Media slice tracking in a communications network using data packet comparison

1. A method, performed by a remote capture server, for tracking a media slice through at least part of a communications network comprising a plurality of network elements, the method comprising:

inspecting a first payload of a first data packet observed at an egress capture point of a first network element;

inspecting a second payload of a second data packet observed at an ingress capture point of a second network element;

comparing the first payload with the second payload;

determining that the first payload and the second payload comprise same content;

associating the first data packet with the second data packet; wherein

the first and second data packets correspond to a first media slice;

inspecting a third payload or metadata of a third data packet observed at the ingress capture point of the second network element;

inspecting a fourth payload or metadata of a fourth data packet observed at the egress capture point of the second network element;

comparing the third payload or metadata of the third data packet with the fourth payload or metadata of the fourth data packet;

determining the third payload or metadata of the third data packet and the fourth payload or metadata of the fourth data packet comprise same content;

associating the third data packet with the fourth data packet, wherein the third and fourth data packets correspond to a second media slice;

determining that the second data packet and the third data packet comprise same content:

associating the first, second or third, and fourth data packets; and

recording the first and second media slices as a common media slice.

2. The method of claim 1 , further comprising in response to determining the first, second or third, and fourth data packets are associated:

inspecting a first timestamp assigned to the first data packet, wherein the first timestamp is generated by the first network element;

inspecting a second timestamp assigned to the second or third data packet, wherein the second timestamp is generated by the second network element;

inspecting a third timestamp assigned to the fourth data packet, wherein the third timestamp is generated by the second network element;

inspecting a fourth timestamp assigned to a fifth data packet, wherein the fifth data packet is recorded at the ingress of the first network element and the fifth data packet is associated with the fourth data packet, wherein the fourth timestamp is generated by the first network element;

estimating a time offset between the first and second network elements using a difference between the first and second timestamp and a difference between the third and fourth timestamp;

applying the time offset to the first, second, third and fourth timestamps to generate first, second, third and fourth corrected timestamps; and

recording, in a log, the first, second, third, and fourth corrected timestamps with the first, second or third, fourth, and fifth data packets.

3. The method of claim 2 , further comprising ordering at least one of the first, second, third, fourth, and fifth data packets according to values of the corrected timestamps for the first, second, third, fourth, and fifth data packets.

4. The method of claim 2 , wherein the estimation of the time offset is at most the difference between first and second timestamps.

5. The method of claim 2 , wherein the estimation of the time offset is at least the difference between the third and fourth timestamps.

6. The method of claim 1 , further comprising generating a graphical representation of the first and second network elements and the first and second media slices for display to a user.

7. A remote capture server for tracking a media slice through at least part of a communications network comprising a plurality of network elements, the remote capture server comprising a memory and a processor, the memory storing thereon computer-executable instructions that, when executed by the processor, cause the remote capture server to perform operations comprising:

inspect a first payload of a first data packet observed at an egress capture point of a first network element;

inspect a second payload of a second data packet observed at an ingress capture point of a second network element;

compare the first payload with the second payload;

associate the first data packet with the second data packet in response to determining that the first payload and the second payload are identical; wherein

the first and second data packets correspond to a first media slice when the first and second data packets are associated;

inspect a third payload and/or metadata of a third data packet observed at the ingress capture point of the second network element;

inspect a fourth payload or metadata of a fourth data packet observed at the egress capture point of the second network element;

compare the third payload or metadata of the third data packet with the fourth payload or metadata of the fourth data packet;

associate the third data packet with the fourth data packet in response to determining the third payload or metadata of the third data packet and the fourth payload or metadata of the fourth data packet are identical; wherein

the third and fourth data packets correspond to a second media slice when the third and fourth data packets are associated;

in response to determining that the second data packet and the third data packet are identical:

associate the first, second or third, and fourth data packets; and

record the first and second media slices as a common media slice; and

in response to determining that the second data packet and the third data packet are not identical data packets:

record the first and second media slices as different media slices.

