Search Images Maps Play YouTube News Gmail Drive More »
Sign in
Screen reader users: click this link for accessible mode. Accessible mode has the same essential features but works better with your reader.

Patents

  1. Advanced Patent Search
Publication numberUS20060023638 A1
Publication typeApplication
Application numberUS 11/193,004
Publication dateFeb 2, 2006
Filing dateJul 29, 2005
Priority dateJul 29, 2004
Also published asUS7986632, US20100020715
Publication number11193004, 193004, US 2006/0023638 A1, US 2006/023638 A1, US 20060023638 A1, US 20060023638A1, US 2006023638 A1, US 2006023638A1, US-A1-20060023638, US-A1-2006023638, US2006/0023638A1, US2006/023638A1, US20060023638 A1, US20060023638A1, US2006023638 A1, US2006023638A1
InventorsJeffrey Monaco, Michele McGough
Original AssigneeSolutions4Networks
Export CitationBiBTeX, EndNote, RefMan
External Links: USPTO, USPTO Assignment, Espacenet
Proactive network analysis system
US 20060023638 A1
Abstract
A proactive network analysis system is a single unit for diagnosing network problems, measuring network performance, and monitoring network status in a comprehensive manner. The system is a compilation of individual tools including a distributed network packet capture data stream collector; a traffic analyzer; a performance graphing unit; a syslog recorder analyzer and archiving unit; a system availability monitor; a device configuration archiving unit; and a throughput measurement tool. The system can further provide an access list generator, an access list analyzer, a router DNS name generator and a service level agreement measurement device.
Images(4)
Previous page
Next page
Claims(20)
1. A proactive network analysis system providing an integrated compilation of network tools for diagnosing network problems, measuring network performance, and monitoring network status, the system comprising:
a distributed network packet capture data stream collector providing selective recordings of network traffic;
a traffic analyzer providing selected samples of specified end-to-end paths, wherein the sampling is at one of the network layer, the IP layer, OS layer, or application layer; and
a syslog recorder analyzer and archiving unit to collect and summarize log events from the network.
2. The integrated proactive network analysis system of claim 1 further comprising an access list generating tool which generates the correct Access List entries to implement the desired policies.
3. The integrated proactive network analysis system of claim 1 further comprising an Access List Analyzer tool which can review an Access List and indicate which Access List entries are inconsistent.
4. The integrated proactive network analysis system of claim 1 further comprising a Layer 3 Topology mapping tool to map out the layer 3 topology of a given network, and to display the data in tabular form, organized on a ‘WAN Island’ approach.
5. The integrated proactive network analysis system of claim 1 further comprising a remote access server identification tool to identify Remote Access Servers on the network, wherein the tool uses the following process:
a. Check each known Layer 3 switch,
b. On the router, get the ARP cache,
c. Find any MAC address that has multiple IP addresses associated with it,
d. Ignore known MAC addresses or vendor IDs,
e. Ping the IP addresses, an check the TTL on the resultant response, wherein the primary server will have an TTL that is greater than the remotely attached devices and based on the differing values of the TTL field, a RAS server can be identified with high probability.
6. The integrated proactive network analysis system of claim 1 further comprising an Intelligent Content Filter to filter and disallow bad webpages, wherein bad webpages are identified by their content using a ‘bayesian’ analysis that determines bad webpages based upon the frequency of bad content.
7. The integrated proactive network analysis system of claim 1 wherein the system is configured to issue alert messages based on the text of syslog messages and configured to accept SNMP traps.
8. The integrated proactive network analysis system of claim 1 further including a HTTP Latency Check tool that allows users to specify a URL, and get an exact measurement of the time it takes for the web page to load.
9. The integrated proactive network analysis system of claim 1 further including a network mapper for network exploration and security auditing, wherein the network mapper uses raw IP packets to determine at least what hosts are available on the network, what services by application name and version those hosts are offering, what operating systems and OS versions they are running, and what type of packet filters and firewalls are in use.
10. The integrated proactive network analysis system of claim 1 wherein the system supports a patch mechanism, wherein the patch mechanism allows users to backup their settings, migrate their setting to other similar network management systems and import their settings from other similar network management systems.
11. The integrated proactive network analysis system of claim 1 further including a service level agreement tool that tracks the level of service provided by a network provider and compares the result to the promises of the service level agreement.
12. The integrated proactive network analysis system of claim 1 further including a DNS name generator tool that takes, as input, a router configuration file and outputs a meaningful name for each of the IP addresses in the configuration file.
13. The integrated proactive network analysis system of claim 1 further including a Generating Access List tool that generates the correct Access List entries to implement the desired policies and provides reports that can be presented to the Security Audit staff for their review and approval of those policies.
14. The integrated proactive network analysis system of claim 1 further including a Bandwidth estimation tool.
15. The integrated proactive network analysis system of claim 1 further including a device configuration archiving unit configured to document and automate network device configuration management allowing the network administrator to gather a baseline of current configurations, audit changes in configurations, rollback to previous known good configurations in the event of a disaster, and perform a risk assessment or impact analysis of planned changes.
16. The integrated proactive network analysis system of claim 1 further including a system availability monitor which continuously monitors the components of the network testing specific component availability, wherein in the event of a failure or unavailability of a component, the unavailability of the component is recorded and the network administrator advised.
17. The integrated proactive network analysis system of claim 1 further including a performance graphing unit that displays network activity graphically.
18. An integrated proactive network analysis system with diagnostic and management tools combined into a single system, the integrated system comprising:
a distributed network packet capture data stream collector;
a traffic analyzer;
a performance graphing unit;
a syslog recorder analyzer and archiving unit;
a system availability monitor;
a device configuration archiving unit; and
a throughput measurement tool.
19. The integrated proactive network analysis system of claim 18 further comprising an access list generator and an access list analyzer.
20. An integrated proactive network analysis system with diagnostic and management tools combined into a single system, the integrated system comprising:
a distributed network packet capture data stream collector;
a traffic analyzer;
a system availability monitor; and
a throughput measurement tool.
Description
    RELATED APPLICATIONS
  • [0001]
    This application claims the benefit of provisional application Ser. No. 60/592,285 Entitled “Proactive Network Analysis System” filed Jul. 29, 2004.
  • BACKGROUND OF THE INVENTION
  • [0002]
    1. Field of the Invention
  • [0003]
    The present invention relates to network administration and optimization, more particularly the present invention relates to a network analyses tool for minimizing network downtime and maximizing network operation and efficiencies.
  • [0004]
    2. Background Information
  • [0005]
    A LAN, or “local area network”, is a computer network generally spanning a relatively small area, such as in an office or a home and are capable of transmitting data at very fast rates. Most LANs are confined to a single building or group of buildings. However, one LAN can be connected to other LANs over distances via telephone lines and radio waves, forming a wide area network or WAN. Most LANs connect end user devices such as workstations and personal computers, known as nodes of a network. Each node (e.g. individual end user device) in a LAN has its own CPU with which it executes programs, but it also is able to access data and devices anywhere on the LAN. This means that many users can share devices, such as printers, as well as data. Users can also use the LAN to communicate with each other, by sending e-mail, or chat sessions or the like. Access to the network is of critical importance to the users.
  • [0006]
    There are many different types of LANS. LANS can be differentiated by topology, which is the geometric arrangement of devices on the network, such as a ring arrangement or in a straight line arrangement; protocols which are the rules and encoding specifications for sending data; and connection media such as twisted pair wire, coaxial cables, fiber optic or wireless. The wireless LANs are also referred to as WLANs with Wi-Fi being the dominant WLAN standard.
  • [0007]
    The integrity and performance of a computer network, a LAN or WLAN or other network, is critical. There are demands for essentially 100% “uptime” of a network for the users to provide services to customers, partners, vendors, and employees. The term “uptime” references the period in which access to a network, and the components thereof, are available. The term “downtime”, also called a network outage, reference the time when a network is inaccessible to users. Although the elimination of all network outages is never a guarantee, managing the network infrastructure can assist in minimizing such outages and maximizing uptime.
