Packet tracing
View Patent ↗To evaluate a network's performance in processing communications related to a target transaction, a set of “reference” communications corresponding to the target transaction are compared to a larger set of communications in the network in a “production” environment, to identify the occurrence of the target transaction in the production environment. Preferably, the reference communications are recorded in a laboratory environment that models the production environment, or recorded from the production environment during a period of minimal other activities. A variety of filters are used to eliminate communications in the production environment that are apparently unrelated to the target transaction, including filters based on the time-order of communications among the nodes, the size of the packets being communicated, and the content of the communications. If necessary, after eliminating the apparently unrelated communications from consideration, the remaining production communications are compared to the reference communications to identify the most likely production communications corresponding to the reference communications.
1. A method of identifying a sequence of transmissions corresponding to a target transaction for embodiment on a network analysis system, comprising:
identifying a reference transaction corresponding to the target transaction that includes a sequence of reference transmissions from multiple nodes in a plurality of tiers in a reference environment,
collecting traffic information corresponding to a period of time within which the target transaction occurs, the traffic information including a plurality of production transmissions from multiple nodes in a plurality of tiers in a production environment,
comparing the sequence of reference transmissions to the plurality of production transmissions to identify corresponding transmissions that form the sequence of transmissions corresponding to the target transaction, wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing an order of communications among tiers of a plurality of tiers in the reference environment with a corresponding order of communications among tiers of a plurality of tiers in the production environment, wherein said comparing involves eliminating at least a portion of the communications among tiers of a plurality of tiers in the production environment that are unrelated to the target transaction.
2. The method of claim 1 , further including determining timing parameters associated with the sequence of transmissions corresponding to the target transaction, to characterize performance of a network during the target transaction.
3. The method of claim 1 , wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing a size of one or more reference transmissions to a size of one or more production transmissions of the plurality of production transmissions.
4. The method of claim 1 , wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing content of one or more of the reference transmissions to content of one or more production transmissions of the plurality of production transmissions.
5. The method of claim 1 , wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes determining a measure of correlation between a plurality of the reference transmissions and a plurality of the production transmissions.
6. The method of claim 1 , further including:
identifying a subset of the reference transmissions that correspond to a subset of the production transmissions, and
partitioning the plurality of reference transmissions into segments of reference transmissions, and the plurality of production transmissions into corresponding segments of production transmissions, based on the subset of reference transmissions corresponding to the subset of production transmissions,
wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing each segment of reference transmissions to the corresponding segment of production transmissions.
7. The method of claim 1 , wherein the target transaction and the reference transaction includes an access to one or more identical items in a database.
8. The method of claim 1 , further including filtering the traffic information based on tiers of a network, and wherein the plurality of production transmissions correspond to transmissions between two tiers of the network.
9. The method of claim 8 , wherein at least one of the tiers includes multiple nodes.
10. The method of claim 9 , wherein comparing the sequence of reference transmissions to the production transmissions is based on the tiers of the network, independent of the multiple nodes at the at least one of the tiers.
11. The method of claim 1 , wherein the reference transmissions and the production transmissions conform to a packet-based protocol, such that the reference transmissions correspond to reference packets and the production transmissions correspond to production packets.
12. The method of claim 11 , wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing a size of one or more reference packets to a size of one or more of the production packets.
13. The method of claim 11 , wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing content of one or more of the reference packets to content of one or more of the production packets.
14. The method of claim 11 , wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes determining a measure of correlation between a plurality of the reference packets and a plurality of the production packets.
15. The method of claim 11 , further including:
identifying a subset of the reference transmissions that correspond to a subset of the production transmissions, and
partitioning the plurality of reference transmissions into segments of reference transmissions, and the plurality of production transmissions into corresponding segments of production transmissions, based on the subset of reference transmissions corresponding to the subset of production transmissions,
wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing each segment of reference transmissions to the corresponding segment of production transmissions.
16. The method of claim 11 , further including filtering the traffic information based on tiers of a network, and wherein the production packets correspond to packets communicated between two tiers of the network.
17. The method of claim 16 , wherein at least one of the tiers includes multiple nodes.
18. The method of claim 17 , wherein comparing the sequence of reference transmissions to the production transmissions is based on the tiers of the network, independent of the multiple nodes at the at least one of the tiers.
