Methods and apparatus to credit streaming activity using domain level bandwidth information
Methods and apparatus to credit streaming activity using domain level bandwidth information are disclosed. An example apparatus includes a packet collector to collect data packets via a network interface, and a traffic analyzer to determine domain data of the data packets and associate bandwidth usage values with the domain data to define bandwidth usage data by domain. The apparatus also includes a bandwidth usage data storage to store the associated bandwidth usage data by domain.
1. An apparatus comprising:
a packet collector to collect data packets via a network interface;
a decryptor to decrypt the data packets;
a traffic analyzer to:
determine domain data of the decrypted data packets, and
associate bandwidth usage values with the domain data to define bandwidth usage data by domain;
a media event identifier to categorize ones of the domain data with a respective type of activity, the type of activity corresponding to categories of use-types of the ones of the domain data; and
a bandwidth usage data storage to store the associated bandwidth usage data by domain, the stored associated bandwidth usage data separated by the categories of use-types of the ones of the domain data.
2. The apparatus as defined in claim 1 , wherein at least one domain of the data packets is determined based on domain name server (DNS) data.
3. The apparatus as defined in claim 1 , wherein the bandwidth usage data includes histogram data separated by ones of multiple domains.
4. The apparatus as defined in claim 3 , wherein the histogram data is time-based.
5. The apparatus as defined in claim 1 , wherein the domain data is extracted from the data packets via a deep packet inspection of the data packets.
6. The apparatus as defined in claim 1 , wherein the bandwidth usage data includes bandwidth usage values at different times.
7. A method of metering internet usage, the method comprising:
collecting, by executing instructions with at least one processor, data packets;
decrypting, by executing instructions with the at least one processor, the data packets;
determining, by executing instructions with the at least one processor, domain data of the decrypted data packets;
associating, by executing instructions with the at least one processor, bandwidth usage values with the domain data to define bandwidth usage data by domain;
categorizing, by executing instructions with the at least one processor, ones of the domain data with a respective type of activity, the type of activity corresponding to categories of use-types of the ones of the domain data; and
storing, by executing instructions with the at least one processor, the associated bandwidth usage data by domain, the stored associated bandwidth usage data separated by the categories of use-types of the ones of the domain data.
8. The method as defined in claim 7 , wherein the domain data is determined based on aggregating domains of the decrypted packets.
9. The method as defined in claim 7 , wherein the domain data is determined based on domain name server (DNS) data.
10. The method as defined in claim 7 , further including generating, by executing instructions with the at least one processor, histogram data based on the domain data.
11. The method as defined in claim 7 , further including associating, by executing instructions with the at least one processor, at least one domain of the domain data with a type of data content to define the bandwidth usage data.
12. The method as defined in claim 7 , wherein the bandwidth usage data by domain includes bandwidth usage values at different times.
13. A non-transitory machine readable medium comprising instructions, which when executed, cause at least one processor to at least:
collect data packets;
decrypt the data packets;
determine domain data of the decrypted data packets;
associate bandwidth usage values with the domain data to define bandwidth usage data by domain;
categorize ones of the domain data with a respective type of activity, the type of activity corresponding to categories of use-types of the ones of the domain data; and
store the associated bandwidth usage data by domain, the stored associated bandwidth usage data separated by the categories of use-types of the ones of the domain data.
14. The non-transitory machine readable medium as defined in claim 13 , wherein the domain data is determined based on aggregating domains of the decrypted packets.
15. The non-transitory machine readable medium as defined in claim 13 , wherein the domain data is determined based on domain name server (DNS) data.
16. The non-transitory machine readable medium as defined in claim 13 , wherein the instructions cause the at least one processor to generate histogram data based on the domain data.
17. The non-transitory machine readable medium as defined in claim 13 , wherein the instructions cause the at least one processor to associate domain data with a type of data content to define the bandwidth usage data.
18. The apparatus as defined in claim 1 , wherein the domain data includes bandwidth usage of domains during different time periods.
19. The apparatus as defined in claim 18 , wherein the bandwidth usage data is aggregated to group the bandwidth usage data with corresponding domains.
20. The apparatus as defined in claim 19 , wherein a bandwidth usage value exceeding a threshold is to cause aggregation of the domains.
21. The apparatus as defined in claim 1 , wherein the decryptor is to decrypt headers of the data packets, and wherein the decryptor is to not decrypt payloads of the data packets.
22. The apparatus as defined in claim 1 , wherein the type of activity indicates streaming activity or non-streaming activity.
23. An apparatus comprising:
at least one memory;
instructions in the apparatus; and
processor circuitry to execute the instructions to:
decrypt collected data packets from a network interface,
determine domain data of the decrypted data packets,
associate bandwidth usage values with the domain data to define bandwidth usage data by domain,
categorize ones of the domain data with a respective type of activity, the type of activity corresponding to categories of use-types of the ones of the domain data, and
store the associated bandwidth usage data by domain, the stored associated bandwidth usage data separated by the categories of use-types of the ones of the domain data.
24. The apparatus as defined in claim 23 , wherein the processor circuitry is to determine the at least one domain of the data packets based on domain name server (DNS) data.
25. The apparatus as defined in claim 23 , wherein the bandwidth usage data includes histogram data separated by ones of multiple domains.
26. The apparatus as defined in claim 25 , wherein the histogram data is time-based.
27. The apparatus as defined in claim 23 , wherein the processor circuitry is to extract the domain data is extracted from the data packets via a deep packet inspection of the data packets.
28. The apparatus as defined in claim 23 , wherein the processor circuitry is to execute the instructions to group ones of the domain data based on similar IP address ranges.
29. The apparatus as defined in claim 24 , wherein the processor circuitry is to execute the instructions to determine the at least one of the domains based on a DNS request.
30. The apparatus as defined in claim 23 , wherein the processor circuitry is to execute the instructions to:
associate bandwidth usage values with the domain data that corresponds to a bandwidth usage event exceeding a threshold bandwidth usage; and
disregard ones of the domain data not corresponding the bandwidth usage event.
31. The apparatus as defined in claim 23 , wherein the processor circuitry is to execute the instructions to determine the at least one of the domains based on a DNS request.