Distributed traffic analysis
A distributed system for analyzing traffic flow on a communications network architecture where a computer provides information over a data network to a concentrator, which provides a bridge between the computer and the end user terminals. The interface between the terminals and the concentrator is provided through access points for each workstation. The system to analyze the traffic is distributed into three components that perform, respectively, classification of the traffic flow, processing of the results of the classification, and handling of the processed results.
1. A distributed traffic analysis system for analyzing traffic flow on a data packet network communication link comprising terminals, access points, a concentrator, and a data network, wherein the access points are provided as interfaces between the terminals and the concentrator for each of the terminals, wherein the distributed traffic analysis system comprises:
a. embedded classification components hosted in at least some of the access points for performing classification and analysis of network traffic;
b. a management server configured to process results of the classification sent by the embedded classification components; and
c. at least one network operating system adapted to use the classified information pertaining to the classification of the traffic processed by the management server to generate a comprehensive analysis of the traffic,
wherein the system further comprises a communication protocol managed by the embedded classification components for providing a communication means between the embedded classification components and the management server,
said communication protocol being configured to encapsulate the information within the traffic flow by modifying the content of the packets intended to carry optional information.
2. The system according to claim 1 , wherein the communication protocol is configured to use a proprietary signaling between the embedded classification components and the management server.
3. The system according to claim 1 , wherein the communication protocol is configured to use a standardized signaling between the embedded classification components and the management server.
4. The system according to claim 1 , wherein the communication protocol is configured to generate a tunnel between the embedded classification components and the management server.
5. The system of claim 1 , wherein the management server is configured to process the classified information pertaining to the classification of the traffic flow by consolidating and storing the classified traffic.
6. The system of claim 1 , wherein the management server is configured to process the classified information pertaining to the classification of the traffic flow by counting the classified traffic.
7. The system of claim 1 , wherein the management server is configured to process the classified information pertaining to the classification of the traffic flow by establishing statistical information.
8. The system of claim 1 , wherein the comprehensive analysis of the traffic flow is used by a billing service.
9. The system of claim 1 , wherein the system further comprises a hierarchical analyzing system comprising analyzers adapted for serially performing different levels of analysis at successive different layers of analysis, wherein the packets analyzed at a given level of analysis are forwarded to a next successive layer for additional analysis, and the additional analysis performed at the next layer profits from the analysis performed by the previous given level of analysis.
10. A method for analyzing traffic flow on a network communication link wherein network information is provided over a data network received by a concentrator, and wherein access points are provided as interfaces between the terminals and the concentrator for each of the terminals, wherein the method comprises:
hosting embedded classification components in the access points to perform classification and analysis of the traffic flow;
processing results of the classification sent by the embedded classification components using a management server;
using the classified information pertaining to the classification of the traffic processed by the management server using at least one network operation system; and
generating a comprehensive analysis of the traffic flow,
wherein the method further comprises providing a communication means between the embedded classification components and the management server via a communication protocol managed by the embedded classification components, and said communication protocol encapsulates the information within the traffic flow comprised of packets, and modifies the content of the packets intended to carry optional information.
11. The method according to claim 10 , wherein the communication protocol uses a proprietary signaling between the embedded classification components and the management server.
12. The method according to claim 10 , wherein the communication protocol uses a standardized signaling between the embedded classification components and the management server.
13. The method according to claim 10 , wherein the communication protocol generates a tunnel between the embedded classification components and the management server.
14. The method of claim 10 , wherein the management server processes the classified information pertaining to the classification of the traffic flow by filtering the classified traffic.
15. The method of claim 10 , wherein the management server processes the classified information pertaining to the classification of the traffic flow by counting the classified traffic.
16. The method of claim 10 , wherein the management server processes the classified information pertaining to the classification of the traffic flow by establishing statistical information.
17. The method of claim 10 , wherein generating the comprehensive analysis of the traffic flow is used by a billing service.