. A statistics creator 518 then generates statistics for each of the consecutive time periods, corresponding to packets received during each respective subsequent time period.
    The filtered packages and the generated statistics can be stored in memory. The paths between the functional blocks in Fig. 5 illustrate that the contents of the memory can then be used again to perform further filtering or generation of statistics. Thus, a network monitor according to the present invention can recursively collect and analyze data by generating statistics based on previously generated statistics or stored packets.
    In addition to programming the network monitor for a custom protocol in the manner described above, the user interface 520 can also define the operating parameters of the function blocks within the network monitor. For example, a user may specify the index to be used by the index creator 504, the time period to be used by the time period filter 514, and the statistics to be generated by the statistics creator 518 for each of the consecutive time periods.
    The collected data and the corresponding analysis, performed by the network monitor 500, can be delivered to one or more applications 522-530. For example, a display device 522 may present statistics, records or packets depending on user selection, which are further described below with reference to the screens in Figs. 10-28.
    The statistics generated by the network monitor 500 can be delivered to a network administrator or router 524 to allow dynamic communication path selection and network bandwidth management, also known as "yield management", for a network depending on the corresponding network performance statistics. It will be readily appreciated that a network monitor of the present invention, by measuring one-way delays and providing traffic statistics protocol by protocol at different protocol layers, can identify these asymmetries by quantifying traffic flows to enable a network administrator to properly dimension network resources according to measured flows.
    Communication networks can be optimized at the service layer, since the network monitor of the present invention includes appropriate programming to analyze traffic flows at each protocol layer. Although different services may have different service requirements, these services are usually integrated into a single communication network. Nevertheless, services such as real-time multimedia, IP-mediated speech, data and intranet can each have unique requirements for network service. With regard to IP-mediated speech, for example, a lower quality of service comprising data delays or data losses cannot be tolerated due to low tolerances for degradation in voice transmission. Data transmission, on the other hand, can take place in an environment with losses due to error recovery through retransmission. An exemplary router 524 is arranged to guide traffic corresponding to 534 543 16 different services in different ways depending on their service requirements.
    The network monitor according to the present invention includes programmed features, which identify flows corresponding to each individual service and / or user and offer analysis regarding the interaction between different services. This information can be used, for example, by a router to make real-time or non-real-time decisions regarding the optimization of network topologies, routers or service divisions and the like, to achieve an optimal design suitable for providing each of the services. with unique requirements for service quality.
    A debiting system 526 may be provided to receive statistics regarding service quality and / or service quantity corresponding to different services and different This allows debiting of clients on the basis of this hosts and in dependence thereon debiting clients. statistics rather than charging with straight prices for previously unmeasured services. For example, a client can use his or her unlimited Internet service for voice transmission over IP. According to the present invention, the network monitor 500 can generate statistics for a particular client regarding the number, duration and destination of IP-mediated voice calls. These statistics are then converted into billing information by the billing system 526, whereby the client is charged accordingly. An Internet subscriber who uses the Internet for IP-mediated voice calls can thus now be charged according to the quantity, duration and destination of the calls, as is the case. Similarly, clients can be charged on the basis of the number for telephone services other than Internet-based. e-commerce transactions, the number of share transactions, the number of real-time readings used and other transactions. Alternatively, clients may have service contracts, which include different charging rates depending on the quality of the service provided and 534,943 17 will be charged accordingly. A network monitor can also be used to ensure compliance with service contracts, which guarantee minimum service standards or service level agreements. collected data may be used for security purposes 528 to identify security breaches, As described above, identify inappropriate network use or illegal activity. Packages can, for example, be filtered to identify special files, FTP to a server computer, which have been delivered by means of identifying who logged in via telnet to a special machine or server computer and to see what was entered as soon as logging in.
    Statistics from a network monitor can correspond to a user or a group of users to profile the user or group. Much of the advertising on the Internet is aimed at customers based on a customer profile, which is generated by asking a number of questions to a user. A network monitor according to the present invention can filter each received packet based on its content to build individual customer profiles. A node that monitors the customer base in Philadelphia can, for example, look at each packet from each user, before it goes out on the Internet. The return traffic to these users can also be analyzed by looking for (filtering) special text within the packages or looking for the websites visited by the user. Then a profile can be generated per user or group of users based on filtered data to identify such content, which may be of interest to the user, for example targeted e-mail. The method of filtering described above can similarly be used by the police authority or security officials to monitor communication for the purpose of detecting illegal activity or to monitor activity of selected users.
    The network monitor can also be used to provide data to a playback device 530 to play client sessions, which were monitored by the communication line. All received packets can be registered and then filtered based on a specific session. The session can be identified on the basis of information contained in the packages themselves or on the basis of session information, which is received in special packages or on special channels such as SDR ("session directory protocol"). The packages corresponding to the session can then be played back in the way they were originally presented to the user. This method can be used to repeat all web activity for a user or call via IP-mediated speech.
    The network monitor can be arranged by a user to monitor communication lines, which transport traffic by means of a private or custom protocol.
    Together with a suitable interface for the physical layer between the network monitor and the communication line, a user can specify private protocol parameters using the user interface. The parameters define the structure of packets within the bitstream, which is transported on the communication line, so that the network monitor can divide the packets from the bitstream. Further so that the network monitor can be arranged with custom queries to provide statistics based on the content of such packet fields. The network monitor can similarly parameters can also define fields within a packet, be programmed to receive and analyze data corresponding to custom protocols at higher layers than the link layer.
    In an exemplary network, the data transfer protocol enables each packet to be provided with a timestamp field. Packets transferred from a source to a destination contain a timestamp value in the timestamp field, which indicates a time for the transmission from the source. When the packet is received at the destination, the destination can calculate the one-way transmission duration or the delay from the source to the destination by subtracting the timestamp value from a current time value. This protocol enables simpler measurements of one-way transmission delay and service quality by eliminating the need for communication between network monitors to match packet pairs at separate network monitors.
    For a network that includes many separate intermediate transmission paths between the source and the destination, the transmission duration information in an end-to-end path provides no information regarding a particular bottleneck somewhere between the source and the destination. For improved bottleneck diagnostics, a network monitor according to the present invention, rather than merely calculating end-to-end delays, may be connected to one of the intermediate separate transmission paths between the source and the destination. The network monitor can receive the timestamp value from a packet traveling across the network from the source to the destination. The timestamp value can be subtracted from the current time at which the packet was received by the network monitor, to determine an intermediate duration value. One or more intermediate monitors can be used in the manner described above to locate the bottleneck in a network. In an exemplary embodiment, each of the source, destination, and network monitor includes a global positioning satellite (GPS) interface, current duration, to receive the one used to calculate over-one. a network monitor according to the present invention can provide is an indication of the number of disconnected connections for a particular pair of source and destination, for a particular source or destination and information regarding the relationship between disconnected connections and the total number of connections for a particular source or An exemplary method for identifying transmission control protocol (TCP) computers with problems is described with reference to the flowchart 600 in Fig. 6. 534 9á3 It is well known to those skilled in the art that a TCP session is normally opened by the client. and then quit by the server, when it has no more data to send to the client. session ends by this indicates that the session has ended in advance. If you use the web as an example, a client can (a user with his / her web browser) end the session simply because he / she has changed in terms of the need for desired data or due to impatience with delays in receiving desired data.
    The network monitor receives a packet from a communication line (step 602) and identifies whether the packet belongs to a TCP session (604). The network monitor can identify whether the packet is a TCP packet by identifying and decoding a protocol field in the packet, which identifies to which of several transport layer protocols to which the packet belongs. Once a packet has been identified as TCP, the TCP client and TCP server are identified (step 606). The packet is then examined to determine whether it opens or initiates TCP connect (step 608). initiates a TCP session, if the packet opens or counts (step 610) the total number of TCP sessions for the previously (in step 606) identified TCP server.
    If the packet is not an opening packet, the network monitor then checks whether the packet terminates the TCP connection (612). If not, the network (602). Otherwise, the fix (step 614) is terminated by the server, for example by the sub-monitor the next packet setting the network monitor whether to connect the FIN bit, or whether the connection is terminated by the client.
    If the server quits, this normally indicates the end of the session, and the network monitor then retrieves the next packet (step 602). If someone other than the server is behind the termination, this indicates a premature termination of the session, whereby a premature termination counter is listed for the corresponding server (step 616). The ratio between the number of premature endings and the total number of TCP sessions for the server in question is calculated (in step 620) 622). If the condition for premature terminations exceeds and is compared with a predetermined limit value (step exceeds the limit value, the server in question is identified (step 624).
    It is known to those skilled in the art that all of them as a “server with problems” packet corresponding to a certain TCP session in certain networks do not travel through the same communication line and therefore cannot be detected by a single network monitoring interface. A network monitor can be placed near or on a server or client to "capture" all packets. Alternatively, multiple network monitoring interfaces can be used in the manner described above to store records corresponding to packets. The stored records can then be analyzed to determine which servers may have "problems". In an exemplary embodiment, remote network monitors are arranged, each of which searches for FIN packets by means of, for example, a filter, and when a FIN packet is detected, a message is sent containing the contents of the FIN packet to a central monitor , which makes the decision regarding problems "." server with Although the lessons regarding measuring disconnected connections and identifying servers with problems are described above with reference to TCP sessions, these lessons can generally be applied to other protocols and to other protocol layers and are not limited to identifying TCP servers with problems. In another protocol, for example, a session can be both opened and closed by the same node, regardless of whether it is a client or a server. In addition, the session loads can be transmitted in separate packets or on communication lines, which are separate from session control messages.
    In a further alternative embodiment, shown in Fig. 7, a communication monitoring system 701 according to the present invention may include one or more network monitors, each of which is connected to respective communication lines in a network shown in Figs. Fig. 7. The first, second and third network 710, 720 are connected to the first, second and third communication lines 702, 712 and 722, respectively. Each network monitor 700, 710, 720 collects and analyzes data, monitor 700, received from its respective communication line, as described above with reference to the data flow chart in Fig. 5.
    In addition to providing independent data collection and analysis, a system containing a plurality of network 710, 720 correlated data may be received at the various network monitors, network monitors 700, which to provide improved network performance analysis. One-way delay can be calculated, for example, for data traveling from the first communication line 702 to the second communication line 712.
    An exemplary method for calculating the one-way delay is illustrated by the flow chart in Fig. 8. In general, the “same” packet is identified at two separate network monitors, and the difference in time between when it was received by the respective monitors is used to calculate the one-way delay. The "same" packet is identified by deleting parts of the packet that have changed between the different network monitors.
    Each of the first and second network monitors 700, 710 receives data (step 802, tive communication line 702, 712. The packer 502 divides received data into packets (steps 803, 807), each index creator (504) associates the time of receipt. 506 generates an entry, which contains the timestamp corresponding to each packet and a unique part of the data packet (UDPD), and stores the record in memory 508, 510 (steps 804, 808). 806) from its respect and (timestamp) for each packet with each package. 534 943 23 UPDP is part of the received packet, the data unit uniquely identifiable. For an Ethernet communication line and an IP load, for example, the Ethernet header is removed from the packet, the fields for IP ttl and checksum are reset, after which the IP header and the subsequent exchanges are saved and incorporated by the mail creator 506 in a UPDP record. . UPDP can differ for different protocols and can be programmed using the user interface.
    The UPDP records from the first network monitor 700 are compared to the UPDP records from the second network monitor 710 to merge pairs of UPDPs (step 810). The first and second network monitors can communicate via a communication link 730. The communication link 730 can be implemented through communication between the network monitors via a network, which they monitor (within the band). Alternatively, the communication link 730 may be implemented by communication outside the network, for example a telephone line, a radio connection or a satellite connection (outside the band).
    The corresponding timestamp ts2 from the second network monitor is subtracted for each merged pair of UPDPs from the corresponding timestamp tsl from the first network monitor (step 812). This time difference tsl-ts2 represents the duration of data corresponding to UPDP when traveling from the second network monitor 710 to the first network monitor 700. By calculating UPDP, one can determine the transmission duration of a certain load between the first and second communication lines 702, 712 by means of the same or different communication protocols according to the method described above.
    In an exemplary embodiment, the time difference tsl-ts2 (steps 814, 816) is normalized to the delay in the first communication line to take into account 702. The delay is normalized by subtracting the delay "xmit-delay" for the packet corresponding to UPDP at 534 943 24 travel over the first communication line from the time difference illustrated by the following equation: normalized network delay = (tsl-ts2) - (link speed / packet length), where link speed is the transmission speed of the first communication line 712 and packet length is the length of the packet line on the first communication line , which contained UPDP. The estimated network delay may include components that depend on queue delay and transmission delay. As illustrated by the data flow chart in Fig. 5, the statistician 518 can receive the packet for which the UPDP record is to be generated, after which the statistician 518 calculates the number of bits in the packet and provides this statistic to the mail creator for incorporation with the UPDP record. and use in a normalization calculation. Round trip times can be estimated by similarly calculating the delay from the first to the second network monitor and adding this delay to the delay between the second and the first network monitor.
