Method and system for network monitoring using signature packets
A method of monitoring a network with a test device connected to the network includes monitoring a plurality of packets which pass through the test device, comparing a predefined field of each of the plurality of packets to a predefined pattern so as to identify signature packets, evaluating whether the signature packets satisfy a predefined condition, and, if the predefined condition is satisfied, sending a notification to a user. A system implementing the method is provided.
1. A device comprising:
a memory configured to store instructions; and
a processor configured to execute the instructions to:
receive a packet that includes one or more Quality of Service (QoS) fields;
compare a value associated with the packet to stored values to identify signature information;
determine, using a rule and based on comparing the value associated with the packet to the stored values, whether the signature information satisfies a particular condition,
the rule corresponding to a signature associated with the signature information, and
the particular condition including one of:
a period of time, associated with receiving the packet and another packet, satisfying a threshold time value, or
a quantity of the one or more QoS fields, associated with the packet, having a respective value that matches; and
selectively transmit, based on determining whether the signature information satisfies the particular condition, a notification that indicates a potential problem affecting one or more real time network services.
2. The device of claim 1 , where the packet is transmitted from a source device and intended for a destination device,
the device being different than the source device and different than the destination device.
3. The device of claim 1 , where the processor is further configured to:
transmit, when the period of time associated with receiving the packet and the other packet does not satisfy the threshold time value, the notification.
4. The device of claim 1 , where the processor is further configured to:
transmit, when the respective values do not match, the notification.
5. The device of claim 1 , where the processor is further configured to:
transmit the signature information to a source device.
6. The device of claim 1 , where the device monitors a plurality of packets, transmitted from a source device to a destination device, using passive monitoring and active testing.
7. The device of claim 1 , where the one or more Quality of Service (QoS) fields include at least one of a Virtual Local Area Network (VLAN) field, an Internet Protocol (IP) field, or a Multiprotocol Label Switching (MPLS) field.
8. A method comprising:
receiving, by a device and from a sensor device, a packet that includes one or more Quality of Service (QoS) fields;
comparing, by the device, a value associated with the packet to stored values to identify signature information;
determining, by the device, using a rule, and based on comparing the value associated with the packet to the stored values, whether the signature information satisfies a particular condition,
the rule corresponding to a signature associated with the signature information, and
the particular condition including at least one of:
a period of time, associated with receiving the packet and another packet, satisfying a threshold time value,
a quantity of the one or more QoS fields, associated with the packet, having a respective value that matches, or
a difference between a first quantity of packets, identified by the sensor device, and a second quantity of packets, identified by another sensor device, satisfying a threshold value; and
selectively transmitting, by the device and based on determining whether the signature information satisfies the particular condition, a notification that includes a potential problem affecting one or more real time networks.
9. The method of claim 8 , further comprising:
transmitting, when the period of time associated with receiving the packet and the other packet does not satisfy the threshold time value, the notification.
10. The method of claim 8 , further comprising:
transmitting, when the respective values do not match, the notification.
11. The method of claim 8 , where
the first quantity of packets and the second quantity of packets each include a respective timestamp, and
the method further includes:
determining, based on the respective timestamp, whether a delay satisfies another threshold value,
the delay being based on when the sensor device receives the packet and when the other sensor device receives the other packet; and
transmitting, when the delay does not satisfy the other threshold value, the notification.
12. The method of claim 8 , further comprising:
transmitting, when the difference between the first quantity of packets and the second quantity of packets does not satisfy the threshold value, the notification.
13. The method of claim 8 , further comprising:
counting the first quantity of packets; and
counting the second quantity of packets.
14. The method of claim 8 , where the one or more Quality of Service (QoS) fields include at least one of a Virtual Local Area Network (VLAN) field, an Internet Protocol (IP) field, or a Multiprotocol Label Switching (MPLS) field.
15. A device comprising:
a memory configured to store instructions; and
a processor configured to execute the instructions to:
receive, from a sensor device, a packet that includes one or more Quality of Service (QoS) fields;
compare a value associated with the packet to stored values to identify signature information;
determine, using a rule and based on comparing the value associated with the packet to the stored values, whether the signature information satisfies a particular condition,
the rule corresponding to a signature associated with the signature information, and
the particular condition including at least one of:
a period of time, associated with receiving the packet and another packet, satisfying a threshold time value,
a quantity of the one or more QoS fields, associated with the packet, having a respective value that matches, or
a difference between a first quantity of packets, identified by the sensor device, and a second quantity of packets, identified by another sensor device, satisfying a threshold value; and
selectively transmit, based on determining whether the signature information satisfies the particular condition, a notification that indicates a potential problem affecting one or more real time network services.
16. The device of claim 15 , where the processor is further configured to:
transmit, when the difference between the first quantity of packets and the second quantity of packets does not satisfy the threshold value, the notification.
17. The device of claim 15 , where the processor is further configured to:
transmit, when the period of time associated with receiving the packet and the other packet does not satisfy the threshold time value, the notification.
18. The device of claim 15 , where the processor is further configured to:
transmit, when the respective values do not match, the notification.
19. The device of claim 15 , where
the first quantity of packets and the second quantity of packets each include a respective timestamp, and
the processor is further configured to:
determine, based on the respective timestamp, whether a delay satisfies another threshold value,
the delay being associated based on when the sensor device receives the packet and when the other sensor device receives the other packet; and
transmit, when the delay does not satisfy the other threshold value, the notification.
20. The device of claim 15 , where the one or more Quality of Service (QoS) fields include at least one of a Virtual Local Area Network (VLAN) field, an Internet Protocol (IP) field, or a Multiprotocol Label Switching (MPLS) field.