  • [0008]
    Various networks are known to have numerous infrastructure inefficiencies, such as in large campus environments, data centers, and remote site location networks. A variety of tools have been created for analyzing and managing network infrastructures. For example, log files from hosts, application logs, intrusion detection systems (IDSs), and network devices are sources of information on network traffic patterns. However, logging mechanisms need to be enabled and properly configured. Log files can be destroyed or altered if a system becomes compromised, and uncertainty about the integrity of system log files rises when out-of-band logging is not performed. In summary, the existing analysis and management tools provide adequate review and analysis to specific areas addressed by the specific tool. However it is left to the network administrator to select the combination of specific tools needed and to combine the results of such tools to properly manage the network. There is a need in the industry to provide network administrators with a single analysis unit for providing comprehensive diagnoses of network problems, measurement of network performance, and monitoring network status.
  • SUMMARY OF THE INVENTION
  • [0009]
    The proactive network analysis system according to the present invention is a single system, or unit, for diagnosing network problems, measuring network performance, managing and monitoring network status in a comprehensive and synergistic manner. The system according to the present invention is a compilation of individual tools assembled in an easy-to-use, cost effective system, or tool kit, for analyzing, isolating, and solving complex network issues wherein the independent tools provide a synergistic effect for the network administrator. The system according to the present invention includes a distributed network packet capture data stream collector; a traffic analyzer; a performance graphing unit; a syslog recorder analyzer and archiving unit; a system availability monitor; a device configuration archiving unit; and a throughput measurement tool. The system can further provide an access list generator, an access list analyzer, a router DNS name generator and a service level agreement measurement device.
  • [0010]
    These and other advantages of the present invention will be clarified in the description of the preferred embodiments taken together with the attached drawings in which like reference numerals represent like elements throughout.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • [0011]
    FIG. 1 is a schematic view of a proactive network analysis system according to the present invention;
  • [0012]
    FIG. 2 is a schematic view of a network implantation of the proactive network analysis system of FIG. 1 according to the present invention;
  • [0013]
    FIG. 3 is a schematic view of a proactive network analysis system according to a modified aspect of the present.
  • DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT
  • [0014]
    Many tools and techniques are available to audit and monitor a network environment. The proactive network analysis system 10 according to the present invention is an integrated compilation of mainly existing network tools providing a comprehensive integrated system for diagnosing network problems, measuring network performance, and monitoring network status. The system 10 is, in effect, an easy-to-use, cost effective tool kit for analyzing, isolating, and solving complex network issues. The system 10 includes a distributed network packet capture data stream collector 20; a traffic analyzer 30; a performance graphing unit 40; a “syslog” recorder analyzer and archiving unit 50; a system availability monitor 60; a device configuration archiving unit 70; and a throughput measurement tool 80 seamlessly combined into a single system 10.
  • [0015]
    In overview, the distributed network packet capture data stream collector 20 provides a highly scalable solution to meet network growth at an affordable cost. The collector 20 delivers access to data and information, as needed, to the network administrator for root-cause analysis.
  • [0016]
    The traffic analyzer 30 provides decoding capabilities for Layer 2 and Layer 3 data transport protocols and delivers extensive collection capabilities locally and remotely across major network topologies. The OSI, or Open System Interconnection, model defines a networking framework for implementing protocols in seven layers. Control is passed from one layer to the next, starting at the application layer in one station, and proceeding to the bottom layer, over the channel to the next station and back up the hierarchy. The seven layers include the application layer (7), the presentation layer (6), the session layer (5), the transport layer (4), the network layer (3), the data link layer (2) and the physical layer (1). The network layer (3) provides switching and routing-technologies, creating logical paths, known as virtual circuits, for transmitting data from node to node. Routing and forwarding are functions of this layer, as well as addressing, inter-networking, error handling, congestion control and packet sequencing. At the data link layer (2), data packets are encoded and decoded into bits. It furnishes transmission protocol knowledge and management and handles errors in the physical layer, flow control and frame synchronization. The data link layer is divided into two sub-layers: The media access control (MAC) layer and the Logical Link Control (LLC) layer. The MAC sub-layer controls how a computer on the network gains access to the data and permission to transmit it. The LLC layer controls frame synchronization, flow control and error checking.
  • [0017]
    The performance graphing unit 40 provides meaningful representation of analyzer traffic and statistics. The performance Graphing unit 40 illustrates statistics and real time data captures within a browser user interface and further provides printable hardcopy options. The “syslog” unit 50 saves and analyzes “syslog” messages. “Syslog” is the de facto standard for logging network events. The unit 50 summarizes thousands of lines of Syslog into a meaningful, easy-to-read report.
  • [0018]
    The system availability monitor 60 checks and logs the status of devices and services. The monitor 60 is topology aware, whereby individual device outages on the network do not generate false ‘all network’ outages.
  • [0019]
    The device configuration archiving unit 70 gathers device (router, switch, etc.) configurations. The configurations are archived by the unit 70, and a ‘difference’ report is generated highlighting changes to the network device configurations.
  • [0020]
    The throughput measurement tool 80 is a bandwidth analyzer that determines the transfer rate between two points. The network administrators can utilize the tool 80 to validate WAN connection bandwidth and QoS settings provided by Services Providers.
  • The Distributed Network Packet Capture Data Stream Collector 20
  • [0021]
    Regarding the data stream collector 10, a packet capture is a recording of network traffic, also called a packet capture. Packet captures are useful to the network administrator when trying to decipher problems with network capable software. For example, in addressing certain network problems problem it may be helpful to have a packet capture of the errant traffic and a packet capture of an analogous operation. In order to obtain a packet capture of network traffic it is necessary to run special software on a machine that is capable of receiving the traffic of interest. There are many existing tools that can do this. For example, Tcpdump is a command line utility for UNIX (there's also a windump for Windows). Tcpdump is often distributed with Linux distributions. Additionally, ethereal is a CU' based application that will capture packets as well as display the individual fields within packets. Ethereal is also distributed with Linux distributions. It can also be obtained at http://www.ethcreal.corn. It runs on UNIX as well and even Windows with an additional packet capture driver. Further, netmon is a Windows application that will capture packets as well as display some information within packets (not as much as Ethereal). NetMon is usually bundled with other networking oriented packages such as SMS.
  • [0022]
    The Ethereal packet capture program also has a very nice user interface for examining the contents of packets and will understand NetMon and tcpdump packet captures. The Ethereal packet capture program is also referred to as a protocol analyzer and it will illustrate three views of a packet. It shows a summary line, briefly describing what the packet is, A protocol tree is shown, allowing you to drill down to exact protocol or field that you interested in. Finally, a hex dump shows you exactly what the packet looks like when it goes over the wire.
  • [0023]
    The present system 10 utilizes the Tethereal packet capture program for the data stream collector 20. Other data stream collector systems could also be utilized, such as the network packet capture facility in Java, Libpcap, and tcpdump.
  • Traffic Analyzer 30
  • [0024]
    A conventional traffic analyzer is used to assess the actual end-to-end conditions in real-time. It samples specified end-to-end paths from the same point of view as an application. The sampling can be either network layer (IP) or OS layer (TCP) or even application layer (i.e. HTTP, SMTh5 FTP.). The traffic analysis can generate detailed, hop-by-hop views of end-to-end paths that offer real-time measures of the capacities of the links, the traffic in the path, and problem analysis, identification and isolation. The traffic analysis offers end-to-end views; real-time, actual performance; location of critical points of performance degradation (i.e. where the network is under- or over-provisioned); easy adaptation to changes in network configuration. Traffic analysis alone does not provide a historical perspective. The traffic analysis can provide rapid isolation of performance bottlenecks and offers powerful diagnostic capabilities.
  • [0025]
    Network traffic analysis can identify for the network administrator what has happened or is happening by revealing unauthorized activity from utilization, traffic patterns, and network address space. Network sniffers, sensors, and packet re-assemblers can capture and reconstruct network sessions.