    The accuracy of the calculated transmission delay depends on the synchronization of the time clocks in the first and second network monitors 700, 710. The network monitors can communicate via the communication line 730 to synchronize their respective clocks. In an exemplary embodiment, the network monitors are synchronized by receiving a time signal from a common time source 740. In an exemplary embodiment, the transmission delay is generated with an accuracy level lower than 10 ps, i.e. the difference between the calculated delay and the actual delay is less than 10 ps. In a preferred embodiment, the common time source 740 consists of a system of global satellites, for example GPS satellites, and each network monitor 700, 710 includes a receiver for 534 943 receiving a time signal from one or more global satellites. When the two communication lines to be monitored are close to each other, one of the first and second network monitors 700, 710 may include a main receiver for GPS, while the other may include a slave receiver for GPS, connected to the main receiver.
    An exemplary network monitor is implemented with a host computer, which has an interface computer on a network (NIC) line, which it monitors. As described above, the data received by the NIC can be processed, the host computer. network interface cards connected to communication before being sent to As also described above, the network monitor can use the time for receiving data from the communication line to generate statistics or To reliably record the time when data is received from the communication line, dimensions regarding network communication. the interface computer associates a reception time with said data (timestamps this data).
    By having the interface computer instead of the Host Computer timestamp this data, inaccuracies in the reception time are reduced or eliminated due to a delay in transferring data from the interface computer to the host computer.
    In an exemplary embodiment, the interface computer includes an interface clock, while the Host Computer has a host clock. The host clock and the interface clock are synchronized, so that the Host Computer can use the timestamp to reliably generate statistics corresponding to received data. In an exemplary embodiment, the interface clock is implemented as a counter. When each packet is received from the communication line, the current value of the counter is associated with this packet.
    The package is later transferred to the Host Computer along with the counter value. The host computer contains a host clock, synchronized with an absolute time reference. above, which is As described, the absolute time reference can be obtained from a global positioning satellite. 534 943 26 The host clock and the interface clock are synchronized by correlating the counter values associated with each packet from the interface computer with the absolute time reference. The method for synchronizing the interface clock with the host clock is described with reference to flow charts in Figs. 9A and 9B with respect to the host computer and the interface computer, respectively. Generally speaking, the host computer periodically requests the value of the interface clock counter from the interface computer and uses this value to correlate the counter with the host clock.
    Referring to Figs. 9A and 9B, if the host computer has received a set of packets from the interface computer (step 902), the host continues to request the counter (step 906) from the interface computer by sending a "fetch counter" message to the interface computer. In an exemplary embodiment, the interface computer stores a set of packets in a memory in the host computer by a direct memory access (DMA) operation and then sends an interrupt to the host computer to indicate the transmission of the packets. If the host computer has not received a set of packets, it waits for packets for a period of time (step 904), after which it requests the counter value (step 906). The host computer registers the time of the host clock (step 906), when it requests the value of the interface counter.
    When the interface computer receives a “fetch counter” message (step 920) from the host computer, the interface computer then determines (step 922) whether it is currently passive or whether it is receiving data from the communication line. If it is not passive, the interface computer (step 924) sends a "retry" message to the host computer. If it is passive, the interface computer then reads the counter value and subtracts a pre-calculated time for interrupt service (step 926) to generate an adjusted counter value. The interface computer then sends (step 928) the setpoint to the host computer. the adjusted counter 534 943 27 The pre-calculated time for interrupt service corresponds to the duration of the time between when the interface computer receives the request for a counter from the host computer and when the interface computer provides the host computer with the adjusted counter value. The pre-calculated time for interrupt service can be determined experimentally using a logic analyzer, for example to measure the duration of the time between when the interface computer receives the counter request until the interface computer outputs the counter value.
    To adapt the experimental delay measurements to the delay during normal operation, the experimental request is sent to the interface, as it is known that this is passive and the interface only serves a request during normal operation in passive state. As is well known to those skilled in the art, one can repeatedly measure the response times of the interface computer to create an average operating time to use during operation.
    Upon receiving the counter value, the host computer (step 912) calculates an estimate of the relative frequency of the interface computer's clock counter relative to the host computer's clock. The relative frequency can be used to correlate counter values associated with packets received from the interface computer until the next execution of the synchronization routine. In an exemplary embodiment, the host computer subtracts a time for serving host interruptions from the recorded time in step 906, before calculating the relative frequency, to take into account the delay between the time the host receives the counter from the interface and the time when values calculate the relative frequency.
    In an exemplary embodiment, a plurality of network interfaces are implemented, each of which is connected to a respective communication line, as a single unit and shares a common clock. Thus, synchronization with the common clock only synchronizes the host clock with the timestamps associated with data received from any of the respective communication lines.
    Figs. 10-28 are exemplary screenshots which (GUI) for collecting and analyzing by one illustrate a graphical user interface present data, network monitors, and for controlling the data analysis in a network monitor according to the present invention. The screen in Fig. 10 includes a table frame 1010, a second frame 1030 and a button frame 1050. The table frame 1010 includes a first part 1011 with selectable fields for user selection and text input fields and a second part 1012 with tables of statistics corresponding to received data . Tables 1023, which appear below the selectable buttons and fields, include values corresponding to the actual data being analyzed. The graphic frame 1030 includes 1034, corresponding to received data. The button frame 1050 includes a diagram 1032, which illustrates statistics versus the set of user programmable buttons.
    The text input fields and the selectable fields in the first part 1011 of the table frame 1010 may alternatively be fixed to prevent user selection of the options and to prevent user input in the text fields. The functions, Fig. 10, associated with the options and fields in are described below: 1. Start: The start field 1013 indicates the start time, which traffic is analyzed and its results from are presented in the graphical user interface. 2. Stop: The stop field 1014 indicates the end time, to which the traffic is analyzed and its results are presented in the graphical user interface.
    The Start and Stop fields 1013, 1014 thus indicate the time between which the traffic is analyzed and presented to the user via the graphical user interface. Contents of the Start and Stop fields 1013, format. The contents are displayed, for example, on a date- 1014 can be presented in several formats in Fig. 10. Alternatively, the contents can be presented as +/- hours to indicate a time relative to the current time, the word "now" can be used to present the current time. , or the word "never" can be used to represent data being continuously updated.
    Window: The Window field 1015 indicates the time intervals at which values are to be calculated for presentation in the second frame 1030. For example, if a user enters “1” in the Window field, the values in the graphical field will be plotted every second. The user can enter the values in the Window bar by using units, which are suitable for indicating the resolution of the diagrams (eg 1 s, 1 ms, 100 gsm to indicate a time resolution, if the unit on the horizontal axis is time). An empty Window bar 1015 indicates that the resolution of the horizontal axis should be selected automatically.
    Top N: The Top N field 1016 indicates the maximum number of entries in the tables 1023, which appear in the second part 1012 of the table frame 1010. If Top N = 10, the table 1023 will include 10 rows, which are sorted by a certain column value in decreasing order. If Top N = -10, Table 1023 will include 10 rows, which are sorted by a certain column value in ascending order (ie this will be the same as Bottom N).
    Filter: The Filter window 1017 describes a filter to be applied to presentation data. Filters can be, for example, "protocol IEEE802.3" to present results for packages according to link layer protocol IEEE802.3. For data, which was previously filtered to show only IP traffic, a filter according to “host 10.0.0.1” will present results for IP traffic, where either source values or destination values were 104.043. Various composite filters are also possible.
    Do DNS: The Do DNS check box (1018) converts the records in Tables 1023 from a numeric representation to a text representation. For example, IP uses a numeric representation (IP address) to identify a host. A DNS (Domain Name Server) can contain an image from this numeric representation of the IP address into a text representation. The IP address .0.0.1 can, for example, be converted to the text representation foo.niksun.com, when the Do DNS check box is checked. For protocols other than DNS, the explanation of the check box will vary according to an equivalent functionality.
    Help: The Help buttons 1019 in each field, when selected, present guidance that depends on the context. For example, if you select the Help button next to Filter window 1017, a Filter help window will appear.
    Refresh: The Refresh button 1020 redraws the contents of all frames.
    Forward and Backward Buttons: The Forward (1021) and Backward (1022) buttons at the top of the first part 1011 of the table frame 1010 work similarly to the "Forward" and "Backward" buttons in a web browser, with the additional feature of they keep the content of all frameworks co-oriented. However, if you click on the "Forward" and "Back" buttons in a web browser, this will give rise to forward or backward movement frame by frame, losing the correspondence between the different frames.
    The graphic frame 1030 includes diagrams 1032, 1034, text input fields and selectable boxes and buttons. lO 534 943 31 The text input fields and the selectable boxes can alternatively be fixed to prevent user selection of the options and to prevent user input in the text fields. The functions associated with the options and boxes shown in the graphical frame 1030 in Fig. 10 are described below: l. Update Tables and Plots: dates the tables and frames in a coordinated manner.
    This button 1036 up- For example, if a user zooms in by selecting some of the drawn information with a mouse, a click on this button 1036 will update the drawn information and the tables for the selected time interval will be zoomed in. 2. Byte / Packet Counts Utilization: SOm (and Bit / Packet Rates) (and This button 1037 switches between one of three options when selecting: "Byte / Packet Counts", "Bit / Packet Rates" and "Utilization". the information is also changed from Byte / Packet Counts over a certain window to Bit / Packet Rates The up- (ie the number of bits or packets per second), or to Utilization In an exemplary embodiment, the byte diagram presents normalized values in relation to the link speed (ie the bit rate divided by the link, channel or virtual circuit capacity in bits / s) 3. Toggle Parent Plot: This button 1038 toggles the line for the charts, as described below 4. Toggle Plot of Average: By selecting the 1039 switch one between whether the mean (not shown) of the y-axis should be presented in the diagrams.
    . Play / Forward / Stop / Fast Forward / Rewind / Fast Rewind / Pause: These 1040 buttons control the playback of the charts on the screen to allow the charts to be updated over time and scrolled with time. The tables 1023 in the table frame 1010 must be updated to 1034.
    The diagram 1032 shown in Fig. 10 is an illustration of bit rate for link level in bytes / s. 7. Bottom Plot: correspond to diagrams 1032, 6. Top Plot: The diagram 1034 shown in Fig. 10 is an illustration of packet speed for link level in packet / s.
    The table 1023 in the table frame 1010 is generated automatically on the basis of the protocols which have been found to be active in the range specified by the fields Start (1013) and Stop (1014). clean received 264 K In Fig. 10, Table 1023 shows that network monitor (K = 100) IP packets and 919 ARP packets between the Start and Stop times. The IP packets and the ARP packets contained 99 MB and 55 KB, respectively (M = 1,000,000).
    The entries in Table 1023 can be selected to sort data by selected field. For example, if you click on the package heading, the table will be sorted by the package column in descending order of activity, and if you click on this heading again, the table will be sorted in reverse order. By selecting the other table headings, the items are sorted in a similar way.
    Fig. 11 illustrates the zoom capability of the present invention. The start / stop time interval of 7: 18/12: 02 in Fig. 10 has been limited to the time interval 9: 00/10: 00 in Fig. 11. Table 1023 and diagrams 1032, 1034 have been updated accordingly. The values in the Start field 1013 and the Stop field 1014 can be adjusted by either manual entry in the fields 1013, 1014 themselves or by graphical selection, by means of a mouse, of time intervals in diagrams 1032, 1034. Once a selection has been made, the display will zoom to the selected interval. By zooming in on the charts, these will be resized for the range selected by the user. 534 943 33 By then selecting the "Update Tables and Plots" button (1036), the data in table frame 1010 will be synchronized with diagrams 1032, 1034. The diagrams can also be updated automatically, in case the user has selected the "auto-synch" option ( not shown).
    Plots ”(1036) allows a user to zoom in on a desired time interval several times without updating data. This provides the advantage of reducing unnecessary processing by the network monitor, until the final interval has been selected.
    The protocols, which are listed as entries in Table 1023 in Fig. 10, link, The "Update Tables and" button can be selected by a user, for example as a hyper- to display protocols encapsulated within the selected protocol. If you click or select IP- the entry in table 1023 in Fig. 10, one obtains the screen according to Fig. 12. The selection causes the diagrams 1032, 1034 in the graphic frame 1030 in Fig. 10 to be automatically updated to show only IP traffic in the diagrams 1232, 1234 in Fig. 12.
    The diagrams illustrate all traffic from the link layer as a line diagram 1235 and all IP traffic as a bar graph. This dual presentation format provides a graphical representation of the perspective between all traffic on a level (IP in this case), compared to all traffic on (Ethernet in this case).
    The contents of the tables in table frame 1210 are also updated to correspond to IP traffic. Table 1223 lists all IP protocols, between the times "Start" and "Stop". previous level used on the monitored link In this particular case, only TCP, UDP and ICMP IP protocols were found. You can also present activity from IP hosts. By scrolling down in table frame 1210, the table for IP count by source value is shown in Fig. 13 for the case where Top N = 2.
    In Fig. 13, traffic is presented in a source host table 1302 for such traffic, in a destination host table 1304 for such traffic, received by a host generated by hosts taken and in a host table 1306 for such traffic generated and received by a host. If you click on a link 1308 in the table frame 1310, to be presented for a "host pairs" table 1402, you will, as shown in Fig. 14.
    The host part table 1402 indicates the total number of packets and bytes sent between pairs of hosts for each identified pair.
