Network monitoring using virtual packets
View Patent ↗A network monitoring device includes a flow processing element, disposed to receive flow information relating to network flows, and to generate a set of virtual packets, each representing a portion of a network flow. The virtual packets are maintained in a time-sequential order, and read by elements of the network monitoring device to generate information relating to network traffic, such as symptoms affecting the communication network, problems affecting the communication network, and otherwise. The network monitoring device randomly samples virtual packets, with at least one of two effects: (1) flow information from traffic reporting devices that are themselves sampling at differing rates can be equalized, with the effect of standardizing information from all of them; (2) the network monitoring device itself can restrict its attention to a fraction of all virtual packets, with the effect of keeping up with a relatively large number of virtual packets.
1. A method, including steps of:
sampling, at a first predetermined rate, first flow information;
generating first virtual packets in response thereto,
said first virtual packets being equally distributed over a time reported for said first flow information;
sampling, at a second predetermined rate, second flow information;
generating second virtual packets in response thereto; and
recording, at a network monitoring device, only some of the first and second virtual packets whereby the recorded virtual packets represent equivalent sampling for both the first flow information and the second flow information.
2. A method as in claim 1 , including steps of reordering either the first or second virtual packets in a time sequential order.
3. A method as in claim 1 , including steps of writing the recorded virtual packets to a buffer in a time sequential order.
4. A method as in claim 1 , wherein
the predetermined rate is selected dynamically in response to the flow information.
5. A method as in claim 1 , further including:
profiling the recorded virtual packets.
6. A method as in claim 1 , wherein
either the first or the second flow information comprises crosspoints.
7. A method as in claim 6 , wherein
the crosspoints comprise one or more of either an identifier, application, location, interface or time periods.
8. A method as in claim 7 , wherein
the crosspoint information is stored for later operation.
9. A method as in claim 1 , wherein
said first virtual packets include no payload information.
10. A system comprising:
a first device having:
a flow processor for receiving flow information from a set of flow information gathering devices,
said flow processor configured to generate a sequence of virtual packets for each said flow, said sequence of virtual packets being equally distributed over a time for said flow, said time being reported after an end of said flow;
wherein a first sequence of virtual packets for a first flow is responsive to a first sampling rate of real packets reported in said flow information for said first flow,
wherein a second sequence of virtual packets for a second flow is responsive to a second sampling rate of real packets reported in said flow information for said second flow,
wherein said first and second sequences of virtual packets have equivalent sampling rates relative to real packets in said first and second flows;
a virtual packet buffer for storing virtual packets received from the flow processor;
a virtual bus coupled to the virtual packet buffer through either a discovery engine, a monitoring engine, a profiling engine or a detection engine.
11. The system of claim 10 wherein
the virtual bus is connected to a problem identification device for communicating symptom and user information.
12. The system of claim 10 wherein
the virtual bus is connected to the virtual bus of at least a second device having a flow processor and virtual packet buffer.
13. The system of claim 12 wherein
each device is assigned to monitor a subset of locations.
14. The system of claim 13 wherein
the locations are associated with a set of endpoints and a equal subset of applications and time intervals.
15. A system as in claim 10 , wherein
said first sequence of virtual packets include no payload information.
16. A non-transitory processor readable storage device having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method including steps of:
sampling, at a first predetermined rate, first flow information;
generating first virtual packets in response thereto,
said first virtual packets being equally distributed over a time reported for said first flow information;
sampling, at a second predetermined rate, second flow information;
generating second virtual packets in response thereto; and
recording some of the virtual packets whereby the recorded virtual packets represent equivalent sampling for both the first flow information and the second flow information.
17. The non-transitory processor readable storage device of claim 16 , wherein
the method further includes steps of reordering those virtual packets in a time sequence.
18. The non-transitory processor readable storage device of claim 16 , wherein
the method further includes steps of writing those the virtual packets to a buffer in a time sequential order.
19. The non-transitory processor readable storage device of claim 16 , wherein
the method further includes steps of recording only some of the virtual packets generated in response to either the first or the second flow information, whereby at least one element of a network monitoring device receives recorded virtual packets equivalent to sampling of either the first or the second flow information.
20. The non-transitory processor readable storage device of claim 16 , wherein
the method further includes profiling the recorded virtual packets.