  • [0026]
    There are numerous traffic analyzers available. Windows 95/98/NT traffic monitors include ANALYZER that uses WINDUMP; LANMON; LANsleuth; LANdecoder32, Lanwatch; NetAnt; NetXRay; Netspy; and Netmon. The Cisco Network Analysis Module (14AM) is an integrated traffic monitoring solution for the high-performance Cisco Catalyst® 6500 Series, Cisco 7600 Series routers, and Cisco 2600/3660/3700 Series multi-service access routers. Iris is described as a network traffic analyzer designed to proactively monitor a network. The traffic analyzer 30 of the system 10 is preferably ntop, although cflowd and traffic-vis are alternatives.
  • Performance Graphing Unit 40
  • [0027]
    The network management tools described herein will collect a tremendous amount of data during audit and monitoring exercises. Data volumes can range from megabytes to terabytes depending on the environment (number of users, applications, business, and so on). The system 10 needs an effective way to display the data in a meaningful way to allow for the network administrator to analyze this data. Graphic visualization of the data with the graphing unit 40 is critical for meaningful analysis by the network administrator. The results can simply be graphed, but the addition of automated analysis and notification can considerably increase the benefit to the network administrator Predictive capabilities may be delivered via trend analysis techniques.
  • [0028]
    “EtherApe is a graphical network monitor for Unix modeled after etherman. Featuring link layer, ip and TCP modes, it displays network activity graphically. Hosts and links change in size with traffic. Color coded protocols display. It supports Ethernet, FDDI, Token Ring, ISDN, PPP and SLIP devices. It can filter traffic to be shown, and can read traffic from a file as well as live from the network.” (For Linux only). Existing graphing units include VIZNET which is a Java application to visualize network bandwidth performance over time; the Multi Router Traffic Grapher (MRTG) tool (from http://www.mrtE.org) queries routers and then graphs the results in a simple and yet very effective fashion; and the ntop program shows network statistics such as source and destination distribution via an embedded web server. The system 10 preferably utilizes Cacti and its rrdtools backend database, although mrtg, mrtgfe, and Ops control panel are alternatives.
  • Syslog Recorder Analyzer and Archiving Unit 50
  • [0029]
    Log consolidators collect and summarize log events from hosts, network devices and multi-vendor security applications, bringing them into a centralized system. Audit and monitoring heighten network administrators' awareness of network usage practices. The feedback from these techniques can be used to enhance current intrusion detection system signatures or firewall rule sets. It also can provide a basis for security awareness tips and focused user training, which will enhance overall protection. Other benefits include reduced time and resources spent responding to an incident, reduced network misuse, and stronger policy enforcement. Audit and monitoring is most often used to detect and analyze anomalous behavior.
  • [0030]
    As noted above, syslog is a de-facto standard for logging system events. The program syslog analyzer is Windows and UNIX System Event Log Analysis and Reporting program. The program provides an easy-to-use, Web-based analysis and reporting solutions that can analyze event logs generated by Windows and UNIX networks and provide valuable information about the health and security of such networks. The system 10 utilizes a syslog analyzer program. The specific analyzer program used is log analysis, and syslogd and logrotate features of Linux may be acceptable.
  • System Availability Monitor 60
  • [0031]
    The system availability monitor continuously monitors the components of the network testing specific component availability. In the event of a failure or unavailability of a component, the unavailability of the component is recorded and the network administrator advised, as needed. Further the monitor 60 may automatically redirect users to the backup component to minimize network downtime. The current network status is displayed to the network administrator in near-real time. When problems are detected, the network administrator can be notified by e-mail, pager, or text messaging, or the like. The continuous monitoring, with alerts, provides a proactive feedback mechanism for the network administrator. The monitor 60, and the history thereof, can be used to predict problems before they occur. Further the monitor 60 provides historical and trending information for automated analysis or for fixture network planning. The specific monitor program utilized is Autostatus, and WhatupGold, and sysmon are acceptable alternatives.
  • Device Configuration Archiving Unit 70
  • [0032]
    The documentation of network resources and the network configurations is usually the first step before re-designing a network. In many instances, an initial network audit can uncover network mis-configurations, the resolution of which can eliminate or postpone the need for a network upgrade.
  • [0033]
    The device configuration archiving unit 70 will document and automate network device configuration management allowing the network administrator to gather a baseline of current configurations, audit changes in configurations, rollback to previous known good configurations in the event of a disaster, and perform a risk assessment or impact analysis of planned changes and implement changes more efficiently. The configuration archiving unit 70 provides visibility and reporting into network device details including hardware, software and configuration information. With real-time change detection and correlation, the unit 70 provides detailed inventory, compliance and change reporting, as well as fast troubleshooting. The unit 70 utilized existing program known as pancho, and yale-tftpd, tftpd built-in with Linux and jtftp may also be considered.
  • Throughput Measurement Tool 80
  • [0034]
    Capacity is the maximum throughput that a network path can provide to a given application. Bandwidth, on the other hand, is the portion of a path's capacity that is not utilized in competing cross traffic. Internet resources are often used inefficiently due to the inability to cooperatively share and access existing bandwidth. High bandwidth applications such as grid interfaces, high-speed file transfers, and streaming media are particularly hindered by the inability to accurately ascertain bandwidth parameters in real-time. Bandwidth estimation tools are especially important to high throughput data-intensive distributed applications. There are a number of bandwidth estimation tools.
  • [0035]
    The program Iperf is a TCP and UDP bandwidth testing tool, similar in function to the traditional ttcp tool.
  • [0036]
    The program fling is a point-to-point bandwidth measurement tool, based on ping. Fling determines the real (raw, as opposed to available or average) throughput on a link by measuring ICMP echo requests roundtrip times for different packet sizes for each end of the link.
  • [0037]
    The program bprobe/cprobe is a tool that estimates the maximum possible bandwidth along a given path. cprobe estimates the current congestion along a path. Currently these tools rely on two features of the IRIX operating system for SGI hardware.
  • [0038]
    The program Netperf is a benchmark that can be used to measure the performance of many different types of networking. It provides tests for both unidirectional throughput, and end-to-end latency. The environments that can be measured by netperf include TCP and UDP via BSD Sockets; DLPI; Unix Domain Sockets; Fore ATM API; and HP HiPPI Link Level Access.
  • [0039]
    The program nettimer is useful for measuring end-to-end network performance. It can simulate or passively collect network traffic, and can also actively probe the network using a packet-pair ‘tailgating’ technique. There is no requirement for any special information from the network and no limitation to a particular transport protocol. Currently implemented metrics include bottleneck bandwidth and link bandwidth. Collected data is output using ‘ns’ database format,
  • [0040]
    The program pathchar estimates performance characteristics of each node along a path from a source to destination. Pathchar uses knowledge about earlier hops and the round trip time distribution to this hop to assess incremental bandwidth, latency, loss, and queue characteristics across this link. The program pchar, similar to pathchar, attempts to characterize the bandwidth, latency, and loss of links along an end-to-end path through the Internet. pchar works on both IPv4 and IPv6 networks.
  • [0041]
    The program TReno is a TCP internet throughput measurement too based on a user-level implementation of a TCP-like protocol. This allows it to measure throughput independently of the TCP implementation of end hosts and to serve as a useful platform for prototyping TCP changes. TReno is associated with the IPPM formal metrics effort (see http://www.psc.edu/˜mathis/ippm/).
  • [0042]
    Uvault Host Analyzer is a bandwidth monitor tool for managing traffic of applications hosted by the Flash Communication Server. Uvault can analyze bandwidth usage and traffic patterns of users accessing applications on Macromedia's Flash Communication Server.
  • [0043]
    The program RTTometer is a measurement tool to estimate path minimum RTT along with a measure of path condition. Similar to traditional ping, it sends a set of probes and reports the RTT experienced by each probe. Moreover, RTTometer makes use of all information gathered about the path revealed in all probes to estimate path condition. It associates a confidence measure with the captured minimum RTT.