    By selecting a "Destination Host" such as .0.0.47 (1404 in Fig. 14), filtering the traffic of the selected "Destination Host" will further to show only such traffic, which is intended for values l0.0.0.47 . This is illustrated in Fig. 15, where table 1502 shows traffic intended for 10.0.0.47, which derives entirely from values 128.32.130.10 in this case for traffic, monitored in the interval between "Start" and "Stop".
    We thus see that only values 128.32.130.1O sent traffic to 10.0.0.47 between the times "Start" and Stop ". Note that the charts 1532, 1534 in the graphical frame 1530 now show this activity between these two hosts as a bar chart 1535 and all IP traffic SOIII as a line chart 1536. Colors can also be used to distinguish data in the charts or tables.
    If one selects the TCP option in Table 1223 in Fig. 12, and the table frame 1610 is updated as shown in Fig. 16 to move the protocol stack upward, grab the TCP level counter for each underlying application 1612. For example, there were 27K http packets ( web), which contained 21 MB received during the selected time interval.
    If the “TCP Flows” button (1604) is selected in Fig. 16, all TCP flows will be presented with their time durations and performance measures, as shown in Fig. 17.
    A TCP feed contains a set of packets associated with a TCP session between two hosts. Each flow can be illustrated, or its corresponding packet can be viewed by selecting the "plot" button 1702 or the "pkts" button 1704, corresponding to the desired TCP flow. Note 534 943, that if the "Do DNS" option had been selected, all IP addresses for TCP hosts would be replaced by their respective names (eg foo.niksun.com). A user can add feeds by clicking on other links, such as those identifying a particular host, for example 10.0.0.47.If a user clicks on .0.0.47 (1706), l0.0.0.47 will be presented, the total flows of values as shown in Fig. 18.
    Fig. 18 shows all TCP flows derived from values l.0.0.0.47. The screen in Fig. 18 is generated by applying a filter set to values 10.0.0.47 on the data shown in Fig. 17. Additional filters can similarly be applied by clicking on other hosts (hyperlinks) in Fig. 18. If a user e.g. in the column “Term Host” select values 10.0.0.5 (1802), all TCP flows between values 10.0.0.47 source) and values 10.0.0.5 will be ter.
    An alternative "TCP performance" can be provided, in the screen shown in Fig. 16, generate tables for TCP performance. By clicking on the hyperlink "TCP performance", the performance table 1902 for TCP is displayed as shown in Fig. 19. From the clear (as (as a destination) to present- for example reasons, for example, the entire table frame in Fig. 19. The presentation includes a table "Troubled TCP Clients" and a table "Troubled TCP Servers" for the two TCP clients and servers with the worst performance ( field value Top N of 2).
    The tables show the following measurements for each TCP client or server over the time interval, the Start and Stop fields: 1. No. This is the total number of TCP connections to the client or server. 2. TCP Data Bytes: This shows the total number of data bytes, TCP connections. used by of Connections: which has been transported over all 3. TCP goodput (bytes / s): This shows the throughput for TCP load (application throughput) 534 943 36 or “TCP goodput”. the number of application bytes divided by the time it means is the total takes to send these bytes, averaged over the number of connections. 4. TCP throughput (bytes / s): This shows the total number of bytes transported over TCP (TCP Flowrate).
    . Avg RTT: This shows the average of the round trip time closures, divided by the time ("Round Trip Time") between the client and the server over the number of connections. 6. Avg Response: This shows the average response time from the server to the client. 7. Retransmit%: This shows the percentage of TCP bytes that were retransmitted (due to congestion, loss or delay, reason). or by something else The TCP performance tables can be customized to add other dimensions or remove existing dimensions via the user interface.
    If you select the http hyperlink in Fig. 16, you get the screen for statistics regarding web traffic (http). An "http performance" option may appear in, for example, the screen according to Fig. 20 to generate tables regarding http performance. By selecting the hyper- shown in Fig. 20. the "http performance" link, performance tables 2102 are presented for http, which shows in Fig. 21. For the sake of clarity, the entire table frame is shown in Fig. 21. The screen includes a "Troubled WWW Clients" table and a "Troubled WWW Server" table for the two WWW clients and servers, (a Top N field value of 2).
    The measurements in tables 2102 for http performance can be generated directly and presented to the user as WWW clients and WWW servers with problems or can be delivered that shows the worst performance directly to a network management system for immediate action. These measures can help a network administrator identify bad servers and connections.
    This information can also be used as a basis to notify the web server operator to buy more bandwidth or to fix its server. The information can also be used to notify clients that they may need more bandwidth or that they may need to choose another service provider. Consequently, these measures can be used to improve the quality of service for users and ultimately provide additional benefit to the network administrator. In the table "Troubled WWW Servers", for example, the other (204,162.96.10) had about 33% web interruptions, which may indicate a potential loss of 33% of the customers from this web site. to include TCP level calculators for each underlying application 1612. There were, for example, 27 K http packets (web packets), which contained 21 MB, which were received during the specified time interval.
    Selecting the UDP hyperlink 40 in Fig. 12 moves up the protocol stack, and the display in Fig. 22 is used to illustrate levels of UDP traffic. Table frame 2210 displays a “UDP Level Counts” table to illustrate activity for each UDP application or UDP port. For example, the monitor indicated that there were 453 domain packages, which contained 69 KB.
    Note that UDP bandwidth utilization was only about 0.32% of total IP (see Table 1223 in Fig. 12). The graphical frame thus only shows IP traffic (RED diagram), which makes the UDP traffic seem insignificant (in BLUE). By clicking on "Toggle Parent Display", the user can now zoom in on the y-axis only on UDP traffic (this is not illustrated), as the diagram for IP (father illustration) will be removed.
    If you select the “MBONE” button 2202 in Fig. 22, you get a presentation of an analysis regarding the application layer for MBONE Sessions (“Multimedia backbone”), which is shown in Fig. 23.
    If you select the "View Packets" button 2204 in the button frame 2250 in Fig. 22, you get a dump of all packets, which is shown in Fig. 24. Since the network monitor can register all packets, you can view all packets and their contents The links in the screen of Fig. 24 allow a user to flexibly filter the data streams.Click on 10.0.0.l2 (2402), the next screenshot will only contain packets to and from l0.0.0.l2. next screen, l0.0.0.5, the updated screen will only show packages between l0.0.0.l2 and l0.0.0.5 A user can also further qualify the dump by selecting ports. the user if a user selects is applied by selecting a dump type from options 2404 at the top of the screen.
    If you select the “Recommend” button 2206 in the button frame 2250 in Fig. 22, you get a presentation of real-time capacity or bandwidth recommendations for the network.
    After detecting the selection of the "Recommend" button 2206, the network monitor uses a mathematical model to interpret the data, to give recommendations regarding the bandwidth utilization of an application considered by the user, for (or other types of traffic) or regarding setting of link / exchange capacity to obtain a specific quality of service. Many forms of such statistics 2502 are shown in Fig. 25. A user can enter values of desired service quality such as loss rates and maximum delays to obtain recommendations regarding the capacity required to meet the desired service quality for the type of traffic being analyzed. Figures 25 and 26 illustrate the recommendations that can be given.
    In an exemplary embodiment, users can select a particular application and a "busy period", during which the user wants to "size" the network resources for a particular level of service quality. Appropriate sub-routers in the network monitor can then analyze the current application traffic and extract or estimate “model parameters.” Using the mathematical model, parameter estimates, and service quality parameters (such as packet loss rates, network delays, frame rates, etc.), the model calculates statistics such as statistical multiplexing gain, capacity requirements, and buffer allocations. recommendations regarding exchange / router settings, network resources or server parameters to maximize network utilization while meeting service quality requirements, such recommendations can be calculated on a real-time basis, when statistics are updated for each packet or set of ket associated with different services, and feedback can be given to network elements along the path of each flow regarding optimal settings to enable dynamic resource allocation in order to meet service quality requirements. the x-axis 2602 in the diagram represents the number of users, and the y-axis 2604 represents capacity in bits / s. For a desired number of users, the capacity can be read from the diagram or from a screen shot of the corresponding table result. Fig. 27 illustrates a screen similar to that of Fig. 22 for the case where the Do DNS button has been selected so that the IP addresses are associated with their registered names.
    Fig. 28 is a screen illustrating statistics, which are presented when selecting the "Statistics" button 2208 in the button frame 2250 in Fig. 22. When selecting the "Statistics" button 2208, the network monitor calculates various statistics based on data. packet size distributions, which are currently viewed by the user. protocol distributions, bandwidth utilization per client, bandwidth utilization per domain, average response time per 534 943 40 server, average round trip time between pairs of server and client and performance measures.
    The present invention is not limited to a particular division of functions between the host computer and the interface computer. The functions of the host computer and the interface computer can be performed by a single computer. The interface of a network monitor according to the present invention is not limited to the user interface and may consist of the monitored network or any other communication line. Although the present invention has been illustrated and described above with reference to certain specific embodiments, the invention is still not intended to be limited to the details shown. Instead, various modifications may be made within the scope and range of equivalence of the claims and without departing from the spirit of the invention.
    An embodiment of the present invention defines a method of collecting and analyzing first data transmitted on a first communication line, comprising the steps of: (a) receiving said first data from the first communication line; (b) dividing said first data into packets; (c) selecting packages based on a respective type for each package; (d) associating a respective index with each selected package; (e) converting each selected packet to a respective record, containing its respective index; (f) store the records; (g) receiving a first duration value corresponding to a first time period: (h) generating at least one statistical power corresponding to packets received during each successive first time period; and 534 943 41 (i) storing the value of said at least one statistical measure for a plurality of consecutive time periods.
    Further, in another embodiment of the present invention, the method as defined above is defined, wherein the received packets originate from a second communication line and wherein each received packet contains an indication of a respective first time corresponding to the transmission of the packet on the second communication line, the method further comprising the steps of : determining a second time, when each packet is received from the first communication line; and generating a transmission delay corresponding to each packet by subtracting its respective second time from its respective first time.
    In addition, in a further embodiment of the present invention, the method as defined above is defined, including the step of receiving a time signal from a global positioning satellite to determine the second time.
    权利要求:
    Claims (9)
    [1]
    A method of transmitting data on a communication line, comprising the steps of: generating successive packets, each packet having a plurality of fields including a time field and a data field, the data field comprising said data and the time field comprising one with the packet associated time; wherein the associated time is determined by an absolute time reference successively transmitting the generated packets on the communication line, the time associated with each packet being a time at which the packet in question was transmitted on the communication line.
    [2]
    The method of claim 1, wherein the associated time is determined from a signal from at least one global positioning satellite.
    [3]
    A method of transmitting data on a first communication line, comprising the steps of: receiving packets from a second communication line, generating successive packets, each packet having a plurality of fields including a time field and a data field, the data field comprising said data and the time field comprises a time associated with the packet, where the time associated with each packet is determined by an absolute time reference and is a time at which the packet in question was received from the second communication line, and successively transmitting the generated packets on the first communication line.
    [4]
    A method of receiving a plurality of consecutive packets from a first communication line, each packet comprising at least one field corresponding to a time associated with the packet and at least where another field corresponding to data, wherein the time associated with the packet is determined by an absolute time reference and corresponds to a time at which the packet has been transmitted from a source, that: the method comprises the steps of dividing data received from the first communication line into successive packets; decode the transfer time from each successive packet.
    [5]
    The method of claim 4, wherein said packet originated from a second communication line and wherein the time associated with the packet corresponds to its transmission on the second communication line, the method further comprising the steps of: determining a respective reception time when each packet is received from the first communication line. ; and generating a transmission delay corresponding to each packet by subtracting the reception time from the transmission time.
    [6]
    The method of claim 5, wherein the reception time is determined from a signal from at least one global positioning satellite.
    [7]
    A method according to claim 6, wherein the transmission delay corresponding to each packet is calculated on the basis of the time associated with the packet, the packet reception time, a data transmission speed on the first communication line and a length of the packet on the first communication line.
    [8]
    A method according to claim 7, wherein the transmission delay corresponding to each packet is calculated using the equation 10 15 20 25 30 35 534 'B43 44 transmission delay = (tsl-ts2) - (link speed / packet length), where tsl is the reception time of the packet, ts2 is the time associated with the packet, link rate is a data rate on the first communication line and packet length is the length of each respective packet on the first communication line.
    [9]
    A data transmission protocol for transmitting data on a communication line, comprising: receiving said data from a protocol layer above the data transmission protocol; encapsulating said data in successive packets, each packet including a time field comprising a time associated with the packet, the associated time being determined by an absolute time reference and the corresponding time of the packet transmission; and transmission of the successive packets on the communication line.
