High efficiency network monitoring system and methods
A system and methods for monitoring wireless local area networks (WLAN) and reporting essential data is disclosed. The system optimizes and decides fundamentals before monitoring to enhance network monitoring efficiency. The system improves over prior problematic solutions that inefficiently monitor all data communicated over a network before filtering. The system may include instructions storable in memory to be executed by a processor. The system may include analytical engines, such as a resource analysis engine, fundamentals analysis engine, traffic analysis engine, optimization engine, and monitoring engine. The invention monitors subsets of the network traffic fundamentals that can be at least partially identified via metadata. The system may include exploring networks, identifying fundamentals of network traffic, assessing and evaluating the chosen fundamentals, optimizing fundamentals, and using a list of optimized fundamentals for network traffic monitoring.
1. A method for monitoring networks using a system comprising a processor and memory, the method comprising:
(a) mapping resources of the system to determine an analytic capacity;
(b) analyzing fundamentals respective to the analytic capacity to determine a subset of data to be analyzed, wherein the fundamentals are at least partially identifiable by analyzing metadata of network traffic;
(c) analyzing the metadata for the fundamentals in the subset to determine a wireless connection to be monitored, further comprising:
(i) scanning the networks in user mode to determine routers on each channel,
(ii) placing the routers detected in a router list,
(iii) scanning the networks in monitor mode to determine users connected to the networks,
(iv) placing the users detected in a user list, and
(v) analyzing the router list and the user list to determine the network traffic for monitoring to be placed in a traffic list;
(d) optimizing the subset for analysis efficiency, further comprising:
(i) analyzing the fundamentals in the traffic list,
(ii) removing the fundamentals that communicate the network traffic that is redundant from the traffic list,
(iii) ranking the fundamentals remaining in the traffic list according to analytical priority, and
(iv) designating the resources of the system to the each of the fundamentals to be analyzed;
(e) monitoring the network traffic relating to the fundamentals to be analyzed prior to expiration of a grand reset period; and
(f) resetting after the grand reset period has expired.
2. The method claim 1 , wherein step (a) further comprises:
(i) scanning the system to determine a processing capacity of the processor and a memory capacity of the memory;
(ii) scanning a network adapter of the system to determine a network capacity comprising connection speed and a level of network consumption;
(iii) comparing the processing capacity, the memory capacity, and the network capacity to determine a consumption threshold; and
(iv) determining the analytic capacity to not exceed the consumption threshold of a given period of analysis.
3. The method of claim 2 , wherein step (a) further comprises before operation (iii):
(v) scanning utilization of peripheral networks to determine a universal bandwidth capacity; and
wherein operation (iii) of step (a) further comprises comparing the universal bandwidth capacity with the processing capacity, the memory capacity, and the network capacity to determine the consumption threshold.
4. The method of claim 1 , wherein under step (c), scanning in monitor mode further comprises waking devices connected via the networks that are in sleep mode.
5. The method of claim 1 , wherein step (c) further comprises:
(vi) removing the routers not of interest from the router list;
(vii) removing the users not of interest from the user list; and
(viii) placing the network traffic not being monitored in a collecting list accessible for supplemental analysis when demanded and where the resources permit.
6. The method of claim 1 , wherein the step (c) further comprises analyzing ad-hoc network traffic and mesh network traffic operating at least partially within range of the networks to be monitored.
7. The method of claim 1 , wherein analyzing the metadata comprises extracting the metadata from a local monitor and sending at least part of the metadata to a remote server for additional analysis.
8. The method of claim 1 , wherein the grand reset period is independently definable for each of the networks.
9. A method for monitoring networks using a system comprising a processor and memory, the method comprising:
(a) analyzing fundamentals respective to an analytic capacity of the system to determine a subset of data to be analyzed, wherein the fundamentals are at least partially identifiable by analyzing metadata of a network traffic;
(b) analyzing the metadata for the fundamentals in the subset to determine a wireless connection to be monitored;
(c) optimizing the subset for analysis efficiency, further comprising:
(i) including the fundamentals to be analyzed in a traffic list,
(ii) analyzing the fundamentals in the traffic list,
(iii) removing the fundamentals that communicate the network traffic that is redundant from the traffic list,
(iv) ranking the fundamentals remaining in the traffic list according to analytical priority, and
(v) designating resources of the system to the each of the fundamentals to be analyzed;
(d) monitoring the network traffic relating to the fundamentals to be analyzed prior to expiration of a grand reset period; and
(e) resetting after the grand reset period has expired;
wherein the grand reset period is independently definable for each of the networks;
wherein the metadata is extractable using a local monitor;
wherein at least part of the metadata is transmittable to a remote server for additional analysis;
wherein ad-hoc network traffic and mesh network traffic operating at least partially within range of the networks to be monitored is detectable via the metadata and subject to analysis.