  • [0044]
    The program mtr combines the functionality of the ‘traceroute’ and ‘ping’ programs in a single network diagnostic tool. As mtr starts, it investigates the network connection between the host mtr runs on and a user-specified destination host. After it determines the address of each network hop between the machines, it sends a sequence ICMP ECHO requests to each one to determine the quality of the link to each machine. As it does this, it prints running statistics about each machine.
  • [0045]
    Initial Gap Increasing, or IGI, is an available bandwidth measurement tool using active probing, which can be used to measure the available bandwidth between two end points on Internet.
  • [0046]
    The system 10 uses ttcp and/or mtr as the throughput measurement tool, although Iperf is an acceptable alternative.
  • Access List Generating Tool 85
  • [0047]
    This is an easy-to-use tool 85, also called GAL for Generating Access List, providing a logical way for a network manager to define and maintain access and traffic policies for their routers and firewalls, and is a tool oriented toward Cisco™ routers and Cisco PIX firewall, It then generates the correct Access List entries to implement the policies and provides reports that can be presented to the Security Audit staff for their review and approval of those policies.
  • Access List Analyzing Tool 90
  • [0048]
    This is a tool 90 that is also oriented toward Cisco™ routers and Cisco PIX firewall. In a router, Access Lists are a way to control or identify traffic. They have a tendency to become very large, very quickly. Frequently, and over time, they are maintained by different people. In this environment, it is easy for logic errors to be made, such that the desired Access List does not performed as required, but the support staff does not know this. The Access List Analyzer tool 90 takes, as input, a router or PIX configuration file. The output of the tool 90 is a report that indicates which Access List entries are inconsistent, and the commands necessary to remove the inconsistent entries, if desired, providing an efficient tool for network managers.
  • DNS Name Generating Tool 95
  • [0049]
    This is a tool 95 that is also oriented toward Cisco™ routers. DNS, the Domain Name System, is used to assign human-meaningful names to IP addresses. Thus, a hard-to-remember address such as 10.34.89.7 might be named webserver7. In the case of a router, there may be may be many dozens of IP addresses associated with the device. Good networking practice dictates that each address should have a name assigned, but the administrative burden of putting together the name+address is high. Many times, the DNS name assignment is not done, The DNS name generator tool 95 is a tool that takes, as input, a router configuration file. The output of the tool is a meaningful name for each of the IP addresses in the configuration file.
  • Service Level Agreement Measurement Device 98
  • [0050]
    The service level agreement tool 98 is a device for assuring that the level of service provided by a network provider is within the promises of the service level agreement. Through making the service level agreement tool 98 as a separate tool in the system 10, the system administrator will have an easy manner of reviewing this material. There are many providers that promise a certain level of service and assert a certain level of past performance, but there has never been an efficient tracking tool for administrators to verity these claims. The service level agreement tool 98 addresses this need and may be particularly helpful in negotiating with fixture network providers for continuation of existing service or new services.
  • [0051]
    The system 10 is an easy-to-use, cost effective, integrated tool kit for analyzing, isolating, and solving complex network issues. As discussed above there are numerous tools for network administration. The system 10 according to the present invention provides a unique combination of existing tools in a single integrated unit which includes a distributed network packet capture data stream collector 20; a traffic analyzer 30; a performance graphing unit 40; a syslog recorder analyzer and archiving unit 50; a system availability monitor 60; a device configuration archiving unit 70; a throughput measurement tool 80 seamlessly combined into a single system 10; an access list generator 85; an access list analyzer 90; a router DNS name generator 95; and a service level agreement measurement device 98. The distributed network packet capture data stream collector 20 and the traffic analyzer 30 may be considered diagnostic tools, the access list generator 85, access list analyzer 90, router DNS name generator 95 and the service level agreement measurement device 98 may be grouped as proprietary additions to an integrated network tool, while the remainders are considered to be existing network management devices.
  • [0052]
    The system 10 can be implemented in a network, such as a corporate WAN 100 shown in FIG. 2. The Wan 100 may have a primary or corporate WAN router 102 and at least one remote site WAN router 104, the corporate LAN will typically have the corporate (i.e. local) DSN, Web, Mail, File and Database servers 106 and the remote LAN will also have local DSN, Web, Mail, File and Database servers 108. The specific network configurations are varied and well known to those of ordinary skill in the art. The system 10 will include a general or management interface 112 with the LAN as well as a packet capture interface 114, as schematically illustrated. At the remote sites the system 10 provides web based packet capture, real time traffic analysis, syslog processing, network device configuration back up/retrieval, and network and system device status. The system 10 can further provide graphing of historical network and system utilization and performance. At the corporate or central site, the system 10 will provide web based packet capture, real time traffic analysis, network device configuration back up/retrieval, network and system device status, and graphing of historical network and system utilization and performance.
  • [0053]
    The system 10 includes more than the collection of existing components in an integrated interface, the system 10 can further provide the access list generator 85, an access list analyzer 90, a router DNS name generator 95 and a service level agreement measurement device 98 as discussed above that are not found in other network management devices.
  • [0054]
    The system 10 can incorporate other features in addition to those described above, such as currently found in the Netterrogator™ product sold by the assignee Solutions4Networks, and generally illustrated in FIG. 3. In the system 10 shown in FIG. 3, access to the system 10 can be via a web browser. This does not preclude the use of telnet or SSH, but they are no longer required to use any of the features of the system 10. The system 10 supports multiple userids. Each id can be given access to select functions of the system 10. The system 10 supports a patch mechanism, which by itself is not new to network management products. What is new regarding the patch mechanism in the system 10, is that the system 10 uses the patch mechanism to allow users to backup their settings, or migrate their setting to other network management systems 10. The user can prepare a ‘migration’ patch (with just one click) that includes all their definition files. They can then apply the patch to a different system 10 and instantly make it look like the original, which is very convenient for management of several systems 10.
  • [0055]
    The system 10 of FIG. 3 includes several new diagnostic tools for the network manager. The first is an Enhanced Ping 110 that builds on the basic ‘ping’ tool that is supplied with many IP stacks. The system 10 issues multiple pings of different sizes. Also, the system 10 issues the pings with the ‘Don't Fragment’ flag set. The combination of the two approaches identifies problems related to VPN tunnel connections. In addition or in conjunction with the enhanced ping 110 is an enhanced traceroute tool (also shown at 110) to combine the functionality of the ‘traceroute’ and ‘ping’ programs in a single network diagnostic tool. As the enhanced traceroute program starts, it investigates the network connection between the host that it runs on and a user-specified destination host. After it determines the address of each network hop between the machines, it sends a sequence ICMP ECHO requests to each one to determine the quality of the link to each machine. As it does this, it prints running statistics about each machine. The enhanced traceroute tool may be formed from an open source tool known as “Matt's Traceroute” or mtr discussed above, although other installations are possible. The “front end” of such programs would be integrated into the system 10 for ease of use.
  • [0056]
    The system 10 of FIG. 3 further includes a network mapper 120 as a diagnostic tool, such as NMAP (an open source utility) with a modified GUI front end to integrate into the system 10. The mapper 120 is for network exploration or security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and other network characteristics.
  • [0057]
    The system 10 of FIG. 3 includes a HTTP Latency Check tool 130 as a diagnostic tool that allows users to specify a URL, and get an exact measurement of the time it takes for the web page to load. The intent is to use this in situations where the system 10 is installed at a remote site, and the site personnel are complaining about poor web performance. This is a way to quantify the actual response time for the specified web pages.
  • [0058]
    The system 10 further includes some additional management tools, for example, the system 10 can now issue alert messages based on the text of syslog messages with the syslog alert tool 140 and will accept SNMP traps with a SNMP processing tool 150. The alerts can be sent to multiple users, either containing the original message text, or user-specified text. The SNMP processing tool 150 allows the system 10 to accept and log SNMP traps. Using the aforementioned SYSLOG Alert tool 140, the traps can then generate alerts.