    类似技术:
    公开号 | 公开日 | 专利标题
    SE534943C2|2012-02-28|Apparatus and method for collecting and analyzing communication data
    US8275875B2|2012-09-25|Security camera for a network
    EP1367771B1|2008-10-29|Passive network monitoring system
    US6321264B1|2001-11-20|Network-performance statistics using end-node computer systems
    AU758185B2|2003-03-20|System and method for measuring the transfer durations and loss rates in high volume telecommunication networks
    US8429270B2|2013-04-23|Network usage collection system
    Cisco2002-07-01|NetFlow Services Solutions Guide
    同族专利:
    公开号 | 公开日
    EP1145541B1|2012-11-21|
    JP2002531014A|2002-09-17|
    IL143049D0|2002-04-21|
    GB2361836A|2001-10-31|
    WO2000031963A1|2000-06-02|
    US8873410B2|2014-10-28|
    KR100814546B1|2008-03-17|
    SE0501119L|2005-05-19|
    CN1328744A|2001-12-26|
    WO2000031963A8|2003-11-06|
    CA2351175A1|2000-06-02|
    DE19983761T1|2002-01-10|
    US20020105911A1|2002-08-08|
    AU774267B2|2004-06-24|
    EP1145541A1|2001-10-17|
    AU2004214573B9|2008-07-24|
    GB2361836B|2004-03-24|
    AU2004214573B2|2008-06-19|
    RU2001117235A|2003-05-27|
    JP2006129533A|2006-05-18|
    AU2004214573A1|2004-10-21|
    US8102782B2|2012-01-24|
    EP1145541A4|2005-09-28|
    DE19983761B3|2014-10-09|
    US20120092343A1|2012-04-19|
    DE19983761B9|2014-12-31|
    WO2000031963A9|2002-08-29|
    KR20010101075A|2001-11-14|
    JP2005051809A|2005-02-24|
    DK1145541T3|2013-03-11|
    BR9915633A|2001-11-13|
    SE0101745L|2001-07-09|
    US7492720B2|2009-02-17|
    CN1214567C|2005-08-10|
    AU2008221570A1|2008-10-16|
    MXPA01005187A|2002-06-04|
    GB0112566D0|2001-07-18|
    IL143049A|2010-04-29|
    SG141212A1|2008-04-28|
    ZA200103858B|2002-08-12|
    AU2348700A|2000-06-13|
    FI20011009A|2001-05-14|
    SE0101745D0|2001-05-18|
    US20090232016A1|2009-09-17|
    CN1700657A|2005-11-23|
    SE526340C2|2005-08-23|
    CA2351175C|2016-05-03|
    引用文献:
    公开号 | 申请日 | 公开日 | 申请人 | 专利标题
    US4769811A|1986-12-31|1988-09-06|American Telephone And Telegraph Company, At&T Bell Laboratories|Packet switching system arranged for congestion control|
    JPH0246391A|1988-08-04|1990-02-15|Daikin Mfg Co Ltd|Seal device for air rotary joint|
    EP0389689B1|1989-03-28|1997-06-04|POLYGRAM MANUFACTURING & DISTRIBUTION CENTRES GMBH|Method for transmitting a transmission signal and a transmitting device and a receiving device for use in the method|
    JP2830270B2|1990-01-17|1998-12-02|日本電気株式会社|LAN monitor circuit|
    JP3315404B2|1990-09-28|2002-08-19|ヒューレット・パッカード・カンパニー|How to detect network topological features|
    DE69020899T2|1990-09-28|1995-12-07|Hewlett Packard Co|Network monitoring system and device.|
    JPH04262645A|1991-02-15|1992-09-18|Fuji Xerox Co Ltd|Selection type routing system|
    US5274631A|1991-03-11|1993-12-28|Kalpana, Inc.|Computer network switching system|
    EP0522211B1|1991-06-12|1996-01-24|Hewlett-Packard Company|Testing a packet-based network|
    GB2261799B|1991-11-23|1995-04-19|Dowty Communications Ltd|Packet transmission system|
    JPH05227218A|1992-02-10|1993-09-03|Nec Corp|Propagation delay measurement system for packet switching network|
    JP3212040B2|1992-03-23|2001-09-25|株式会社荏原製作所|Centrifugal blower|
    US5282194A|1992-08-17|1994-01-25|Loral Aerospace Corporation|Interactive protocol analysis system|
    US5483468A|1992-10-23|1996-01-09|International Business Machines Corporation|System and method for concurrent recording and displaying of system performance data|
    JPH06282527A|1993-03-29|1994-10-07|Hitachi Software Eng Co Ltd|Network control system|
    AU7207994A|1993-06-21|1995-01-17|Multimedia Design Corporation|Integrated multimedia information management system|
    JPH07321783A|1994-05-25|1995-12-08|Fuji Xerox Co Ltd|Network monitor equipment|
    US5483568A|1994-11-03|1996-01-09|Kabushiki Kaisha Toshiba|Pad condition and polishing rate monitor using fluorescence|
    US5615323A|1994-11-04|1997-03-25|Concord Communications, Inc.|Displaying resource performance and utilization information|
    US5570346A|1994-12-08|1996-10-29|Lucent Technologies Inc.|Packet network transit delay measurement system|
    CA2162939C|1994-12-30|2001-12-18|Thomas Jay Cloonan|Terabit per second packet switch|
    US5521907A|1995-04-25|1996-05-28|Visual Networks, Inc.|Method and apparatus for non-intrusive measurement of round trip delay in communications networks|
    GB2300789B|1995-05-12|2000-04-05|Gen Datacomm Adv Res|Data network|
    US5790605A|1995-07-28|1998-08-04|Motorola, Inc.|Method for determining voting windows in a diversity repeater|
    JPH0946391A|1995-08-01|1997-02-14|Nippon Telegr & Teleph Corp <Ntt>|Method for adding time stamp to data packet|
    DE19531611C1|1995-08-28|1996-11-07|Siemens Ag|Transmission bit rate matching method for data multiplexer|
    US5878420A|1995-08-31|1999-03-02|Compuware Corporation|Network monitoring and management system|
    US5812528A|1995-11-17|1998-09-22|Telecommunications Techniques Corporation|Measuring round trip time in ATM network virtual connections|
    US5761191A|1995-11-28|1998-06-02|Telecommunications Techniques Corporation|Statistics collection for ATM networks|
    US5793954A|1995-12-20|1998-08-11|Nb Networks|System and method for general purpose network analysis|
    US6233256B1|1996-03-13|2001-05-15|Sarnoff Corporation|Method and apparatus for analyzing and monitoring packet streams|
    US5905736A|1996-04-22|1999-05-18|At&T Corp|Method for the billing of transactions over the internet|
    US5787253A|1996-05-28|1998-07-28|The Ag Group|Apparatus and method of analyzing internet activity|
    US5754831A|1996-05-30|1998-05-19|Ncr Corporation|Systems and methods for modeling a network|
    GB9611403D0|1996-05-31|1996-08-07|Northern Telecom Ltd|Network data analysis method|
    US5734962A|1996-07-17|1998-03-31|General Electric Company|Satellite communications system utilizing parallel concatenated coding|
    US5850388A|1996-08-02|1998-12-15|Wandel & Goltermann Technologies, Inc.|Protocol analyzer for monitoring digital transmission networks|
    US5887139A|1996-08-19|1999-03-23|3Com Corporation|Configurable graphical user interface useful in managing devices connected to a network|
    US5886643A|1996-09-17|1999-03-23|Concord Communications Incorporated|Method and apparatus for discovering network topology|
    US5850386A|1996-11-01|1998-12-15|Wandel & Goltermann Technologies, Inc.|Protocol analyzer for monitoring digital transmission networks|
    US5991881A|1996-11-08|1999-11-23|Harris Corporation|Network surveillance system|
    US5867483A|1996-11-12|1999-02-02|Visual Networks, Inc.|Method and apparatus for measurement of peak throughput in packetized data networks|
    US6085243A|1996-12-13|2000-07-04|3Com Corporation|Distributed remote management for networks|
    US5974237A|1996-12-18|1999-10-26|Northern Telecom Limited|Communications network monitoring|
    US6198728B1|1996-12-19|2001-03-06|Phillips Electronics North America Corp.|Medium access control protocol for wireless ATM|
    JP3816612B2|1997-01-14|2006-08-30|富士通株式会社|Network management device|
    US6076115A|1997-02-11|2000-06-13|Xaqti Corporation|Media access control receiver and network management system|
    US6578077B1|1997-05-27|2003-06-10|Novell, Inc.|Traffic monitoring tool for bandwidth management|
    US6243756B1|1997-06-23|2001-06-05|Compaq Computer Corporation|Network device with unified management|
    US6304903B1|1997-08-01|2001-10-16|Agilent Technologies, Inc.|State machine for collecting information on use of a packet network|
    US6006264A|1997-08-01|1999-12-21|Arrowpoint Communications, Inc.|Method and system for directing a flow between a client and a server|
    US7039015B1|1998-04-24|2006-05-02|Paradyne Corporation|System and method for the collection and display of network performance data in a communication network|
    US6070190A|1998-05-11|2000-05-30|International Business Machines Corporation|Client-based application availability and response monitoring and reporting for distributed computing environments|
    US6369820B1|1998-06-02|2002-04-09|International Business Machines Corporation|Method and system for graphically displaying trend and range data for a variety of systems|
    US6321264B1|1998-08-28|2001-11-20|3Com Corporation|Network-performance statistics using end-node computer systems|
    US6819655B1|1998-11-09|2004-11-16|Applied Digital Access, Inc.|System and method of analyzing network protocols|
    CN1293502C|1999-06-30|2007-01-03|倾向探测公司|Method and apparatus for monitoring traffic in a network|
    US6654803B1|1999-06-30|2003-11-25|Nortel Networks Limited|Multi-panel route monitoring graphical user interface, system and method|
    FI20000316A|2000-02-14|2001-08-15|Nokia Networks Oy|Emulation of information flow|
    JP5227218B2|2009-02-27|2013-07-03|トヨタ自動車株式会社|Varnish processing equipment|US6707794B1|1999-11-15|2004-03-16|Networks Associates Technology, Inc.|Method, system and computer program product for physical link layer handshake protocol analysis|
    US7461163B2|2002-08-16|2008-12-02|Infrastructure Innovations Llc|Real time mesh measurement system stream latency and jitter measurements|
    WO2001061509A1|2000-02-18|2001-08-23|Cedere Corporation|Real time mesh measurement system stream latency and jitter measurements|
    US10572824B2|2003-05-23|2020-02-25|Ip Reservoir, Llc|System and method for low latency multi-functional pipeline with correlation logic and selectively activated/deactivated pipelined data processing engines|
    US6711558B1|2000-04-07|2004-03-23|Washington University|Associative database scanning and information retrieval|
    US7139743B2|2000-04-07|2006-11-21|Washington University|Associative database scanning and information retrieval using FPGA devices|
    US8095508B2|2000-04-07|2012-01-10|Washington University|Intelligent data storage and processing using FPGA devices|
    SE514884C2|2000-04-26|2001-05-14|Telia Ab|Apparatus and method for measuring and processing information in a packet-oriented communication system|
    US6842769B1|2000-05-05|2005-01-11|Interland, Inc.|Automatically configured network server|
    US20020016937A1|2000-08-02|2002-02-07|Henry Houh|Method and apparatus for utilizing a network processor as part of a test system|
    US20020015387A1|2000-08-02|2002-02-07|Henry Houh|Voice traffic packet capture and analysis tool for a data network|
    US7325029B1|2000-08-08|2008-01-29|Chang Ifay F|Methods for enabling e-commerce voice communication|
    US6718346B1|2000-08-17|2004-04-06|3Com Corporation|Generating summary data for a requested time period having a requested start time and end time a plurality of data records|
    US6804197B1|2000-10-24|2004-10-12|Agilent Technologies, Inc.|Clock switching for a synchronous memory in network probe circuitry|
    US6807156B1|2000-11-07|2004-10-19|Telefonaktiebolaget Lm Ericsson |Scalable real-time quality of service monitoring and analysis of service dependent subscriber satisfaction in IP networks|
    US7545752B2|2000-11-10|2009-06-09|Packeteer, Inc.|Application service level mediation and method of using the same|
    US7937470B2|2000-12-21|2011-05-03|Oracle International Corp.|Methods of determining communications protocol latency|
    DE10125382A1|2001-01-26|2002-08-14|Cst Concepts Comm System Test|Distributed test system for testing and monitoring electronic signals at network connections processing signals taking into account associated time information|
    US6937562B2|2001-02-05|2005-08-30|Ipr Licensing, Inc.|Application specific traffic optimization in a wireless link|
    US20020133364A1|2001-03-15|2002-09-19|International Business Machines Corporation|System and method for pricing agent for differentiated services computer networks|
    US20020133473A1|2001-03-15|2002-09-19|International Business Machines Corporation|System and method for on-demand pricing for differentiated services computer networks|
    JP2002290433A|2001-03-27|2002-10-04|Fujitsu Ltd|Data repeater system provided with band control function, and band management device|
    US7415038B2|2001-03-29|2008-08-19|International Business Machines Corporation|Method and system for network management providing access to application bandwidth usage calculations|
    US7269157B2|2001-04-10|2007-09-11|Internap Network Services Corporation|System and method to assure network service levels with intelligent routing|
    US7197559B2|2001-05-09|2007-03-27|Mercury Interactive Corporation|Transaction breakdown feature to facilitate analysis of end user performance of a server system|
    US6950405B2|2001-07-16|2005-09-27|Agilent Technologies, Inc.|Traffic stream generator having a non-consecutive addressing mechanism|