10. The method of claim 9 , further comprising before step (a):
(f) mapping the resources of the system to determine the analytic capacity.
11. The method claim 10 , wherein step (f) further comprises:
(i) scanning the system to determine a processing capacity of the processor and a memory capacity of the memory;
(ii) scanning a network adapter of the system to determine a network capacity comprising connection speed and a level of network consumption;
(iii) comparing the processing capacity, the memory capacity, and the network capacity to determine a consumption threshold; and
(iv) determining the analytic capacity to not exceed the consumption threshold for a given period of analysis.
12. The method of claim 11 , wherein step (f) further comprises before operation (iii):
(v) scanning utilization of peripheral networks to determine a universal bandwidth capacity; and
wherein operation (iii) of step (f) further comprises comparing the universal bandwidth capacity with the processing capacity, the memory capacity, and the network capacity to determine the consumption threshold.
13. The method of claim 9 , wherein step (b) further comprises:
(i) scanning the networks in user mode to determine routers on each channel;
(ii) placing the routers detected in a router list;
(iii) scanning the networks in monitor mode to determine users connected to the networks;
(iv) placing the users detected in a user list; and
(v) analyzing the router list and the user list to determine the network traffic for monitoring to be placed in a traffic list.
14. The method of claim 13 , wherein under step (b), scanning in monitor mode further comprises waking devices connected via the networks that are in sleep mode.
15. The method of claim 13 , wherein step (b) further comprises:
(vi) removing the routers not of interest from the router list;
(vii) removing the users not of interest from the user list; and
(viii) placing the network traffic not being monitored in a collecting list accessible for supplemental analysis when demanded and where the resources permit.
16. A system for monitoring networks comprising:
memory to hold executable instructions;
a processor for executing the instructions stored in the memory;
a resource analysis engine to map resources of the system to determine an analytic capacity;
a fundamentals analysis engine to analyze fundamentals respective to the analytic capacity and determine a subset of data to be monitored, wherein the fundamentals are at least partially identifiable by analyzing metadata of network traffic;
a traffic analysis engine for analyzing the metadata for the fundamentals in the subset to determine a wireless connection to be monitored, the traffic analysis engine performing the steps:
(a) scanning the networks in user mode to determine routers on each channel,
(b) placing the routers detected in a router list,
(c) removing the routers not of interest from the router list,
(d) scanning the networks in monitor mode to determine users connected to the networks,
(e) placing the users detected in a user list,
(f) removing the users not of interest from the user list,
(g) analyzing the router list and the user list to determine the network traffic for monitoring to be placed in a traffic list, and
(h) placing the network traffic not being monitored in a collecting list accessible for supplemental analysis when demanded and where the resources permit;
an optimization engine for optimizing the subset for analysis efficiency, the optimization engine performing the steps:
(i) analyzing the fundamentals in the traffic list,
(j) removing the fundamentals that communicate the network traffic that is redundant from the traffic list,
(k) ranking the fundamentals remaining in the traffic list according to analytical priority, and
(l) designating the resources of the system to each of the fundamentals to be analyzed; and
a monitoring engine to monitor the network traffic relating to the fundamentals to be analyzed prior to expiration of a grand reset period;
wherein monitoring of the network traffic is reset after the grand reset period has expired;
wherein the grand reset period is independently definable for each of the networks;
wherein scanning in monitor mode further comprises waking devices connected via the networks that are in sleep mode.
17. The system of claim 16 wherein the resource analysis engine further performs the steps:
(m) scanning the system to determine a processing capacity of the processor and a memory capacity of the memory;
(n) scanning a network adapter of the system to determine a network capacity comprising connection speed and a level of network consumption;
(o) comparing the processing capacity, the memory capacity, and the network capacity to determine the a consumption threshold; and
(p) determining the analytic capacity to not exceed the consumption threshold for a given period of analysis.
18. The system of claim 17 , wherein the resource analysis engine scans utilization of peripheral networks to determine a universal bandwidth capacity, and wherein the resource analysis engine compares the universal bandwidth capacity with the processing capacity, the memory capacity, and the network capacity to determine the consumption threshold.
19. The system of claim 16 , wherein ad-hoc network traffic and mesh network traffic operating at least partially within range of the networks is optionally monitored by the traffic analysis engine.
20. The system of claim 16 , wherein analyzing the metadata comprises extracting the metadata from a local monitor and sending at least part of the metadata to a remote server for additional analysis.