System and method for aggregating multi-protocol flows for network monitoring

1. A method for monitoring the operation of a telecommunications network, comprising:

displaying, on a user interface of a network monitoring system, a multi-protocol flow representing packets captured from the telecommunications network during a selected time period;

highlighting the multi-protocol flow on the user interface display if any session records within the multi-protocol flow do not meet operator-defined criteria;

detecting a user's selection of the multi-protocol flow;

displaying, on the user interface, a plurality of protocol-specific flows that are within the multi-protocol flow;

highlighting one or more of the protocol-specific flows on the user interface display if any session records within the protocol-specific flows do not meet operator-defined criteria;

detecting the user's selection of one of the protocol-specific flows;

displaying, on the user interface, a plurality of session flows that are within the selected protocol-specific flow;

highlighting any session records on the user interface display that do not meet operator-defined criteria;

detecting the operator's selection of one of session flows;

displaying, on the user interface, a plurality of packets that are within the selected session flow;

wherein the method aggregates session flows in a hierarchical manner to identify errors in a lower layer of the hierarchy.

2. The method of claim 1 , wherein the highlighting comprises assigning a color on the user interface display.

3. The method of claim 1 , wherein the protocol-specific flows comprise packets associated with a protocol selected from the group consisting of: email protocols, VoIP protocols, and video streaming protocols.

4. A system for monitoring IP flows in a telecommunications network, comprising:

a plurality of monitor probes coupled to links in the telecommunications network, the monitor probes configured to capture data packets from the links and correlating the data packets into session records;

a processor coupled to the monitor probe, the processor configured to analyze the session records to determine if the session records meet predetermined criteria; and

a user-interface coupled to the processor, the user interface configured to:

display a multi-protocol flow representing packets captured from the telecommunications network during a selected time period;

highlight the multi-protocol flow if any session records within the multi-protocol flow do not meet operator-defined criteria;

detect a user's selection of the multi-protocol flow;

display a plurality of protocol-specific flows that are within the multi-protocol flow;

highlight one or more of the protocol-specific flows if any session records within the protocol-specific flows do not meet operator-defined criteria;

detect the user's selection of one of the protocol-specific flows;

display a plurality of session flows that are within the selected protocol-specific flow;

highlight any session records that do not meet operator-defined criteria; detect the operator's selection of one of session flows;

display a plurality of packets that are within the selected session flow;

wherein the system aggregates session flows in a hierarchical manner to identify errors in a lower layer of the hierarchy.

5. A non transitory computer program product that includes a non-transitory computer readable medium useable by a computer system, the medium having stored thereon a sequence of instructions which, when executed by a computer system, causes the computer system to:

display, on a user interface, a multi-protocol flow representing packets captured from the telecommunications network during a selected time period;

highlight the multi-protocol flow on the user interface display if any session records within the multi-protocol flow do not meet operator-defined criteria;

detect a user's selection of the multi-protocol flow;

display, on the user interface, a plurality of protocol-specific flows that are within the multi-protocol flow;

highlight one or more of the protocol-specific flows on the user interface display if any session records within the protocol-specific flows do not meet operator-defined criteria;

detect the user's selection of one of the protocol-specific flows;

display, on the user interface, a plurality of session flows that are within the selected protocol-specific flow;

highlight any session records on the user interface display that do not meet operator-defined criteria;

detect the operator's selection of one of session flows;

display, on the user interface, a plurality of packets that are within the selected session flow;

wherein the computer program aggregates session flows in a hierarchical manner to identify errors in a lower layer of the hierarchy.