    US7436826B2|2001-07-25|2008-10-14|Dell Products L.P.|System and method for detecting and indicating communication protocols|
    US7657935B2|2001-08-16|2010-02-02|The Trustees Of Columbia University In The City Of New York|System and methods for detecting malicious email transmission|
    US8868715B2|2001-10-15|2014-10-21|Volli Polymer Gmbh Llc|Report generation and visualization systems and methods and their use in testing frameworks for determining suitability of a network for target applications|
    US8543681B2|2001-10-15|2013-09-24|Volli Polymer Gmbh Llc|Network topology discovery systems and methods|
    US7633942B2|2001-10-15|2009-12-15|Avaya Inc.|Network traffic generation and monitoring systems and methods for their use in testing frameworks for determining suitability of a network for target applications|
    US7716330B2|2001-10-19|2010-05-11|Global Velocity, Inc.|System and method for controlling transmission of data packets over an information network|
    US7457862B2|2001-10-22|2008-11-25|Avaya, Inc.|Real time control protocol session matching|
    FR2831741B1|2001-10-26|2003-12-19|Thales Sa|METHODS AND SYSTEMS FOR RECORDING AND SYNCHRONIZED READING OF DATA FROM A PLURALITY OF TERMINAL EQUIPMENT|
    US7133365B2|2001-11-02|2006-11-07|Internap Network Services Corporation|System and method to provide routing control of information over networks|
    US7222190B2|2001-11-02|2007-05-22|Internap Network Services Corporation|System and method to provide routing control of information over data networks|
    US7668966B2|2001-11-02|2010-02-23|Internap Network Services Corporation|Data network controller|
    US7561517B2|2001-11-02|2009-07-14|Internap Network Services Corporation|Passive route control of data networks|
    US7274731B2|2001-11-09|2007-09-25|Adc Dsl Systems, Inc.|Non-chronological system statistics|
    US9306966B2|2001-12-14|2016-04-05|The Trustees Of Columbia University In The City Of New York|Methods of unsupervised anomaly detection using a geometric framework|
    US8544087B1|2001-12-14|2013-09-24|The Trustess Of Columbia University In The City Of New York|Methods of unsupervised anomaly detection using a geometric framework|
    US6604139B1|2001-12-14|2003-08-05|Networks Associates Technology, Inc.|Voice protocol filtering system and method|
    US7225343B1|2002-01-25|2007-05-29|The Trustees Of Columbia University In The City Of New York|System and methods for adaptive model generation for detecting intrusions in computer systems|
    US20030163343A1|2002-02-27|2003-08-28|International Business Machines Corporation|Method and system for dynamically modifying an electronic campaign based on network activity|
    DE10210707A1|2002-03-12|2003-10-02|Deutsche Telekom Ag|Process for the output of status data|
    US7489687B2|2002-04-11|2009-02-10|Avaya. Inc.|Emergency bandwidth allocation with an RSVP-like protocol|
    KR100878805B1|2002-04-30|2009-01-14|엘지전자 주식회사|Subpacket transmission parameters decision method|
    US20030208614A1|2002-05-01|2003-11-06|John Wilkes|System and method for enforcing system performance guarantees|
    EP1627284B1|2003-05-23|2018-10-24|IP Reservoir, LLC|Intelligent data storage and processing using fpga devices|
    US6800321B1|2002-05-29|2004-10-05|The Regents Of The University Of California|Reduced AC losses in HTS coated conductors|
    US7747729B2|2002-06-14|2010-06-29|Hanoch Levy|Determining client latencies over a network|
    US7383582B1|2002-08-02|2008-06-03|Federal Network Systems, Llc|Systems and methods for performing electronic surveillance|
    KR100457688B1|2002-08-06|2004-11-17|에스케이텔레텍주식회사|Monitoring-phone and monitoring-method for navigation of internet contents|
    US7711844B2|2002-08-15|2010-05-04|Washington University Of St. Louis|TCP-splitter: reliable packet monitoring methods and apparatus for high speed networks|
    US7373403B2|2002-08-22|2008-05-13|Agilent Technologies, Inc.|Method and apparatus for displaying measurement data from heterogeneous measurement sources|
    US20040073690A1|2002-09-30|2004-04-15|Neil Hepworth|Voice over IP endpoint call admission|
    US8176154B2|2002-09-30|2012-05-08|Avaya Inc.|Instantaneous user initiation voice quality feedback|
    US7359979B2|2002-09-30|2008-04-15|Avaya Technology Corp.|Packet prioritization and associated bandwidth and buffer management techniques for audio over IP|
    US7469418B1|2002-10-01|2008-12-23|Mirage Networks, Inc.|Deterring network incursion|
    US8819285B1|2002-10-01|2014-08-26|Trustwave Holdings, Inc.|System and method for managing network communications|
    US8260961B1|2002-10-01|2012-09-04|Trustwave Holdings, Inc.|Logical / physical address state lifecycle management|
    US7752115B2|2002-10-02|2010-07-06|Trading Technologies International, Inc.|Method and apparatus for a fair exchange|
    US7894354B2|2002-10-04|2011-02-22|Jds Uniphase Corporation|System and method to monitor RTP streams using RTCP SR/RR packet information|
    US7827272B2|2002-11-04|2010-11-02|Riverbed Technology, Inc.|Connection table for intrusion detection|
    US20040133733A1|2002-11-06|2004-07-08|Finisar Corporation|Storing, retrieving and displaying captured data in a network analysis system|
    US20040093413A1|2002-11-06|2004-05-13|Bean Timothy E.|Selecting and managing time specified segments from a large continuous capture of network data|
    US20040098611A1|2002-11-06|2004-05-20|Bean Timothy E.|Optimizing retrieval of requested data from a remote device|
    US7991827B1|2002-11-13|2011-08-02|Mcafee, Inc.|Network analysis system and method utilizing collected metadata|
    WO2004045143A1|2002-11-13|2004-05-27|Ktfreetel Co., Ltd.|Apparatus for analyzing the packet data on mobile communication network and method thereof|
    US7734637B2|2002-12-05|2010-06-08|Borland Software Corporation|Method and system for automatic detection of monitoring data sources|
    US7701863B2|2002-12-12|2010-04-20|Alcatel Lucent|Decentralized SLS monitoring for throughput in a differentiated service environment|
    US7584298B2|2002-12-13|2009-09-01|Internap Network Services Corporation|Topology aware route control|
    WO2004056043A1|2002-12-17|2004-07-01|Xyratex Technology Limited|Network tap module|
    US7454494B1|2003-01-07|2008-11-18|Exfo Service Assurance Inc.|Apparatus and method for actively analyzing a data packet delivery path|
    JP4108486B2|2003-01-08|2008-06-25|Ｎｅｃインフロンティア株式会社|IP router, communication system, bandwidth setting method used therefor, and program thereof|
    US7525994B2|2003-01-30|2009-04-28|Avaya Inc.|Packet data flow identification for multiplexing|
    JP3986526B2|2003-02-27|2007-10-03|富士通株式会社|Usage state confirmation method and apparatus|
    US7249178B2|2003-03-28|2007-07-24|International Business Machines Corporation|Non-intrusive recursive dispatching of nested service collections for aggregating web services|
    US7607093B2|2003-04-04|2009-10-20|Agilent Technologies, Inc.|Displaying network segment decode information in diagrammatic form|
    US8024795B2|2003-05-09|2011-09-20|Q1 Labs, Inc.|Network intelligence system|
    US7840664B2|2003-05-21|2010-11-23|Ixia|Automated characterization of network traffic|
    US7627669B2|2003-05-21|2009-12-01|Ixia|Automated capturing and characterization of network traffic using feedback|
    WO2018119035A1|2016-12-22|2018-06-28|Ip Reservoir, Llc|Pipelines for hardware-accelerated machine learning|
    US7437458B1|2003-06-13|2008-10-14|Juniper Networks, Inc.|Systems and methods for providing quality assurance|
    JP3791921B2|2003-07-04|2006-06-28|インターナショナル・ビジネス・マシーンズ・コーポレーション|Method for analyzing network trace, processing device for analyzing network trace, computer-executable program for controlling computer as processing device, and method for correcting time difference between nodes in network|
    US7937460B2|2003-07-11|2011-05-03|Computer Associates Think, Inc.|System and method for providing service level management|
    DE10335811A1|2003-08-05|2005-03-03|Rohde & Schwarz Gmbh & Co. Kg|Message analysis device and method for analyzing|
    US8521684B2|2003-09-03|2013-08-27|Ca, Inc.|System and method for aligning data frames in time|
    US20050050098A1|2003-09-03|2005-03-03|Paul Barnett|System and method for aligning data frames in time|
    US8055612B2|2003-09-03|2011-11-08|Hyperformix, Inc.|System and method for aligning data frames in time|
    WO2005025257A1|2003-09-05|2005-03-17|Telefonaktiebolaget Lm Ericsson |Monitoring in a telecommunication network|
    US20050078606A1|2003-09-11|2005-04-14|Bernstein David R.|Pattern-based correlation of non-translative network segments|
    US20050060403A1|2003-09-11|2005-03-17|Bernstein David R.|Time-based correlation of non-translative network segments|
    US7577736B1|2003-10-15|2009-08-18|Nortel Networks Limited|Network accounting statistics collection|
    JP3651850B2|2003-10-21|2005-05-25|アンリツ株式会社|Mobile communication terminal test equipment|
    KR100593987B1|2003-11-29|2006-06-30|삼성전자주식회사|Method for displaying of data rate in wireless terminal|
    US7450568B2|2003-12-05|2008-11-11|Cisco Technology, Inc.|System and method for managing a VolP network|
    US8898339B2|2003-12-12|2014-11-25|Napatech A/S|Method of transferring data implying a network analyser card|
    US8213323B1|2003-12-18|2012-07-03|Sprint Communications Company L.P.|System and method for network performance monitoring|
    EP1549092A1|2003-12-22|2005-06-29|Nortel Networks Limited|Wireless data traffic statistics|
    US8578016B2|2004-01-08|2013-11-05|International Business Machines Corporation|Non-invasive discovery of relationships between nodes in a network|
    US8738804B2|2004-01-08|2014-05-27|International Business Machines Corporation|Supporting transactions in a data network using router information|
    WO2005071890A1|2004-01-27|2005-08-04|Actix Limited|Monitoring system for a mobile communication network for traffic analysis using a hierarchial approach|
    US8046464B2|2004-03-10|2011-10-25|The Boeing Company|Quality of service resource management apparatus and method for middleware services|
    US7698730B2|2004-03-16|2010-04-13|Riverbed Technology, Inc.|Service detection|
    US7460837B2|2004-03-25|2008-12-02|Cisco Technology, Inc.|User interface and time-shifted presentation of data in a system that monitors activity in a shared radio frequency band|
    US8489720B1|2004-03-31|2013-07-16|Blue Coat Systems, Inc.|Cost-aware, bandwidth management systems adaptive to network conditions|
    US7422152B2|2004-05-13|2008-09-09|Cisco Technology, Inc.|Methods and devices for providing scalable RFID networks|
    WO2005114910A1|2004-05-21|2005-12-01|Xyratex Technology Limited|A method of processing data, a network analyser card, a host and an intrusion detection system|
    US8190731B2|2004-06-15|2012-05-29|Alcatel Lucent|Network statistics processing device|
    US7978827B1|2004-06-30|2011-07-12|Avaya Inc.|Automatic configuration of call handling based on end-user needs and characteristics|
    US9021081B2|2007-02-12|2015-04-28|Cradlepoint, Inc.|System and method for collecting individualized network usage data in a personal hotspot wireless network|
    US8332938B2|2004-09-17|2012-12-11|At&T Intellectual Property I, L.P.|Detection of encrypted packet streams using a timer|
    US7730519B2|2004-09-17|2010-06-01|At&T Intellectual Property I, L.P.|Detection of encrypted packet streams using feedback probing|
    US7761705B2|2004-09-17|2010-07-20|At&T Intellectual Property I, L.P.|Detection of encrypted packet streams|
    US7451309B2|2004-09-17|2008-11-11|At&T Intellectual Property L.P.|Signature specification for encrypted packet streams|
    US7603460B2|2004-09-24|2009-10-13|Microsoft Corporation|Detecting and diagnosing performance problems in a wireless network through neighbor collaboration|
    US7680100B1|2004-09-30|2010-03-16|Avaya Inc.|Internet protocol appliance manager|
    KR100655187B1|2004-10-25|2006-12-08|주식회사 유프레스토|System and method for analyzing the amount of data transmitted|
    US7664879B2|2004-11-23|2010-02-16|Cisco Technology, Inc.|Caching content and state data at a network element|
    US7987272B2|2004-12-06|2011-07-26|Cisco Technology, Inc.|Performing message payload processing functions in a network element on behalf of an application|
    US7725934B2|2004-12-07|2010-05-25|Cisco Technology, Inc.|Network and application attack protection based on application layer message inspection|
    US8082304B2|2004-12-10|2011-12-20|Cisco Technology, Inc.|Guaranteed delivery of application layer messages by a network element|
    US20060149841A1|2004-12-20|2006-07-06|Alcatel|Application session management for flow-based statistics|
    JP4117291B2|2004-12-28|2008-07-16|インターナショナル・ビジネス・マシーンズ・コーポレーション|Device for collecting and analyzing network information and creating network configuration information, method for creating network configuration information, and program for creating network configuration information|