  • [0059]
    A new proposed functional area of the sytem 10 not described above is the inclusion of an Intelligent Content Filter (ICF). This tool is a web (http) proxy server. The intent is to filter and disallow bad, i.e. pornographic, websites. Instead of simply generating lists of approved or disapproved sites, the ICF uses the approach whereby ‘bad’ webpages are identified by their content instead of subscriptions lists. The ICF uses a ‘bayesian’ analysis technique that determines ‘goodness’ or ‘badness’ based upon the frequency of good and bad content. It effectively filters out bad pages with a high degree of accuracy without the need of long ‘white’ or ‘black’ lists.
  • [0060]
    The system 10 is further proposed to include a management tool that is a Layer 3 (the IP layer) Topology mapping tool. This tool will discover, or map out, the layer 3 topology of a given network. While there are other tools that do this, traditional approaches have all tried to draw a ‘map’ or diagram of the network. In practice, this is ineffective on large, corporate networks. The proposed approach of the Layer 3 mapping tool for the system 10 is to display the data in tabular form, organized on a ‘WAN Island’ approach. Most networks are made up of many remote site high-speed LANs interconnected by a slower-speed WAN. The various sites will be determined based on the connection speed the site has to the rest of the network. For example, a site may consist of several routers and Ethernets (high-speed LANs), and a couple of T1 connections.
  • [0061]
    The system 10 is further proposed to include a remote access server identification tool to identify RAS servers (Remote Access Servers) on a network. The tool intends to use the following process:
      • 1. Check each know Layer 3 switch (i.e. the Router).
      • 2. On the router, get the ARP cache.
      • 3. Find any MAC address that has multiple IP addresses associated with it.
      • 4. Ignore known MAC addresses or vendor IDs. For example, you may want to ignore VMware servers.
      • 5. Ping the IP addresses, an check the TTL on the resultant response. The primary server will have an TTL that is greater than the remotely attached devices. Based on the differing values of the TTL field, you can identify candidates as highly probably being a RAS server.
  • [0067]
    The system 10 will preferably be able to issue time of day command executions. Based on time-of-day and day-of-week, the system 10 will be able to issue application and Operating System commands to various systems. The system 10 will be able to determine the health of a system on more than just a ping response of a TCP port being available. It will be able to check for actual application availability. For example, it will pull back an actual web page to determine a web server and related application is functional. The system 10 will preferably allow for easy incorporation of future enhancements of tools, as shown in FIG. 3.
  • [0068]
    It will be apparent to those of ordinary skill in the art that various modifications may be made to the present invention without departing from the spirit and scope thereof The scope of the present invention is defined by the appended claims and equivalents thereto.
Patent Citations
Cited PatentFiling datePublication dateApplicantTitle
US5954829 *Dec 30, 1996Sep 21, 1999Mci Communications CorporationSystem, method, and computer program product for digital cross connect testing
US7317723 *Feb 3, 2004Jan 8, 2008Cisco Technology, Inc.Action based termination of multidimensional lookup
US20030145039 *Jan 25, 2002Jul 31, 2003Bonney Jordan C.Network analyzer having distributed packet replay and triggering
US20030187982 *Mar 27, 2002Oct 2, 2003Patrick PetitSystem and method for resource load balancing in a portal server
US20040166857 *Nov 26, 2003Aug 26, 2004Nec Laboratories America, Inc.Secure candidate access router discovery method and system
US20040204949 *Apr 9, 2003Oct 14, 2004Ullattil ShajiMethod and system for implementing group policy operations
US20050015626 *Jul 9, 2004Jan 20, 2005Chasin C. ScottSystem and method for identifying and filtering junk e-mail messages or spam based on URL content
US20050049726 *Aug 27, 2004Mar 3, 2005Adamson Hugh P.Input device for building automation
US20050114495 *Oct 29, 2003May 26, 2005Alexander ClemmMethod of providing views of a managed network that uses network address translation
US20050138114 *Dec 19, 2003Jun 23, 2005Connor Patrick L.Method, apparatus, system, and article of manufacture for generating a response in an offload adapter
US20050243729 *Apr 15, 2005Nov 3, 2005Apparent Networks, Inc.Method and apparatus for automating and scaling active probing-based IP network performance monitoring and diagnosis
US20070100585 *Sep 26, 2006May 3, 2007Nextnine Ltd.Support Network
US20070143463 *Oct 17, 2006Jun 21, 2007Verizon Laboratories, Inc.Systems and methods for managing faults in a network
US20070198707 *Mar 5, 2007Aug 23, 2007Webtrends, Inc.System and method for analyzing remote traffic data in a distributed computing environment
US20080008202 *Sep 24, 2007Jan 10, 2008Terrell William CRouter with routing processors and methods for virtualization
US20080014917 *May 31, 2007Jan 17, 2008Rhoads Geoffrey BWireless Mobile Phone Methods
US20080317032 *Sep 4, 2008Dec 25, 2008At&T Intellectual Property I, Lp Formerly Known As Bellsouth Intellectual Property CorporationMethods for using a translation/instruction system to redirect a multiprotocol label switching (mpls) packet
US20090052320 *Oct 21, 2008Feb 26, 2009Yibei LingEstimator for end-to-end throughput of wireless networks
Referenced by
Citing PatentFiling datePublication dateApplicantTitle
US7564796 *Sep 30, 2004Jul 21, 2009Hewlett-Packard Development Company, L.P.Method and system for managing a network slowdown
US7634809 *Mar 11, 2005Dec 15, 2009Symantec CorporationDetecting unsanctioned network servers
US7639690 *Jul 19, 2006Dec 29, 2009Fujitsu LimitedNetwork communication monitoring system, network communication monitoring method, central apparatus, relay unit, and memory product for storing a computer program
US7710892 *Sep 8, 2006May 4, 2010Dominic CoupalSmart match search method for captured data frames
US7738403 *Jan 23, 2006Jun 15, 2010Cisco Technology, Inc.Method for determining the operations performed on packets by a network device
US7765294May 31, 2007Jul 27, 2010Embarq Holdings Company, LlcSystem and method for managing subscriber usage of a communications network
US7796535 *Sep 1, 2006Sep 14, 2010Comcast Cable Holdings, LlcSystem and method for monitoring a data packet
US7808918May 31, 2007Oct 5, 2010Embarq Holdings Company, LlcSystem and method for dynamically shaping network traffic
US7843831May 31, 2007Nov 30, 2010Embarq Holdings Company LlcSystem and method for routing data on a packet network
US7889660Aug 22, 2007Feb 15, 2011Embarq Holdings Company, LlcSystem and method for synchronizing counters on an asynchronous packet communications network
US7940735May 31, 2007May 10, 2011Embarq Holdings Company, LlcSystem and method for selecting an access point
US7948909May 31, 2007May 24, 2011Embarq Holdings Company, LlcSystem and method for resetting counters counting network performance information at network communications devices on a packet network
US7979371Jan 17, 2008Jul 12, 2011International Business Machines CorporationPredictive monitoring for events at computer network resources
US7984007 *Jan 3, 2007Jul 19, 2011International Business Machines CorporationProactive problem resolution system, method of proactive problem resolution and program product therefor
US7991881Feb 29, 2008Aug 2, 2011Microsoft CorporationMonitoring network performance to identify sources of network performance degradation
US8000318May 31, 2007Aug 16, 2011Embarq Holdings Company, LlcSystem and method for call routing based on transmission performance of a packet network
US8015294May 31, 2007Sep 6, 2011Embarq Holdings Company, LPPin-hole firewall for communicating data packets on a packet network
