System and method for network analysis
View Patent ↗A method of evaluating the performance of a network at an edge device of a provider network includes receiving a plurality of packets associated with a plurality of customers and copying the header information for each of the plurality of packets. The method also includes identifying one of the plurality of customers for each of the plurality of packets and storing the header information for each of the plurality of packets in a database associated with the identified customer.
1. A method of evaluating the performance of a network at an edge device of a provider network, the method comprising:
receiving a plurality of packets associated with a plurality of customers;
copying the header information for each of the plurality of packets;
identifying one of the plurality of customers for each of the plurality of packets;
storing the header information for each of the plurality of packets in a database associated with the identified customer;
generating statistical information in response to the stored header information, the statistical information being associated with an application associated with the identified customer; and
storing the header information and the statistical information in a second database associated with the identified customer and the application, wherein storing the header information and the statistical information further comprises storing the header information and the statistical information in at least one file associated with each network connection.
2. The method of claim 1 , wherein copying the header information includes mirroring the plurality of packets using a raw socket interface to an Ethernet interface, the raw socket interface using a packet capture application.
3. The method of claim 1 , wherein storing the header information includes mapping the header information for each of the plurality packets into the database associated with the identified customer.
4. The method of claim 1 , and further comprising determining a packet count that is associated with each source address, destination address, transport protocol, source port, and destination port included in the stored header information, the packet count being determined for a particular interval of time.
5. The method of claim 1 , and further comprising determining a byte count that is associated with each source address, destination address, transport protocol, source port, and destination port included in the stored header information, the byte count being determined for a particular interval of time.
6. The method of claim 1 , wherein the stored header information is forwarded to a second database associated with the network at regular intervals, the stored header information being forwarded using a network distribution layer.
7. The method of claim 1 , wherein the stored header information is forwarded in further packets over a network to a database, the stored header information being forwarded using check-summing of such further packets prior to and following the forwarding of the further packets to the database.
8. The method of claim 1 , and further comprising generating statistical information in response to the stored header information.
9. The method of claim 1 , and further comprising:
generating statistical information in response to the stored header information, the statistical information being associated with an application associated with the identified customer; and
storing the header information and the statistical information in a further database associated with the identified customer and the application.
10. The method of claim 1 , wherein storing the header information and the statistical information in at least one file associated with each network connection further includes storing the header information and the statistical information in at least one file associated with each direction of communication associated with the network connection.
11. The method of claim 10 , and further comprising presenting network performance information in response to a query of the database including a start time and a stop time, the presented network performance information associated with an interval defined by the start time and the stop time.
12. The method of claim 10 , and further comprising presenting a portion of the header information in response to a query of the database including a start time and a stop time, the portion of the header information being associated with packets communicated over the network connection during an interval defined by the start time and the stop time.
13. A system for evaluating the communication of customer information on a provider network, the system comprising:
an edge device operable to receive a plurality of packets associated with a plurality of customers;
a packet capture application in communication with the edge device and operable to copy the header information for each of the plurality of packets;
a mapping application in communication with the packet capture application and operable to identify one of the plurality of customers for each of the plurality of packets; and
a memory in communication with the mapping application and operable to store the header information for each of the plurality of packets, the memory including data files associated with each of the identified customers, wherein statistical information is generated in response to the stored header information, the statistical information being associated with an application associated with the identified customer; and
a database in communication with the network the database associated with the identified customer and the application, wherein the stored header information is communicated to the database from the memory, wherein the header information and the statistical information is stored in at least one file associated with each network connection.
14. The system of claim 13 , wherein the data files including fields associated with each source address, destination address, transport protocol, source port, and destination port included in the stored header information.
15. The system of claim 13 , wherein the database includes data associated with each of the identified customers.
16. The system of claim 13 , wherein each file includes data associated with each application used by the identified customer.
17. The system of claim 16 , wherein each subfile includes further data associated with each network connection used to communicate data for the application.
18. The system of claim 17 , wherein each further subfile includes additional data associated with each direction of communication associated with the network connection.