    CN100442702C|2005-01-05|2008-12-10|华为技术有限公司|Method and apparatus for realizing modem signal fault analysis|
    US7917299B2|2005-03-03|2011-03-29|Washington University|Method and apparatus for performing similarity searching on a data stream with respect to a query string|
    US9015324B2|2005-03-16|2015-04-21|Adaptive Computing Enterprises, Inc.|System and method of brokering cloud computing resources|
    US9231886B2|2005-03-16|2016-01-05|Adaptive Computing Enterprises, Inc.|Simple integration of an on-demand compute environment|
    US9413687B2|2005-03-16|2016-08-09|Adaptive Computing Enterprises, Inc.|Automatic workload transfer to an on-demand center|
    US8782120B2|2005-04-07|2014-07-15|Adaptive Computing Enterprises, Inc.|Elastic management of compute resources between a web server and an on-demand compute environment|
    WO2006108190A2|2005-04-07|2006-10-12|Google Inc.|Computing online advertising statistics and implementing computer-generated modifications to an online advertising program in real time|
    CA2603577A1|2005-04-07|2006-10-12|Cluster Resources, Inc.|On-demand access to compute resources|
    US7765591B2|2005-05-05|2010-07-27|Cisco Technology, Inc.|Method and system for prioritizing security operations in a communication network|
    US7751331B1|2005-05-09|2010-07-06|Cisco Technology, Inc.|Technique for policy conflict resolution using priority with variance|
    WO2006131909A2|2005-06-06|2006-12-14|Netbarrage Ltd.|Method and system for monitoring and analyzing peer-to-peer users' activities over a data network|
    US8458467B2|2005-06-21|2013-06-04|Cisco Technology, Inc.|Method and apparatus for adaptive application message payload content transformation in a network infrastructure element|
    US8266327B2|2005-06-21|2012-09-11|Cisco Technology, Inc.|Identity brokering in a network element|
    AT438856T|2005-06-22|2009-08-15|Univ Johns Hopkins|BIOMARKER FOR EGG CANCER: PROTEINS RELATED TO CTAP3|
    CN100387003C|2005-06-27|2008-05-07|华为技术有限公司|Chain-circuit time delay detecting method|
    DE102005033211A1|2005-07-13|2007-01-18|Deutsche Thomson-Brandt Gmbh|Method for determining the activity of a device in a network of distributed stations and network station for carrying out the method|
    US7345585B2|2005-08-01|2008-03-18|Cisco Technology, Inc.|Network based device for providing RFID middleware functionality|
    US7649845B2|2005-09-30|2010-01-19|Intel Corporation|Handling hot spots in interconnection networks|
    US20070081471A1|2005-10-06|2007-04-12|Alcatel Usa Sourcing, L.P.|Apparatus and method for analyzing packet data streams|
    US9019821B2|2005-10-13|2015-04-28|Alcatel Lucent|Accounting based on active packet time|
    KR100813966B1|2005-11-22|2008-03-14|연세대학교 산학협력단|Clock synchronization method and apparatus using estimated one-way delay|
    US7702629B2|2005-12-02|2010-04-20|Exegy Incorporated|Method and device for high performance regular expression pattern matching|
    JP5013268B2|2006-01-06|2012-08-29|日本電気株式会社|Transmission line quality measuring device, communication system, quality measuring method and quality measuring program|
    US7954114B2|2006-01-26|2011-05-31|Exegy Incorporated|Firmware socket module for FPGA-based pipeline processing|
    US8379841B2|2006-03-23|2013-02-19|Exegy Incorporated|Method and system for high throughput blockwise independent encryption/decryption|
    US7894488B2|2006-04-13|2011-02-22|Cisco Technology, Inc.|Apparatus and method for monitoring quality metrics associated with a wireless network|
    US7840482B2|2006-06-19|2010-11-23|Exegy Incorporated|Method and system for high speed options pricing|
    US7921046B2|2006-06-19|2011-04-05|Exegy Incorporated|High speed processing of financial information using FPGA devices|
    US7865584B2|2006-06-20|2011-01-04|Alcatel Lucent|Network service performance monitoring apparatus and methods|
    US8488447B2|2006-06-30|2013-07-16|Centurylink Intellectual Property Llc|System and method for adjusting code speed in a transmission path during call set-up due to reduced transmission performance|
    US9094257B2|2006-06-30|2015-07-28|Centurylink Intellectual Property Llc|System and method for selecting a content delivery network|
    US8717911B2|2006-06-30|2014-05-06|Centurylink Intellectual Property Llc|System and method for collecting network performance information|
    US7765294B2|2006-06-30|2010-07-27|Embarq Holdings Company, Llc|System and method for managing subscriber usage of a communications network|
    US9003292B2|2006-07-06|2015-04-07|LiveAction, Inc.|System and method for network topology and flow visualization|
    US7797406B2|2006-07-27|2010-09-14|Cisco Technology, Inc.|Applying quality of service to application messages in network elements based on roles and status|
    JP4126707B2|2006-07-28|2008-07-30|インターナショナル・ビジネス・マシーンズ・コーポレーション|Technology for analyzing the state of information systems|
    WO2008022036A2|2006-08-10|2008-02-21|Washington University|Method and apparatus for protein sequence alignment using fpga devices|
    US8531954B2|2006-08-22|2013-09-10|Centurylink Intellectual Property Llc|System and method for handling reservation requests with a connection admission control engine|
    US8619600B2|2006-08-22|2013-12-31|Centurylink Intellectual Property Llc|System and method for establishing calls over a call path having best path metrics|
    US9479341B2|2006-08-22|2016-10-25|Centurylink Intellectual Property Llc|System and method for initiating diagnostics on a packet network node|
    US8750158B2|2006-08-22|2014-06-10|Centurylink Intellectual Property Llc|System and method for differentiated billing|
    US7843831B2|2006-08-22|2010-11-30|Embarq Holdings Company Llc|System and method for routing data on a packet network|
    US8576722B2|2006-08-22|2013-11-05|Centurylink Intellectual Property Llc|System and method for modifying connectivity fault management packets|
    US8064391B2|2006-08-22|2011-11-22|Embarq Holdings Company, Llc|System and method for monitoring and optimizing network performance to a wireless device|
    US8238253B2|2006-08-22|2012-08-07|Embarq Holdings Company, Llc|System and method for monitoring interlayer devices and optimizing network performance|
    US8537695B2|2006-08-22|2013-09-17|Centurylink Intellectual Property Llc|System and method for establishing a call being received by a trunk on a packet network|
    US8223655B2|2006-08-22|2012-07-17|Embarq Holdings Company, Llc|System and method for provisioning resources of a packet network based on collected network performance information|
    US8307065B2|2006-08-22|2012-11-06|Centurylink Intellectual Property Llc|System and method for remotely controlling network operators|
    US8743703B2|2006-08-22|2014-06-03|Centurylink Intellectual Property Llc|System and method for tracking application resource usage|
    US8130793B2|2006-08-22|2012-03-06|Embarq Holdings Company, Llc|System and method for enabling reciprocal billing for different types of communications over a packet network|
    US8274905B2|2006-08-22|2012-09-25|Embarq Holdings Company, Llc|System and method for displaying a graph representative of network performance over a time period|
    US8144587B2|2006-08-22|2012-03-27|Embarq Holdings Company, Llc|System and method for load balancing network resources using a connection admission control engine|
    US8407765B2|2006-08-22|2013-03-26|Centurylink Intellectual Property Llc|System and method for restricting access to network performance information tables|
    US8224255B2|2006-08-22|2012-07-17|Embarq Holdings Company, Llc|System and method for managing radio frequency windows|
    US8015294B2|2006-08-22|2011-09-06|Embarq Holdings Company, LP|Pin-hole firewall for communicating data packets on a packet network|
    US7684332B2|2006-08-22|2010-03-23|Embarq Holdings Company, Llc|System and method for adjusting the window size of a TCP packet through network elements|
    US8041806B2|2006-09-11|2011-10-18|Alcatel Lucent|Targeted electronic content delivery control systems and methods|
    US8078972B2|2006-09-15|2011-12-13|Citrix Systems, Inc.|Methods and interfaces for displaying performance data related to a current remote access session|
    US7978617B2|2006-09-15|2011-07-12|Citrix Systems, Inc.|Methods for providing performance improvement recommendations|
    US8194643B2|2006-10-19|2012-06-05|Embarq Holdings Company, Llc|System and method for monitoring the connection of an end-user to a remote network|
    US8289965B2|2006-10-19|2012-10-16|Embarq Holdings Company, Llc|System and method for establishing a communications session with an end-user based on the state of a network connection|
    US8189468B2|2006-10-25|2012-05-29|Embarq Holdings, Company, LLC|System and method for regulating messages between networks|
    US8326819B2|2006-11-13|2012-12-04|Exegy Incorporated|Method and system for high performance data metatagging and data indexing using coprocessors|
    US7660793B2|2006-11-13|2010-02-09|Exegy Incorporated|Method and system for high performance integration, processing and searching of structured and unstructured data using coprocessors|
    US20080112399A1|2006-11-13|2008-05-15|British Telecommunications Public Limited Company|Telecommunications system|
    JP4412322B2|2006-12-26|2010-02-10|ソニー株式会社|Communication system and method for providing information for detecting failure thereof|
    US20080298271A1|2007-02-05|2008-12-04|Fujitsu Limited|Communication-quality measuring apparatus, communication-quality measuring method, and computer program|
    JP5092768B2|2007-02-05|2012-12-05|富士通株式会社|Communication quality measuring apparatus, communication quality measuring method, and computer program|
    US20080188191A1|2007-02-06|2008-08-07|British Telecommunications Public Limited Company|Network monitoring system|
    US7617337B1|2007-02-06|2009-11-10|Avaya Inc.|VoIP quality tradeoff system|
    US7779127B2|2007-03-09|2010-08-17|Hewlett-Packard Development Company, L.P.|System and method for determining a subset of transactions of a computing system for use in determing resource costs|
    US8239275B1|2007-03-15|2012-08-07|Philip Scott Lyren|Methods and apparatus for generating recommendations for gifts|
    GB2459814B8|2007-03-20|2012-07-11|Fujitsu Ltd|Measuring method, measuring device, and computer program|
    EP2127191A4|2007-03-26|2011-04-13|Intel Corp|Method and apparatus of testing data communication performance of a network system|
    US8381268B2|2007-05-11|2013-02-19|Cisco Technology, Inc.|Network authorization status notification|
    US8832495B2|2007-05-11|2014-09-09|Kip Cr P1 Lp|Method and system for non-intrusive monitoring of library components|
    WO2008155440A1|2007-06-19|2008-12-24|Aito Technologies Oy|An arrangement and a related method for providing business assurance in communication networks|
    DE102007041143B4|2007-08-30|2010-04-08|Siemens Enterprise Communications Gmbh & Co. Kg|Method for analyzing concurrently transmitted, encrypted data streams in IP networks|
    EP2186250B1|2007-08-31|2019-03-27|IP Reservoir, LLC|Method and apparatus for hardware-accelerated encryption/decryption|
    US20090073885A1|2007-09-17|2009-03-19|Rehan Jalil|Method, system and apparatus for tracking user behavior in a wireless communication network|
    US8812710B2|2007-10-05|2014-08-19|At&T Intellectual Property I, L.P.|Video content monitoring and display based on popularity|
    US8326970B2|2007-11-05|2012-12-04|Hewlett-Packard Development Company, L.P.|System and method for modeling a session-based system with a transaction-based analytic model|
    US8027267B2|2007-11-06|2011-09-27|Avaya Inc|Network condition capture and reproduction|
    US20090177626A1|2008-01-05|2009-07-09|Robert Lottero|Apparatus and method for investigative analysis of law enforcement cases|
    US10229453B2|2008-01-11|2019-03-12|Ip Reservoir, Llc|Method and system for low latency basket calculation|
    US7817636B2|2008-01-30|2010-10-19|Cisco Technology, Inc.|Obtaining information on forwarding decisions for a packet flow|
    US8650241B2|2008-02-01|2014-02-11|Kip Cr P1 Lp|System and method for identifying failing drives or media in media library|
    US7908366B2|2008-02-01|2011-03-15|Crossroads Systems, Inc.|Media library monitoring system and method|
    US8645328B2|2008-02-04|2014-02-04|Kip Cr P1 Lp|System and method for archive verification|
    US9015005B1|2008-02-04|2015-04-21|Kip Cr P1 Lp|Determining, displaying, and using tape drive session information|
    US7974215B1|2008-02-04|2011-07-05|Crossroads Systems, Inc.|System and method of network diagnosis|
    JP4841573B2|2008-02-07|2011-12-21|三菱電機株式会社|Baseband device|