US8040811May 31, 2007Oct 18, 2011Embarq Holdings Company, LlcSystem and method for collecting and managing network performance information
US8041804May 25, 2006Oct 18, 2011Cisco Technology, Inc.Utilizing captured IP packets to determine operations performed on packets by a network device
US8050195 *Feb 11, 2009Nov 1, 2011Nec CorporationTraffic performance evaluation system in wireless network and method thereof
US8064391May 31, 2007Nov 22, 2011Embarq Holdings Company, LlcSystem and method for monitoring and optimizing network performance to a wireless device
US8068425Apr 9, 2009Nov 29, 2011Embarq Holdings Company, LlcSystem and method for using network performance information to determine improved measures of path states
US8086836Aug 28, 2008Dec 27, 2011Splashtop Inc.Method and apparatus for virtualization of appliances
US8098579May 31, 2007Jan 17, 2012Embarq Holdings Company, LPSystem and method for adjusting the window size of a TCP packet through remote network elements
US8102770May 31, 2007Jan 24, 2012Embarq Holdings Company, LPSystem and method for monitoring and optimizing network performance with vector performance tables and engines
US8107366May 31, 2007Jan 31, 2012Embarq Holdings Company, LPSystem and method for using centralized network performance tables to manage network communications
US8111692Apr 28, 2010Feb 7, 2012Embarq Holdings Company LlcSystem and method for modifying network traffic
US8125897May 31, 2007Feb 28, 2012Embarq Holdings Company LpSystem and method for monitoring and optimizing network performance with user datagram protocol network performance information packets
US8130793May 31, 2007Mar 6, 2012Embarq Holdings Company, LlcSystem and method for enabling reciprocal billing for different types of communications over a packet network
US8144586May 31, 2007Mar 27, 2012Embarq Holdings Company, LlcSystem and method for controlling network bandwidth with a connection admission control engine
US8144587May 31, 2007Mar 27, 2012Embarq Holdings Company, LlcSystem and method for load balancing network resources using a connection admission control engine
US8184549May 31, 2007May 22, 2012Embarq Holdings Company, LLPSystem and method for selecting network egress
US8189468Oct 25, 2006May 29, 2012Embarq Holdings, Company, LLCSystem and method for regulating messages between networks
US8194555May 31, 2007Jun 5, 2012Embarq Holdings Company, LlcSystem and method for using distributed network performance information tables to manage network communications
US8194643Oct 19, 2006Jun 5, 2012Embarq Holdings Company, LlcSystem and method for monitoring the connection of an end-user to a remote network
US8199653May 31, 2007Jun 12, 2012Embarq Holdings Company, LlcSystem and method for communicating network performance information over a packet network
US8213366Sep 7, 2011Jul 3, 2012Embarq Holdings Company, LlcSystem and method for monitoring and optimizing network performance to a wireless device
US8223654May 31, 2007Jul 17, 2012Embarq Holdings Company, LlcApplication-specific integrated circuit for monitoring and optimizing interlayer network performance
US8223655May 31, 2007Jul 17, 2012Embarq Holdings Company, LlcSystem and method for provisioning resources of a packet network based on collected network performance information
US8224255May 31, 2007Jul 17, 2012Embarq Holdings Company, LlcSystem and method for managing radio frequency windows
US8228791May 31, 2007Jul 24, 2012Embarq Holdings Company, LlcSystem and method for routing communications between packet networks based on intercarrier agreements
US8238253 *May 31, 2007Aug 7, 2012Embarq Holdings Company, LlcSystem and method for monitoring interlayer devices and optimizing network performance
US8244862Jul 15, 2011Aug 14, 2012Microsoft CorporationMonitoring network performance to identify sources of network performance degradation
US8274905May 31, 2007Sep 25, 2012Embarq Holdings Company, LlcSystem and method for displaying a graph representative of network performance over a time period
US8289965Oct 19, 2006Oct 16, 2012Embarq Holdings Company, LlcSystem and method for establishing a communications session with an end-user based on the state of a network connection
US8307065May 31, 2007Nov 6, 2012Centurylink Intellectual Property LlcSystem and method for remotely controlling network operators
US8335162Aug 13, 2007Dec 18, 2012At&T Intellectual Property I, LpMethods and apparatus to control traffic in a packet-switched network
US8358580Dec 8, 2009Jan 22, 2013Centurylink Intellectual Property LlcSystem and method for adjusting the window size of a TCP packet through network elements
US8374090Oct 18, 2010Feb 12, 2013Centurylink Intellectual Property LlcSystem and method for routing data on a packet network
US8407765May 31, 2007Mar 26, 2013Centurylink Intellectual Property LlcSystem and method for restricting access to network performance information tables
US8429748 *Nov 27, 2009Apr 23, 2013Red Hat, Inc.Network traffic analysis using a dynamically updating ontological network description
US8472326Jul 5, 2012Jun 25, 2013Centurylink Intellectual Property LlcSystem and method for monitoring interlayer devices and optimizing network performance
US8477614May 31, 2007Jul 2, 2013Centurylink Intellectual Property LlcSystem and method for routing calls if potential call paths are impaired or congested
US8488447May 31, 2007Jul 16, 2013Centurylink Intellectual Property LlcSystem and method for adjusting code speed in a transmission path during call set-up due to reduced transmission performance
US8488495Jun 18, 2012Jul 16, 2013Centurylink Intellectual Property LlcSystem and method for routing communications between packet networks based on real time pricing
US8509082Mar 16, 2012Aug 13, 2013Centurylink Intellectual Property LlcSystem and method for load balancing network resources using a connection admission control engine
US8510436Sep 15, 2011Aug 13, 2013Cisco Technology, Inc.Utilizing captured IP packets to determine operations performed on packets by a network device
US8520603May 23, 2012Aug 27, 2013Centurylink Intellectual Property LlcSystem and method for monitoring and optimizing network performance to a wireless device
US8531954May 31, 2007Sep 10, 2013Centurylink Intellectual Property LlcSystem and method for handling reservation requests with a connection admission control engine
US8537695May 31, 2007Sep 17, 2013Centurylink Intellectual Property LlcSystem and method for establishing a call being received by a trunk on a packet network
US8549405May 31, 2007Oct 1, 2013Centurylink Intellectual Property LlcSystem and method for displaying a graphical representation of a network to identify nodes and node segments on the network that are not operating normally
US8570872Apr 18, 2012Oct 29, 2013Centurylink Intellectual Property LlcSystem and method for selecting network ingress and egress
US8576722May 31, 2007Nov 5, 2013Centurylink Intellectual Property LlcSystem and method for modifying connectivity fault management packets
US8614954Oct 26, 2006Dec 24, 2013Hewlett-Packard Development Company, L.P.Network path identification
US8619596Jan 27, 2012Dec 31, 2013Centurylink Intellectual Property LlcSystem and method for using centralized network performance tables to manage network communications
US8619600May 31, 2007Dec 31, 2013Centurylink Intellectual Property LlcSystem and method for establishing calls over a call path having best path metrics
US8619820Jan 27, 2012Dec 31, 2013Centurylink Intellectual Property LlcSystem and method for enabling communications over a number of packet networks
US8660021Nov 18, 2008Feb 25, 2014At&T Intellectual Property I, L.P.Network diagnostics
US8670313Dec 13, 2012Mar 11, 2014Centurylink Intellectual Property LlcSystem and method for adjusting the window size of a TCP packet through network elements
US8687614Dec 7, 2010Apr 1, 2014Centurylink Intellectual Property LlcSystem and method for adjusting radio frequency parameters
US8699348Nov 29, 2012Apr 15, 2014At&T Intellectual Property, I, L.P.Methods and apparatus to control traffic in a packet-switched network
US8717911May 31, 2007May 6, 2014Centurylink Intellectual Property LlcSystem and method for collecting network performance information
