Multi-protocol correlation for network subscriber troubleshooting
A method for multi-protocol monitoring and correlation includes aggregating captured network performance data including a plurality of captured network performance metrics for a plurality of subscriber session records associated with a plurality of protocols. A first level of correlation is performed between the plurality of subscriber session records using one or more direct correlation rules. The correlated subscriber session records associated with the plurality of protocols are related to the same subscriber session. A second level of correlation is performed between the correlated subscriber session records using one or more indirect correlation rules based on the performed first level of correlation.
1. A method for multi-protocol monitoring and correlation, the method comprising steps of:
monitoring, via a network monitoring device, an exchange of network data;
intercepting network data from the monitored network wherein the intercepted network data consists of captured user plane packets and control plane packets;
aggregating captured network performance data from the captured user plane packets and control plane packets, comprising a plurality of captured network performance metrics for a plurality of subscriber session records associated with a plurality of protocols;
performing a first level of correlation between the plurality of subscriber session records using one or more direct correlation rules, wherein the correlated subscriber session records associated with the plurality of protocols are related to a same subscriber session and wherein the first level of correlation is a shallow correlation whereby the protocols and child sessions are grouped and associated with the same subscriber session; and
performing a second level of correlation between the correlated subscriber session records using one or more indirect correlation rules based on the performed first level of correlation and wherein the second level of correlation is a deep correlation whereby the child sessions are grouped and associated with the same subscriber session per each protocol.
2. The method of claim 1 , wherein performing the second level of correlation further comprises correlating a first subscriber session record associated with a first protocol with a second subscriber session record associated with the first protocol using a third subscriber session record associated with a second protocol.
3. The method of claim 1 , wherein performing the first level of correlation further comprises correlating a first subscriber session record associated with a first protocol with a second subscriber session record associated with a second protocol.
4. The method of claim 3 , wherein the one or more direct correlation rules specifies a first attribute of the first protocol and a corresponding second attribute of the second protocol and wherein the first level of correlation is performed using the first attribute and the second attribute.
5. The method of claim 1 , wherein the one or more direct correlation rules specifies a time period associated with the performed first level of correlation.
6. The method of claim 1 , wherein the one or more indirect correlation rules specifies a time period associated with the performed second level of correlation.
7. The method of claim 1 , wherein the one or more direct correlation rules and the one or more indirect correlation rules are expressed in a natural language.
8. A system for multi-protocol monitoring and correlation, the system comprising:
a processor and a memory device coupled to the processor, the memory device containing a set of instructions that, when executed by the processor, cause the processor to:
monitor, via a network monitoring device, an exchange of network data;
intercept network data from the monitored network wherein the intercepted network data consists of captured user plane packets and control plane packets;
aggregate captured network performance data from the captured user plane packets and control plane packets, comprising a plurality of captured network performance metrics for a plurality of subscriber session records associated with a plurality of protocols;
perform a first level of correlation between the plurality of subscriber session records using one or more direct correlation rules, wherein the correlated subscriber session records associated with the plurality of protocols are related to a same subscriber session and wherein the first level of correlation is a shallow correlation whereby the protocols and child sessions are grouped and associated with the same subscriber session; and
perform a second level of correlation between the correlated subscriber session records using one or more indirect correlation rules based on the performed first level of correlation and wherein the second level of correlation is a deep correlation whereby the child sessions are grouped and associated with the same subscriber session per each protocol.
9. The system of claim 8 , wherein the set of instructions that, when executed by the processor, cause the processor to perform the second level of correlation further cause the processor to correlate a first subscriber session record associated with a first protocol with a second subscriber session record associated with the first protocol using a third subscriber session record associated with a second protocol.
10. The system of claim 8 , wherein the set of instructions that, when executed by the processor, cause the processor to perform the first level of correlation further cause the processor to correlate a first subscriber session record associated with a first protocol with a second subscriber session record associated with a second protocol.
11. The system of claim 10 , wherein the one or more direct correlation rules specifies a first attribute of the first protocol and a corresponding second attribute of the second protocol and wherein the first level of correlation is performed using the first attribute and the second attribute.
12. The system of claim 8 , wherein the one or more direct correlation rules specifies a time period associated with the performed first level of correlation.
13. The system of claim 8 , wherein the one or more indirect correlation rules specifies a time period associated with the performed second level of correlation.
14. The system of claim 8 , wherein the one or more direct correlation rules and the one or more indirect correlation rules are expressed in a natural language.
15. A tangible, non-transitory, computer-readable media having software encoded thereon, the software, when executed by a processor, operable to:
monitor, via a network monitoring device, an exchange of network data;
intercept network data from the monitored network wherein the intercepted network data consists of captured user plane packets and control plane packets;
aggregate captured network performance data from the captured user plane packets and control plane packets, comprising a plurality of captured network performance metrics for a plurality of subscriber session records associated with a plurality of protocols;
perform a first level of correlation between the plurality of subscriber session records using one or more direct correlation rules, wherein the correlated subscriber session records associated with the plurality of protocols are related to a same subscriber session and wherein the first level of correlation is a shallow correlation whereby the protocols and child sessions are grouped and associated with the same subscriber session; and
perform a second level of correlation between the correlated subscriber session records using one or more indirect correlation rules based on the performed first level of correlation and wherein the second level of correlation is a deep correlation whereby the child sessions are grouped and associated with the same subscriber session per each protocol.
16. The computer-readable media of claim 15 , wherein the software, when executed by the processor, operable to perform the second level of correlation is further operable to correlate a first subscriber session record associated with a first protocol with a second subscriber session record associated with the first protocol using a third subscriber session record associated with a second protocol.
17. The computer-readable media of claim 15 , wherein the software, when executed by the processor, operable to perform the first level of correlation is further operable to correlate a first subscriber session record associated with a first protocol with a second subscriber session record associated with a second protocol.
18. The computer-readable media of claim 17 , wherein the one or more direct correlation rules specifies a first attribute of the first protocol and a corresponding second attribute of the second protocol and wherein the first level of correlation is performed using the first attribute and the second attribute.