19. A system comprising:
a first memory area that is configured to store a set of reference packets transmitted from multiple nodes in a plurality of tiers in a reference environment, wherein the set of reference packets corresponds to a target transaction,
a second memory area that is configured to store a plurality of production packets transmitted from multiple nodes in a plurality of tiers in a production environment,
a plurality of filters that are configured to filter the plurality of production packets to distinguish a set of production packets of the plurality of production packets corresponding to the set of reference packets, including:
a first filter that is configured to filter the production packets based on a sequence order of a plurality of the set of reference packets,
a second filter that is configured to filter the production packets based on a size of one or more of the set of reference packets,
a third filter that is configured to filter the production packets based on content of one or more of the set of reference packets,
a fourth filter that is configured to filter the traffic information based on tiers of a network, wherein at least one of the tiers includes multiple nodes of the network, and
wherein at least one of the first, second, and third filters is configured to compare the sequence of reference packets to the production packets based on the tiers of the network, independent of the multiple nodes at the at least one of the tiers, wherein at least one of the first, second, third filters and fourth filters eliminate at least a portion of the plurality of production packets transmitted from multiple nodes in a plurality of tiers in a production environment that are unrelated to the target transaction, and
a traffic analyzer that is configured to determine timing parameters associated with the set of production transmissions, to characterize performance of a network during the target transaction.
20. A non-transitory computer readable media that includes a program that, when executed by a processing system, identifies a sequence of transmissions corresponding to a target transaction by causing the processing system to:
identify a reference transaction corresponding to the target transaction that includes a sequence of reference transmissions from multiple nodes in a plurality of tiers in a reference environment,
collect traffic information corresponding to a period of time within which the target transaction occurs, the traffic information including a plurality of production transmissions from multiple nodes in a plurality of tiers in a production environment, and
compare the sequence of reference transmissions to the plurality of production transmissions to identify corresponding transmissions that form the sequence of transmissions corresponding to the target transaction, wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing an order of communications among tiers of a plurality of tiers in the reference environment with a corresponding order of communications among tiers of a plurality of tiers in the production environment, wherein said comparing involves eliminating at least a portion of the communications among tiers of a plurality of tiers in the production environment that are unrelated to the target transaction.
21. The media of claim 20 , wherein the program further causes the processing system to determine timing parameters associated with the sequence of transmissions corresponding to the target transaction, to characterize performance of a network during the target transaction.
22. The media of claim 20 , wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing a size of one or more reference transmissions to a size of one or more production transmissions of the plurality of production transmissions.
23. The media of claim 20 , wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing content of one or more of the reference transmissions to content of one or more production transmissions of the plurality of production transmissions.
24. The media of claim 20 , wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes determining a measure of correlation between a plurality of the reference transmissions and a plurality of the production transmissions.
25. The media of claim 20 , wherein the program further causes the processing system to:
identify a subset of the reference transmissions that correspond to a subset of the production transmissions, and
partition the plurality of reference transmissions into segments of reference transmissions, and the plurality of production transmissions into corresponding segments of production transmissions, based on the subset of reference transmissions corresponding to the subset of production transmissions,
wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing each segment of reference transmissions to the corresponding segment of production transmissions.
26. The media of claim 20 , wherein the target transaction and the reference transaction includes an access to one or more identical items in a database.
27. The media of claim 20 , further including filtering the traffic information based on tiers of a network, and wherein the plurality of production transmissions correspond to transmissions between two tiers of the network.
28. The media of claim 27 , wherein at least one of the tiers includes multiple nodes.
29. The media of claim 28 , wherein comparing the sequence of reference transmissions to the production transmissions is based on the tiers of the network, independent of the multiple nodes at the at least one of the tiers.
30. The media of claim 20 , wherein the reference transmissions and the production transmissions conform to a packet-based protocol, such that the reference transmissions correspond to reference packets and the production transmissions correspond to production packets.
31. The media of claim 30 , wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing a size of one or more reference packets to a size of one or more of the production packets.
32. The media of claim 30 , wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing content of one or more of the reference packets to content of one or more of the production packets.
33. The media of claim 30 , wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes determining a measure of correlation between a plurality of the reference packets and a plurality of the production packets.
34. The media of claim 30 , wherein the program further causes the processing system to:
identify a subset of the reference transmissions that correspond to a subset of the production transmissions, and
partition the plurality of reference transmissions into segments of reference transmissions, and the plurality of production transmissions into corresponding segments of production transmissions, based on the subset of reference transmissions corresponding to the subset of production transmissions,
wherein comparing the sequence of reference transmissions to the plurality of production transmissions includes comparing each segment of reference transmissions to the corresponding segment of production transmissions.
35. The media of claim 30 , wherein the program further causes the processing system to filter the traffic information based on tiers of a network, and wherein the production packets correspond to packets communicated between two tiers of the network.
36. The media of claim 35 , wherein at least one of the tiers includes multiple nodes.
37. The media of claim 36 , wherein comparing the sequence of reference transmissions to the production transmissions is based on the tiers of the network, independent of the multiple nodes at the at least one of the tiers.