US8719398Feb 29, 2008May 6, 2014Microsoft CorporationNetwork performance monitor
US8737235 *Dec 11, 2009May 27, 2014Cavesson Software LlcReal-time network analyzer
US8743700May 30, 2012Jun 3, 2014Centurylink Intellectual Property LlcSystem and method for provisioning resources of a packet network based on collected network performance information
US8743703May 31, 2007Jun 3, 2014Centurylink Intellectual Property LlcSystem and method for tracking application resource usage
US8750158Aug 9, 2012Jun 10, 2014Centurylink Intellectual Property LlcSystem and method for differentiated billing
US8769091Feb 15, 2012Jul 1, 2014Cisco Technology, Inc.Method, device and medium for determining operations performed on a packet
US8811160Jan 22, 2013Aug 19, 2014Centurylink Intellectual Property LlcSystem and method for routing data on a packet network
US8879391Sep 30, 2011Nov 4, 2014Centurylink Intellectual Property LlcSystem and method for using network derivations to determine path states
US8898280 *Feb 19, 2009Nov 25, 2014Fluke CorporationMethods and apparatus for determining and displaying WAN optimization attributes for individual transactions
US8976665Jul 1, 2013Mar 10, 2015Centurylink Intellectual Property LlcSystem and method for re-routing calls
US9014204Nov 6, 2013Apr 21, 2015Centurylink Intellectual Property LlcSystem and method for managing network communications
US9042370Nov 6, 2013May 26, 2015Centurylink Intellectual Property LlcSystem and method for establishing calls over a call path having best path metrics
US9054915Jul 16, 2013Jun 9, 2015Centurylink Intellectual Property LlcSystem and method for adjusting CODEC speed in a transmission path during call set-up due to reduced transmission performance
US9054986Nov 8, 2013Jun 9, 2015Centurylink Intellectual Property LlcSystem and method for enabling communications over a number of packet networks
US9094257Aug 9, 2012Jul 28, 2015Centurylink Intellectual Property LlcSystem and method for selecting a content delivery network
US9094261Aug 8, 2013Jul 28, 2015Centurylink Intellectual Property LlcSystem and method for establishing a call being received by a trunk on a packet network
US9112734Aug 21, 2012Aug 18, 2015Centurylink Intellectual Property LlcSystem and method for generating a graphical user interface representative of network performance
US9118583Jan 28, 2015Aug 25, 2015Centurylink Intellectual Property LlcSystem and method for re-routing calls
US9154634Oct 21, 2013Oct 6, 2015Centurylink Intellectual Property LlcSystem and method for managing network communications
US9225609Oct 9, 2012Dec 29, 2015Centurylink Intellectual Property LlcSystem and method for remotely controlling network operators
US9225646Aug 8, 2013Dec 29, 2015Centurylink Intellectual Property LlcSystem and method for improving network performance using a connection admission control engine
US9240906Aug 21, 2012Jan 19, 2016Centurylink Intellectual Property LlcSystem and method for monitoring and altering performance of a packet network
US9240930 *Feb 22, 2013Jan 19, 2016LiveAction, Inc.System for network flow visualization through network devices within network topology
US9241271Jan 25, 2013Jan 19, 2016Centurylink Intellectual Property LlcSystem and method for restricting access to network performance information
US9241277Aug 8, 2013Jan 19, 2016Centurylink Intellectual Property LlcSystem and method for monitoring and optimizing network performance to a wireless device
US9246772 *Feb 22, 2013Jan 26, 2016LiveAction, Inc.System and method for network topology and flow visualization
US9253661Oct 21, 2013Feb 2, 2016Centurylink Intellectual Property LlcSystem and method for modifying connectivity fault management packets
US9294483 *May 5, 2014Mar 22, 2016John WongMethod and system for mitigation of distributed denial of service (DDOS) attacks
US9311611Jun 16, 2006Apr 12, 2016Hewlett Packard Enterprise Development LpAutomated service level management system
US9329908Sep 29, 2010May 3, 2016International Business Machines CorporationProactive identification of hotspots in a cloud computing environment
US9350622 *Feb 22, 2013May 24, 2016LiveAction, Inc.Method and system for real-time visualization of network flow within network device
US9354960Dec 27, 2010May 31, 2016Red Hat, Inc.Assigning virtual machines to business application service groups based on ranking of the virtual machines
US9411787Mar 13, 2014Aug 9, 2016Thousandeyes, Inc.Cross-layer troubleshooting of application delivery
US9455890Mar 13, 2014Sep 27, 2016Thousandeyes, Inc.Deep path analysis of application delivery over a network
US9479341May 31, 2007Oct 25, 2016Centurylink Intellectual Property LlcSystem and method for initiating diagnostics on a packet network node
US9521150Apr 27, 2012Dec 13, 2016Centurylink Intellectual Property LlcSystem and method for automatically regulating messages between networks
US9549004Jul 16, 2015Jan 17, 2017Centurylink Intellectual Property LlcSystem and method for re-routing calls
US20060072479 *Sep 30, 2004Apr 6, 2006Loyd Aaron JMethod and system for managing a network slowdown
US20070097872 *Oct 27, 2005May 3, 2007Inventec CorporationNetwork connection apparatus testing method
US20070217422 *Jul 19, 2006Sep 20, 2007Fujitsu LimitedNetwork communication monitoring system, network communication monitoring method, central apparatus, relay unit, and memory product for storing a computer program
US20070263545 *May 12, 2006Nov 15, 2007Foster Craig ENetwork diagnostic systems and methods for using network configuration data
US20070276938 *May 25, 2006Nov 29, 2007Iqlas Maheen OttamalikaUtilizing captured IP packets to determine operations performed on packets by a network device
US20080002576 *May 31, 2007Jan 3, 2008Bugenhagen Michael KSystem and method for resetting counters counting network performance information at network communications devices on a packet network
US20080002670 *May 31, 2007Jan 3, 2008Bugenhagen Michael KSystem and method for adjusting code speed in a transmission path during call set-up due to reduced transmission performance
US20080002676 *May 31, 2007Jan 3, 2008Wiley William LSystem and method for routing calls if potential call paths are impaired or congested
US20080002677 *May 31, 2007Jan 3, 2008Bugenhagen Michael KSystem and method for collecting network performance information
US20080002711 *Jun 30, 2006Jan 3, 2008Bugenhagen Michael KSystem and method for access state based service options
US20080002716 *May 31, 2007Jan 3, 2008Wiley William LSystem and method for selecting network egress
US20080005156 *May 31, 2007Jan 3, 2008Edwards Stephen KSystem and method for managing subscriber usage of a communications network
US20080049625 *May 31, 2007Feb 28, 2008Edwards Stephen KSystem and method for collecting and managing network performance information
US20080049626 *May 31, 2007Feb 28, 2008Bugenhagen Michael KSystem and method for communicating network performance information over a packet network
US20080049628 *May 31, 2007Feb 28, 2008Bugenhagen Michael KSystem and method for modifying connectivity fault management packets
US20080049629 *May 31, 2007Feb 28, 2008Morrill Robert JSystem and method for monitoring data link layer devices and optimizing interlayer network performance
US20080049630 *May 31, 2007Feb 28, 2008Kozisek Steven ESystem and method for monitoring and optimizing network performance to a wireless device
US20080049631 *May 31, 2007Feb 28, 2008Morrill Robert JSystem and method for monitoring interlayer devices and optimizing network performance
US20080049632 *May 31, 2007Feb 28, 2008Ray Amar NSystem and method for adjusting the window size of a TCP packet through remote network elements
US20080049637 *May 31, 2007Feb 28, 2008Morrill Robert JSystem and method for establishing calls over a call path having best path metrics
US20080049638 *May 31, 2007Feb 28, 2008Ray Amar NSystem and method for monitoring and optimizing network performance with user datagram protocol network performance information packets
US20080049639 *May 31, 2007Feb 28, 2008Wiley William LSystem and method for managing a service level agreement
