Network monitoring using virtual packets
View Patent ↗A network monitoring device includes a flow processing element, disposed to receive flow information relating to network flows, and to generate a set of virtual packets, each representing a portion of a network flow. The virtual packets are maintained in a time-sequential order, and read by elements of the network monitoring device to generate information relating to network traffic, such as symptoms affecting the communication network, problems affecting the communication network, and otherwise. The network monitoring device randomly samples virtual packets, with at least one of two effects: (1) flow information from traffic reporting devices that are themselves sampling a differing rates can be equalized, with the effect of standardizing information from all of them; (2) the network monitoring device itself can restrict its attention to a fraction of all virtual packets, with the effect of keeping up with a relatively large number of virtual packets.
1. A method, including steps of
receiving flow information from one or more flow information gathering devices, after each particular flow associated with said flow information is complete;
generating virtual packets in response to said flow information, said virtual packets being equally distributed over a time duration indicated by said flow information;
receiving said virtual packets at a network monitoring device;
entering said virtual packets into a first buffer in an order in which said virtual packets are generated;
reordering said virtual packets into an order in which said virtual packets are sequentially distributed over each said time duration by each said flow information;
entering said virtual packets into a second buffer in response to said steps of reordering.
2. A method as in claim 1 , wherein
said steps of receiving said virtual packets are responsive to an order of said virtual packets in said second buffer.
3. A method as in claim 1 , including steps of recording only some of said virtual packets,
wherein said steps of receiving said virtual packets are with respect to a sampling of said flow information.
4. A method as in claim 3 , wherein
said steps of recording only some of said virtual packets include steps of selecting particular virtual packets for recording in response to a randomizing parameter.
5. A method as in claim 1 , wherein
said steps of generating provide virtual packets at a selected rate with respect to said time duration.
6. A method as in claim 5 , wherein
said selected rate is determined dynamically in response to said flow information.
7. A method as in claim 1 , wherein
said steps of receiving flow information include steps of receiving first flow information at a first sampling rate;
said steps of receiving flow information include steps of receiving second flow information at a second damping rate; and
said steps or receiving said virtual packets include receiving only some of the virtual packets provided by said steps of generating;
wherein said virtual packets represent equivalent sampling for said first flow information and said second flow information.
8. A method as in claim 1 , wherein
said virtual packets have no useful payload information.
9. A method, including steps of
receiving flow information from one or more reporting devices; generating virtual packets in response to said flow information for a particular flow, said virtual packets being representative of an amount of traffic reported for said particular flow;
coupling said virtual packets to a network monitoring device;
entering said virtual packets into a first buffer in an order in which said virtual packets are generated;
reordering said virtual packets into an order in which said virtual packets are sequentially distributed over said time duration indicated by said flow information for a particular flow, as if generated during said particular flow;
entering said virtual packets into a second buffer in response to said steps of reordering.
10. A method as in claim 9 , including steps of recording only some of said virtual packets,
wherein said steps of receiving said virtual packets are with respect to a sampling of said flow information.
11. A method as in claim 9 , including steps of recording only some of said virtual packets for a particular flow, wherein said steps of recording only some of virtual packets allow said virtual packets to be representative of an amount of traffic reported for said particular flow,
when recording all of said virtual packets associated with a said particular flow would be infeasible.
12. A method as in claim 11 , wherein
said steps of recording only some of said virtual packets include steps of selecting particular virtual packets for recording in response to a randomizing parameter.
13. A method as in claim 9 , wherein said steps of generating include steps of
providing said virtual packets equally distributed over a time duration reported for the start and end of said particular flow.
14. A method as in claim 9 , wherein said steps of generating include steps of
providing said virtual packets in a predetermined distribution, said predetermined distribution being representative of a number of packets reported for said particular flow.
15. A method as in claim 9 , wherein
said steps of generating provide virtual packets at a rate with respect to a said time duration.
16. A method as in claim 15 , wherein
said selected rate is determined dynamically in response to said flow information.