    US7769002B2|2008-02-15|2010-08-03|Intel Corporation|Constrained dynamic path selection among multiple communication interfaces|
    US8601090B1|2008-03-31|2013-12-03|Amazon Technologies, Inc.|Network resource identification|
    US8533293B1|2008-03-31|2013-09-10|Amazon Technologies, Inc.|Client side cache management|
    US8321568B2|2008-03-31|2012-11-27|Amazon Technologies, Inc.|Content management|
    US8156243B2|2008-03-31|2012-04-10|Amazon Technologies, Inc.|Request routing|
    US7962597B2|2008-03-31|2011-06-14|Amazon Technologies, Inc.|Request routing based on class|
    US8606996B2|2008-03-31|2013-12-10|Amazon Technologies, Inc.|Cache optimization|
    US7970820B1|2008-03-31|2011-06-28|Amazon Technologies, Inc.|Locality based content distribution|
    US8447831B1|2008-03-31|2013-05-21|Amazon Technologies, Inc.|Incentive driven content delivery|
    US8068425B2|2008-04-09|2011-11-29|Embarq Holdings Company, Llc|System and method for using network performance information to determine improved measures of path states|
    US8374986B2|2008-05-15|2013-02-12|Exegy Incorporated|Method and system for accelerated stream processing|
    US7925782B2|2008-06-30|2011-04-12|Amazon Technologies, Inc.|Request routing using network computing components|
    US9912740B2|2008-06-30|2018-03-06|Amazon Technologies, Inc.|Latency measurement in resource requests|
    US20100017507A1|2008-07-15|2010-01-21|Fluke Corporation|Method and apparatus of combining multiple packets into protocol transactions with request and response detail for enhanced troubleshooting in a line rate network monitoring device|
    US8095507B2|2008-08-08|2012-01-10|Oracle International Corporation|Automated topology-based statistics monitoring and performance analysis|
    US8218751B2|2008-09-29|2012-07-10|Avaya Inc.|Method and apparatus for identifying and eliminating the source of background noise in multi-party teleconferences|
    US20100114516A1|2008-11-05|2010-05-06|Tektronix, Inc.|Method and Apparatus for Time Synchronization of Events for Multiple Instruments|
    US8521880B1|2008-11-17|2013-08-27|Amazon Technologies, Inc.|Managing content delivery network service providers|
    US7991910B2|2008-11-17|2011-08-02|Amazon Technologies, Inc.|Updating routing information based on client location|
    US8122098B1|2008-11-17|2012-02-21|Amazon Technologies, Inc.|Managing content delivery network service providers by a content broker|
    US8065417B1|2008-11-17|2011-11-22|Amazon Technologies, Inc.|Service provider registration by a content broker|
    US8028090B2|2008-11-17|2011-09-27|Amazon Technologies, Inc.|Request routing utilizing client location information|
    US8060616B1|2008-11-17|2011-11-15|Amazon Technologies, Inc.|Managing CDN registration by a storage provider|
    US8732309B1|2008-11-17|2014-05-20|Amazon Technologies, Inc.|Request routing utilizing cost information|
    US8073940B1|2008-11-17|2011-12-06|Amazon Technologies, Inc.|Managing content delivery network service providers|
    GB2466207B|2008-12-11|2013-07-24|Advanced Risc Mach Ltd|Use of statistical representations of traffic flow in a data processing system|
    WO2010077829A1|2008-12-15|2010-07-08|Exegy Incorporated|Method and apparatus for high-speed processing of financial market depth data|
    JP5221332B2|2008-12-27|2013-06-26|株式会社東芝|Memory system|
    US8756341B1|2009-03-27|2014-06-17|Amazon Technologies, Inc.|Request routing utilizing popularity information|
    US8412823B1|2009-03-27|2013-04-02|Amazon Technologies, Inc.|Managing tracking information entries in resource cache components|
    US8688837B1|2009-03-27|2014-04-01|Amazon Technologies, Inc.|Dynamically translating resource identifiers for request routing using popularity information|
    US8521851B1|2009-03-27|2013-08-27|Amazon Technologies, Inc.|DNS query processing using resource identifiers specifying an application broker|
    US8537484B2|2009-04-16|2013-09-17|Spectra Logic Corporation|Tape data assessment|
    US8767328B2|2009-04-16|2014-07-01|Spectra Logic Corporation|Certifying a data storage medium|
    US10326848B2|2009-04-17|2019-06-18|Empirix Inc.|Method for modeling user behavior in IP networks|
    US8782236B1|2009-06-16|2014-07-15|Amazon Technologies, Inc.|Managing resources using resource expiration data|
    EP2271058A1|2009-07-03|2011-01-05|Siemens Aktiengesellschaft|Device and method of distributing and forwarding requirements to a number of web servers in an industrial automation system|
    US8788652B2|2009-07-27|2014-07-22|Ixia|Real world network testing combining lower layer network tests, application layer tests and interdependent interactions|
    US8456530B2|2009-08-18|2013-06-04|Arcom Digital, Llc|Methods and apparatus for detecting and locating leakage of digital signals|
    US8397073B1|2009-09-04|2013-03-12|Amazon Technologies, Inc.|Managing secure content in a content delivery network|
    US9866633B1|2009-09-25|2018-01-09|Kip Cr P1 Lp|System and method for eliminating performance impact of information collection from media drives|
    US8433771B1|2009-10-02|2013-04-30|Amazon Technologies, Inc.|Distribution network with forward resource propagation|
    US20110080829A1|2009-10-05|2011-04-07|Vss Monitoring, Inc.|Method, apparatus and system for monitoring network conditions via a stacked topology of network captured traffic distribution devices|
    US20110119370A1|2009-11-17|2011-05-19|Microsoft Corporation|Measuring network performance for cloud services|
    CN102076027B|2009-11-19|2014-04-30|中兴通讯股份有限公司|System, device and method for counting PPP negotiation states in wireless system|
    US8843787B1|2009-12-16|2014-09-23|Kip Cr P1 Lp|System and method for archive verification according to policies|
    CN101729202B|2009-12-21|2013-04-03|杭州合众信息技术股份有限公司|Device and method for reliable transmission of pure one-way data based on light splitting technology|
    US9495338B1|2010-01-28|2016-11-15|Amazon Technologies, Inc.|Content distribution network|
    US8477648B2|2010-02-16|2013-07-02|Vss Monitoring, Inc.|Systems, apparatus, and methods for monitoring network capacity|
    CN102823203B|2010-02-18|2015-11-25|日本电气株式会社|Quality deterioration partial analysis system, quality deterioration partial analysis equipment, quality deterioration partial analysis method and quality deterioration partial analysis program|
    US8291058B2|2010-02-19|2012-10-16|Intrusion, Inc.|High speed network data extractor|
    US8898582B2|2010-03-10|2014-11-25|Salesforce.Com, Inc.|Configurable highlights panel for display of database records|
    US8582454B2|2010-04-08|2013-11-12|Netscout Systems, Inc.|Real-time adaptive processing of network data packets for analysis|
    JP5630070B2|2010-05-14|2014-11-26|富士通株式会社|Relay device, program and method|
    WO2012016327A1|2010-08-06|2012-02-09|Neuralitic Systems|A method and system for generating metrics representative of ip data traffic from ip data records|
    US8756272B1|2010-08-26|2014-06-17|Amazon Technologies, Inc.|Processing encoded content|
    US8577992B1|2010-09-28|2013-11-05|Amazon Technologies, Inc.|Request routing management based on network components|
    US10097398B1|2010-09-28|2018-10-09|Amazon Technologies, Inc.|Point of presence management in request routing|
    US10958501B1|2010-09-28|2021-03-23|Amazon Technologies, Inc.|Request routing information based on client IP groupings|
    US8930513B1|2010-09-28|2015-01-06|Amazon Technologies, Inc.|Latency measurement in resource requests|
    US9003035B1|2010-09-28|2015-04-07|Amazon Technologies, Inc.|Point of presence management in request routing|
    US9712484B1|2010-09-28|2017-07-18|Amazon Technologies, Inc.|Managing request routing information utilizing client identifiers|
    US8924528B1|2010-09-28|2014-12-30|Amazon Technologies, Inc.|Latency measurement in resource requests|
    US8938526B1|2010-09-28|2015-01-20|Amazon Technologies, Inc.|Request routing management based on network components|
    US8468247B1|2010-09-28|2013-06-18|Amazon Technologies, Inc.|Point of presence management in request routing|
    US9407681B1|2010-09-28|2016-08-02|Amazon Technologies, Inc.|Latency measurement in resource requests|
    US8819283B2|2010-09-28|2014-08-26|Amazon Technologies, Inc.|Request routing in a networked environment|
    US9483313B2|2010-10-19|2016-11-01|Microsoft Technology Licensing, Llc|Availability management for reference data services|
    US8452874B2|2010-11-22|2013-05-28|Amazon Technologies, Inc.|Request routing processing|
    US8626950B1|2010-12-03|2014-01-07|Amazon Technologies, Inc.|Request routing processing|
    US9391949B1|2010-12-03|2016-07-12|Amazon Technologies, Inc.|Request routing processing|
    JP6045505B2|2010-12-09|2016-12-14|アイピー レザボア，エルエルシー．ＩＰ Ｒｅｓｅｒｖｏｉｒ， ＬＬＣ．|Method and apparatus for managing orders in a financial market|
    JP2012141723A|2010-12-28|2012-07-26|Toshiba Tec Corp|Information terminal and program|
    US8891385B2|2011-01-04|2014-11-18|Alcatel Lucent|Validating ethernet virtual connection service|
    EP2661941B1|2011-01-06|2015-07-22|Telefonaktiebolaget LM Ericsson |Method of routing a session from a calling party in a serving communication network of the calling party to a called party|
    US8526470B2|2011-07-05|2013-09-03|Ixia|Synchronized commands for network testing|
    DE102011082969B4|2011-09-19|2015-04-30|Siemens Aktiengesellschaft|Method for operating a communication network and network arrangement|
    US8495387B2|2011-10-31|2013-07-23|Spectra Logic Corporation|Encryption redundancy in a storage element array|
    US9444700B2|2011-11-02|2016-09-13|Imagine Communications Corp.|Network analysis device and method|
    CN105610312A|2011-11-11|2016-05-25|台达电子企业管理（上海）有限公司|Cascaded frequency converter and power unit|
    US8583990B2|2011-11-30|2013-11-12|Spectra Logic Corporation|Error correction in a storage element array|
    US8707100B2|2011-12-13|2014-04-22|Ixia|Testing a network using randomly distributed commands|
    US8904009B1|2012-02-10|2014-12-02|Amazon Technologies, Inc.|Dynamic content delivery|
    US10021179B1|2012-02-21|2018-07-10|Amazon Technologies, Inc.|Local resource delivery network|
    JP5811891B2|2012-02-24|2015-11-11|富士通株式会社|Packet transfer delay measurement system|
    US10095994B2|2012-03-19|2018-10-09|Sap Se|Service level agreement translation for service oriented systems|
    US9172674B1|2012-03-21|2015-10-27|Amazon Technologies, Inc.|Managing request routing information utilizing performance information|
    US9237082B2|2012-03-26|2016-01-12|Hewlett Packard Enterprise Development Lp|Packet descriptor trace indicators|
    US10650452B2|2012-03-27|2020-05-12|Ip Reservoir, Llc|Offload processing of data packets|
    US10121196B2|2012-03-27|2018-11-06|Ip Reservoir, Llc|Offload processing of data packets containing financial market data|
    US9990393B2|2012-03-27|2018-06-05|Ip Reservoir, Llc|Intelligent feed switch|
    US8788659B1|2012-03-29|2014-07-22|Google Inc.|Playlist analytics|
    US10623408B1|2012-04-02|2020-04-14|Amazon Technologies, Inc.|Context sensitive object management|
    CN104487930A|2012-05-09|2015-04-01|苹果公司|Device, method, and graphical user interface for moving and dropping a user interface object|
    WO2013169851A2|2012-05-09|2013-11-14|Yknots Industries Llc|Device, method, and graphical user interface for facilitating user interaction with controls in a user interface|
    US8966321B2|2012-05-09|2015-02-24|Ixia|Logical port and layer protocol test configuration resource manager|
    WO2013169843A1|2012-05-09|2013-11-14|Yknots Industries Llc|Device, method, and graphical user interface for manipulating framed graphical objects|
    EP2975512B1|2012-05-09|2019-02-06|Apple Inc.|Device and method for displaying a virtual loupe in response to a user contact|
    DE112013002387T5|2012-05-09|2015-02-12|Apple Inc.|Apparatus, method and graphical user interface for providing tactile feedback for operations in a user interface|
    CN104471521B|2012-05-09|2018-10-23|苹果公司|For providing the equipment, method and graphic user interface of feedback for the state of activation for changing user interface object|
    JP6002836B2|2012-05-09|2016-10-05|アップル インコーポレイテッド|Device, method, and graphical user interface for transitioning between display states in response to a gesture|
    KR101956082B1|2012-05-09|2019-03-11|애플 인크.|Device, method, and graphical user interface for selecting user interface objects|
    WO2013169865A2|2012-05-09|2013-11-14|Yknots Industries Llc|Device, method, and graphical user interface for moving a user interface object based on an intensity of a press input|
    WO2013169849A2|2012-05-09|2013-11-14|Industries Llc Yknots|Device, method, and graphical user interface for displaying user interface objects corresponding to an application|