US20080049641 *May 31, 2007Feb 28, 2008Edwards Stephen KSystem and method for displaying a graph representative of network performance over a time period
US20080049649 *May 31, 2007Feb 28, 2008Kozisek Steven ESystem and method for selecting an access point
US20080049650 *May 31, 2007Feb 28, 2008Coppage Carl MSystem and method for managing radio frequency windows
US20080049745 *May 31, 2007Feb 28, 2008Edwards Stephen KSystem and method for enabling reciprocal billing for different types of communications over a packet network
US20080049748 *May 31, 2007Feb 28, 2008Bugenhagen Michael KSystem and method for routing communications between packet networks based on intercarrier agreements
US20080049753 *May 31, 2007Feb 28, 2008Heinze John MSystem and method for load balancing network resources using a connection admission control engine
US20080049757 *Aug 22, 2007Feb 28, 2008Bugenhagen Michael KSystem and method for synchronizing counters on an asynchronous packet communications network
US20080049769 *May 31, 2007Feb 28, 2008Bugenhagen Michael KApplication-specific integrated circuit for monitoring and optimizing interlayer network performance
US20080049777 *May 31, 2007Feb 28, 2008Morrill Robert JSystem and method for using distributed network performance information tables to manage network communications
US20080049787 *May 31, 2007Feb 28, 2008Mcnaughton James LSystem and method for controlling network bandwidth with a connection admission control engine
US20080049927 *May 31, 2007Feb 28, 2008Wiley William LSystem and method for establishing a call being received by a trunk on a packet network
US20080052206 *May 31, 2007Feb 28, 2008Edwards Stephen KSystem and method for billing users for communicating over a communications network
US20080052387 *May 31, 2007Feb 28, 2008Heinz John MSystem and method for tracking application resource usage
US20080052393 *May 31, 2007Feb 28, 2008Mcnaughton James LSystem and method for remotely controlling network operators
US20080052394 *May 31, 2007Feb 28, 2008Bugenhagen Michael KSystem and method for initiating diagnostics on a packet network node
US20080052401 *May 31, 2007Feb 28, 2008Bugenhagen Michael KPin-hole firewall for communicating data packets on a packet network
US20080052628 *May 31, 2007Feb 28, 2008Bugenhagen Michael KSystem and method for displaying a graphical representation of a network to identify nodes and node segments on the network that are not operating normally
US20080052784 *May 31, 2007Feb 28, 2008Wiley William LSystem and method for restricting access to network performance information tables
US20080056153 *Sep 1, 2006Mar 6, 2008Comcast Cable Holdings, LlcSystem and method for monitoring a data packet
US20080062989 *Sep 8, 2006Mar 13, 2008Dominic CoupalSmart match search method for captured data frames
US20080095049 *Oct 19, 2006Apr 24, 2008Embarq Holdings Company, LlcSystem and method for establishing a communications session with an end-user based on the state of a network connection
US20080095173 *Oct 19, 2006Apr 24, 2008Embarq Holdings Company, LlcSystem and method for monitoring the connection of an end-user to a remote network
US20080101250 *Oct 26, 2006May 1, 2008Mcgee Michael SeanNetwork path identification
US20080162688 *Jan 3, 2007Jul 3, 2008International Business Machines CorporationProactive problem resolution system, method of proactive problem resolution and program product therefor
US20080201778 *Feb 21, 2007Aug 21, 2008Matsushita Electric Industrial Co., Ltd.Intrusion detection using system call monitors on a bayesian network
US20080279183 *May 31, 2007Nov 13, 2008Wiley William LSystem and method for call routing based on transmission performance of a packet network
US20090037496 *Aug 1, 2008Feb 5, 2009Chong Benedict TDiagnostic Virtual Appliance
US20090046583 *Aug 13, 2007Feb 19, 2009Henry TowsterMethods and apparatus to control traffic in a packet-switched network
US20090083375 *Sep 26, 2008Mar 26, 2009Chong Benedict TInstallation of a Virtualization Environment
US20090089260 *Sep 26, 2008Apr 2, 2009Chong Benedict TQuick Searching UI for a Better User Experience
US20090144214 *Sep 25, 2008Jun 4, 2009Aditya DesarajuData Processing System And Method
US20090199132 *Feb 11, 2009Aug 6, 2009Devicevm, Inc.Quick access to virtual applications
US20090201829 *Feb 11, 2009Aug 13, 2009Satoru YamanoTraffic performance evaluation system in wireless network and method thereof
US20090257350 *Apr 9, 2009Oct 15, 2009Embarq Holdings Company, LlcSystem and method for using network performance information to determine improved measures of path states
US20100077078 *Nov 27, 2009Mar 25, 2010Fortisphere, Inc.Network traffic analysis using a dynamically updating ontological network description
US20100085887 *Dec 8, 2009Apr 8, 2010Embarq Holdings Company, LlcSystem and method for adjusting the window size of a tcp packet through network elements
US20100091664 *Dec 11, 2009Apr 15, 2010Biswajit NandyReal-time network analyzer
US20100125886 *Nov 18, 2008May 20, 2010At&T Intellectual Property I, L.P.Network diagnostics
US20100135168 *Jul 4, 2008Jun 3, 2010Yi-Ping ChenMethod for automatically determining a group of pairs located close to another pair in a communication network and associated server, analysis device and communication device
US20100208611 *Apr 28, 2010Aug 19, 2010Embarq Holdings Company, LlcSystem and method for modifying network traffic
US20100211673 *Feb 19, 2009Aug 19, 2010Fluke CorporationMethods and Apparatus for Determining and Displaying WAN Optimization Attributes for Individual Transactions
US20100278068 *Apr 16, 2008Nov 4, 2010Neuralitic SystemsMethod and System for Filtering IP Traffic in Mobile IP Networks
US20100309809 *Aug 9, 2010Dec 9, 2010Comcast Cable Holdings, LlcSystem and Method for Monitoring a Data Packet
US20110032821 *Oct 18, 2010Feb 10, 2011Morrill Robert JSystem and method for routing data on a packet network
US20110116405 *Dec 7, 2010May 19, 2011Coppage Carl MSystem and method for adjusting radio frequency parameters
US20130159863 *Feb 22, 2013Jun 20, 2013John Kei SmithSystem and Method for Network Topology and Flow Visualization
US20130159864 *Feb 22, 2013Jun 20, 2013John Kei SmithSystem for Network Flow Visualization through Network Devices within Network Topology
US20130159865 *Feb 22, 2013Jun 20, 2013John Kei SmithMethod and System for Real-Time Visualization of Network Flow within Network Device
US20140092757 *Oct 1, 2012Apr 3, 2014Futurewei Technologies, Co.Controlling Data Synchronization and Backup Services
US20140331304 *May 5, 2014Nov 6, 2014John WongMethod and system for mitigation of distributed denial of service (ddos) attacks
CN101917467A *Jul 27, 2010Dec 15, 2010中国科学院等离子体物理研究所Distributed computer monitoring system and monitoring method thereof
CN102035696A *Dec 22, 2010Apr 27, 2011中国工商银行股份有限公司Website access performance monitoring method, device and system
CN103947124A *Sep 25, 2013Jul 23, 2014华为技术有限公司Controlling data synchronization and backup services
EP2357565A1 *Nov 17, 2008Aug 17, 2011Fujitsu LimitedMonitoring-inhibiting error message selection method and program
EP2357565A4 *Nov 17, 2008Aug 21, 2013Fujitsu LtdMonitoring-inhibiting error message selection method and program
EP2852886A4 *May 13, 2013Feb 17, 2016Thousandeyes IncCross-layer troubleshooting of application delivery
WO2008093209A2 *Jan 29, 2008Aug 7, 2008Nortel Networks LimitedNetwork performance indicators
WO2008093209A3 *Jan 29, 2008Apr 28, 2011Nortel Networks LimitedNetwork performance indicators
WO2008124947A1 *Apr 16, 2008Oct 23, 2008Neuralitic SystemsA method and system for filtering ip traffic in mobile ip networks
WO2009032446A1 *Aug 1, 2008Mar 12, 2009Devicevm, Inc.Diagnostic virtual appliance
Classifications
U.S. Classification370/252, 370/235
International ClassificationH04L12/26
Cooperative ClassificationH04L43/022, H04L43/0817, H04L43/0888
European ClassificationH04L43/08G2, H04L43/08D, H04L43/02A
Legal Events
DateCodeEventDescription
Oct 17, 2005ASAssignment
Owner name: SOLUTIONS4NETWORKS, PENNSYLVANIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:MONACO, JEFFREY P.;MCGOUGH, MICHELE R.;REEL/FRAME:016890/0476
Effective date: 20050915