    WO2013169842A2|2012-05-09|2013-11-14|Yknots Industries Llc|Device, method, and graphical user interface for selecting object within a group of objects|
    WO2013169845A1|2012-05-09|2013-11-14|Yknots Industries Llc|Device, method, and graphical user interface for scrolling nested regions|
    WO2013169875A2|2012-05-09|2013-11-14|Yknots Industries Llc|Device, method, and graphical user interface for displaying content associated with a corresponding affordance|
    US9154551B1|2012-06-11|2015-10-06|Amazon Technologies, Inc.|Processing DNS queries to identify pre-processing information|
    US10846788B1|2012-06-28|2020-11-24|Amazon Technologies, Inc.|Resource group traffic rate service|
    US9167445B2|2012-08-24|2015-10-20|Ascom Network Testing Ab|Systems and methods for measuring available bandwidth in mobile telecommunications networks|
    US9525659B1|2012-09-04|2016-12-20|Amazon Technologies, Inc.|Request routing utilizing point of presence load information|
    US9135048B2|2012-09-20|2015-09-15|Amazon Technologies, Inc.|Automated profiling of resource usage|
    US9323577B2|2012-09-20|2016-04-26|Amazon Technologies, Inc.|Automated profiling of resource usage|
    KR102343418B1|2012-10-19|2021-12-23|에스케이텔레콤 주식회사|Method and apparatus for controling traffic using open flow switches and controller|
    US9633093B2|2012-10-23|2017-04-25|Ip Reservoir, Llc|Method and apparatus for accelerated format translation of data in a delimited data format|
    US10102260B2|2012-10-23|2018-10-16|Ip Reservoir, Llc|Method and apparatus for accelerated data translation using record layout detection|
    WO2014066416A2|2012-10-23|2014-05-01|Ip Reservoir, Llc|Method and apparatus for accelerated format translation of data in a delimited data format|
    US9438517B2|2012-10-30|2016-09-06|Viavi Solutions Inc.|Method and system for identifying matching packets|
    US9356847B2|2012-10-31|2016-05-31|Keysight Technologies, Inc.|Method for monitoring and displaying high speed bus performance|
    US10205698B1|2012-12-19|2019-02-12|Amazon Technologies, Inc.|Source-dependent address resolution|
    CN104903835B|2012-12-29|2018-05-04|苹果公司|For abandoning equipment, method and the graphic user interface of generation tactile output for more contact gestures|
    KR102301592B1|2012-12-29|2021-09-10|애플 인크.|Device, method, and graphical user interface for navigating user interface hierachies|
    EP2939095B1|2012-12-29|2018-10-03|Apple Inc.|Device, method, and graphical user interface for moving a cursor according to a change in an appearance of a control icon with simulated three-dimensional characteristics|
    CN104885050B|2012-12-29|2017-12-08|苹果公司|For determining the equipment, method and the graphic user interface that are rolling or selection content|
    KR101958517B1|2012-12-29|2019-03-14|애플 인크.|Device, method, and graphical user interface for transitioning between touch input to display output relationships|
    US9892026B2|2013-02-01|2018-02-13|Ab Initio Technology Llc|Data records selection|
    CN103220188B|2013-04-11|2016-08-03|江苏中科惠软信息技术有限公司|A kind of HTTP data acquisition equipment|
    US9294391B1|2013-06-04|2016-03-22|Amazon Technologies, Inc.|Managing network computing components utilizing request routing|
    US10003536B2|2013-07-25|2018-06-19|Grigore Raileanu|System and method for managing bandwidth usage rates in a packet-switched network|
    WO2015046697A1|2013-09-24|2015-04-02|Öt¯Ö»¸ÒªðÖbЀÖndÖ¸©ÔmmÖo©ÖºyÖo©|Apparatus for detecting abnormal increase of control packets, method therefor, and recording medium|
    KR101564643B1|2013-10-17|2015-11-09|한국전자통신연구원|Network apparatus and selective information monitoring method using the same|
    KR101490649B1|2014-01-22|2015-02-06|주식회사 퓨쳐시스템|System and method for deciding symptom of network security device|
    KR101485732B1|2014-01-22|2015-01-22|주식회사 퓨쳐시스템|System and method for tracking issue of network security device|
    KR101491731B1|2014-01-22|2015-02-09|에스케이 텔레콤주식회사|Method and Apparatus for Improving Security of Network and Communication Relay Apparatus Thereof|
    WO2015139727A1|2014-03-17|2015-09-24|Telefonaktiebolaget L M Ericsson |Application-aware data charging|
    GB2541577A|2014-04-23|2017-02-22|Ip Reservoir Llc|Method and apparatus for accelerated data translation|
    US9813259B2|2014-05-13|2017-11-07|Cisco Technology, Inc.|Probing available bandwidth along a network path|
    CN106461252B|2014-05-15|2019-07-16|艾默生电气公司|Heating, ventilation or the diagnosis of air handling system air filter and monitoring|
    US10309677B2|2014-05-15|2019-06-04|Emerson Climate Technolgoies, Inc.|HVAC system air filter diagnostics and monitoring|
    US9379959B1|2014-07-10|2016-06-28|Juniper Networks, Inc.|System and method for verifying the functionality of network paths|
    GB2532032B|2014-11-05|2017-10-25|Openwave Mobility Inc|Congestion monitoring|
    US10924408B2|2014-11-07|2021-02-16|Noction, Inc.|System and method for optimizing traffic in packet-switched networks with internet exchanges|
    US9608879B2|2014-12-02|2017-03-28|At&T Intellectual Property I, L.P.|Methods and apparatus to collect call packets in a communications network|
    US10033627B1|2014-12-18|2018-07-24|Amazon Technologies, Inc.|Routing mode and point-of-presence selection service|
    US10091096B1|2014-12-18|2018-10-02|Amazon Technologies, Inc.|Routing mode and point-of-presence selection service|
    US10097448B1|2014-12-18|2018-10-09|Amazon Technologies, Inc.|Routing mode and point-of-presence selection service|
    US10348428B2|2014-12-23|2019-07-09|Intel Corporation|Techniques for synchronized execution of a command at network fabric nodes|
    US9614853B2|2015-01-20|2017-04-04|Enzoo, Inc.|Session security splitting and application profiler|
    US9769070B2|2015-01-28|2017-09-19|Maxim Basunov|System and method of providing a platform for optimizing traffic through a computer network with distributed routing domains interconnected through data center interconnect links|
    JP6198195B2|2015-02-17|2017-09-20|日本電信電話株式会社|Estimation apparatus, estimation method, and program|
    US9645732B2|2015-03-08|2017-05-09|Apple Inc.|Devices, methods, and graphical user interfaces for displaying and using menus|
    US10048757B2|2015-03-08|2018-08-14|Apple Inc.|Devices and methods for controlling media presentation|
    US10095396B2|2015-03-08|2018-10-09|Apple Inc.|Devices, methods, and graphical user interfaces for interacting with a control object while dragging another object|
    US9785305B2|2015-03-19|2017-10-10|Apple Inc.|Touch input cursor manipulation|
    US10225326B1|2015-03-23|2019-03-05|Amazon Technologies, Inc.|Point of presence based data uploading|
    US9819567B1|2015-03-30|2017-11-14|Amazon Technologies, Inc.|Traffic surge management for points of presence|
    US9887931B1|2015-03-30|2018-02-06|Amazon Technologies, Inc.|Traffic surge management for points of presence|
    US9887932B1|2015-03-30|2018-02-06|Amazon Technologies, Inc.|Traffic surge management for points of presence|
    US9832141B1|2015-05-13|2017-11-28|Amazon Technologies, Inc.|Routing based request correlation|
    CN104931752A|2015-05-29|2015-09-23|南车株洲电力机车研究所有限公司|Current transformer waveform monitoring device and current transformer control system|
    US9860451B2|2015-06-07|2018-01-02|Apple Inc.|Devices and methods for capturing and interacting with enhanced digital images|
    US9674426B2|2015-06-07|2017-06-06|Apple Inc.|Devices and methods for capturing and interacting with enhanced digital images|
    US10616179B1|2015-06-25|2020-04-07|Amazon Technologies, Inc.|Selective routing of domain name systemrequests|
    US10097566B1|2015-07-31|2018-10-09|Amazon Technologies, Inc.|Identifying targets of network attacks|
    US20170045981A1|2015-08-10|2017-02-16|Apple Inc.|Devices and Methods for Processing Touch Inputs Based on Their Intensities|
    US9742795B1|2015-09-24|2017-08-22|Amazon Technologies, Inc.|Mitigating network attacks|
    US9794281B1|2015-09-24|2017-10-17|Amazon Technologies, Inc.|Identifying sources of network attacks|
    US9774619B1|2015-09-24|2017-09-26|Amazon Technologies, Inc.|Mitigating network attacks|
    US10313194B2|2015-09-28|2019-06-04|International Business Machines Corporation|Flexibly deployable network analyzer|
    US10942943B2|2015-10-29|2021-03-09|Ip Reservoir, Llc|Dynamic field data translation to support high performance stream data processing|
    US10044577B2|2015-11-04|2018-08-07|International Business Machines Corporation|Visualization of cyclical patterns in metric data|
    US10270878B1|2015-11-10|2019-04-23|Amazon Technologies, Inc.|Routing for origin-facing points of presence|
    US10257307B1|2015-12-11|2019-04-09|Amazon Technologies, Inc.|Reserved cache space in content delivery networks|
    US10049051B1|2015-12-11|2018-08-14|Amazon Technologies, Inc.|Reserved cache space in content delivery networks|
    US10348639B2|2015-12-18|2019-07-09|Amazon Technologies, Inc.|Use of virtual endpoints to improve data transmission rates|
    KR101641637B1|2016-02-29|2016-07-21|주식회사 티맥스 소프트|Method and application performance monitoring device for monitoring transaction by analyzing packets in the packet processing system|
    US10142198B2|2016-03-07|2018-11-27|Autodesk, Inc.|Node-centric analysis of dynamic networks|
    US10075551B1|2016-06-06|2018-09-11|Amazon Technologies, Inc.|Request management for hierarchical cache|
    CN107528870B|2016-06-22|2019-08-23|腾讯科技（深圳）有限公司|A kind of collecting method and its equipment|
    US10110694B1|2016-06-29|2018-10-23|Amazon Technologies, Inc.|Adaptive transfer rate for retrieving content from a server|
    US10776535B2|2016-07-11|2020-09-15|Keysight Technologies SingaporePte. Ltd.|Methods, systems and computer readable media for testing network devices using variable traffic burst profiles|
    US9992086B1|2016-08-23|2018-06-05|Amazon Technologies, Inc.|External health checking of virtual private cloud network environments|
    US10033691B1|2016-08-24|2018-07-24|Amazon Technologies, Inc.|Adaptive resolution of domain name requests in virtual private cloud network environments|
    US10218986B2|2016-09-26|2019-02-26|Google Llc|Frame accurate splicing|
    US10469513B2|2016-10-05|2019-11-05|Amazon Technologies, Inc.|Encrypted network addresses|
    US10263873B2|2016-11-09|2019-04-16|Corvil Limited|Method and system for determining short-timescale traffic rates from time-stamped packet data|
    US10372499B1|2016-12-27|2019-08-06|Amazon Technologies, Inc.|Efficient region selection system for executing request-driven code|
    US10831549B1|2016-12-27|2020-11-10|Amazon Technologies, Inc.|Multi-region request-driven code execution system|
    US10938884B1|2017-01-30|2021-03-02|Amazon Technologies, Inc.|Origin server cloaking using virtual private cloud network environments|
    US10503613B1|2017-04-21|2019-12-10|Amazon Technologies, Inc.|Efficient serving of resources during server unavailability|
    CN107147535A|2017-06-02|2017-09-08|中国人民解放军理工大学|A kind of distributed network measurement data statistical analysis technique|
    US11075987B1|2017-06-12|2021-07-27|Amazon Technologies, Inc.|Load estimating content delivery network|
    US10447648B2|2017-06-19|2019-10-15|Amazon Technologies, Inc.|Assignment of a POP to a DNS resolver based on volume of communications over a link between client devices and the POP|
    US20190020696A1|2017-07-11|2019-01-17|Chatalyze, Inc.|Communications system with interactive and digital engagement functions and digital object inscription workflows|
    US20190018723A1|2017-07-11|2019-01-17|Entit Software Llc|Aggregating metric scores|
    WO2019117052A1|2017-12-13|2019-06-20|日本電気株式会社|Information processing device, information processing system, information processing method, and recording medium|
    US10592578B1|2018-03-07|2020-03-17|Amazon Technologies, Inc.|Predictive content push-enabled content delivery network|
    US10862852B1|2018-11-16|2020-12-08|Amazon Technologies, Inc.|Resolution of domain name requests in heterogeneous network environments|
    US10897412B2|2018-11-16|2021-01-19|Cisco Technology, Inc.|Bifocal timeline graphs for network analytics|
    CN109506318A|2018-11-19|2019-03-22|珠海格力电器股份有限公司|A kind of method and device of fault alarm|
    US11025747B1|2018-12-12|2021-06-01|Amazon Technologies, Inc.|Content request pattern-based routing system|
    US11178107B2|2019-09-30|2021-11-16|Michael Schloss|System and method for detecting surreptitious packet rerouting|
    CN111641532B|2020-03-30|2022-02-18|北京红山信息科技研究院有限公司|Communication quality detection method, device, server and storage medium|
    法律状态:
    2020-05-12| NUG| Patent has lapsed|
    优先权:
    申请号 | 申请日 | 专利标题
    US10971898P| true| 1998-11-24|1998-11-24|
    PCT/US1999/027969|WO2000031963A1|1998-11-24|1999-11-23|Apparatus and method for collecting and analyzing communications data|
    [返回顶部]