8. The remote capture server of claim 7 , further comprising computer-executable instructions that, when executed by the processor, cause the remote capture server to perform operations comprising:

in response to determining that the first, second or third, and fourth data packets are associated:

inspect a first timestamp assigned to the first data packet, wherein the first timestamp is generated by the first network element;

inspect a second timestamp assigned to the second or third data packet, wherein the second timestamp is generated by the second network element;

inspect a third timestamp assigned to the fourth data packet, wherein the third timestamp is generated by the second network element;

inspect a fourth timestamp assigned to a fifth data packet, wherein the fifth data packet is recorded at the ingress of the first network element and the fifth data packet is associated with the fourth data packet, wherein the fourth timestamp is generated by the first network element;

estimate a time offset between the first and second network elements using a difference between the first and second timestamp and a difference between the third and fourth timestamp;

apply the time offset to the first, second, third and fourth timestamps to generate first, second, third and fourth corrected timestamps; and

record in a log the corrected first, second, third, and fourth timestamps with the first, second or third, fourth, and fifth data packets.

9. The remote capture server of claim 8 , further comprising computer-executable instructions that, when executed by the processor, cause the remote capture server to perform operations comprising: order at least one of the first, second, third, fourth and fifth data packets according to values of the corrected timestamps for the first, second, third, fourth and fifth data packets.

10. The remote capture server of claim 8 , wherein the estimation of the time offset is at most the difference between first and second timestamps.

11. The remote capture server of claim 8 , wherein the estimation of the time offset is at least the difference between the third and fourth timestamps.

12. The remote capture server of claim 8 , wherein the estimation of the time offset is repeated for data packets received subsequent to the fifth data packet and previous time offset estimations are discarded.

13. The remote capture server of claim 8 , further comprising computer-executable instructions that, when executed by the processor, cause the remote capture server to perform operations comprising:

prior to inspecting, receiving copies of the first, second, third, fourth and fifth data packets; and

encapsulating the copies of the first, second, third, fourth and fifth data packets in additional data packets such that the first, second, third, fourth and fifth data packets are unchanged when sending the copies to the remote capture server.

14. The remote capture server of claim 7 , further comprising computer-executable instructions that, when executed by the processor, cause the remote capture server to perform operations comprising: generate a graphical representation of the first and second network elements and the first and second media slices for display to a user.

15. The remote capture server of claim 7 , wherein comparing the third payload or metadata of the third data packet and the fourth payload or metadata of the fourth data packet comprises at least one of:

inspecting and comparing the payloads of the third and fourth data packets; or

assessing whether the third and fourth data packets are equal under a process of transcoding; or

assessing a transrating protocol from the metadata of the third and fourth data packets.

16. The remote capture server of claim 15 , wherein the comparing the payload or metadata of the third data packet and the payload or metadata of the fourth data packet is selected based on a central processing unit (CPU) resource value of the remote capture server.

17. The remote capture server of claim 7 , further comprising computer-executable instructions that, when executed by the processor, cause the remote capture server to perform operations comprising:

in response to comparing the first and second data packets, identifying differences and commonalities between the first and second data packets;

recording the differences and commonalities between the first and second data packets in a log;

in response to comparing the third and fourth data packets, identifying differences and commonalities between the third and fourth data packets; and

recording the differences and commonalities between the third and fourth data packets in the log.

18. The remote capture server of claim 17 , wherein the differences or commonalities between the first and second data packets and between third and fourth data packets are at least one of: one or more layer headers, a service delivery platform, the corresponding payload, or the metadata.

19. A computer-readable storage medium comprising instructions which, when executed by a processor of a computing device, cause the computing device to perform operations for tracking a media slice through at least part of a communications network comprising a plurality of network elements, the operations comprising:

inspecting a first payload of a first data packet observed at an egress capture point of a first network element;

inspecting a second payload of a second data packet observed at an ingress capture point of a second network element;

comparing the first payload with the second payload;

associating the first data packet with the second data packet in response to determining that the first payload and the second payload are identical; wherein

the first and second data packets correspond to a first media slice when the first data packet with the second data packet are associated;

inspecting a third payload or metadata of a third data packet observed at the ingress capture point of the second network element;

inspecting a fourth payload or metadata of a fourth data packet observed at the egress capture point of the second network element;

comparing the third payload or metadata of the third data packet with the fourth payload or metadata of the fourth data packet;

associating the third data packet with the fourth data packet in response to determining the third payload or metadata of the third data packet and the fourth payload or metadata of the fourth data packet are identical wherein

the third and fourth data packets correspond to a second media slice when the third and fourth data packets are associated;

in response to determining that the second data packet and the third data packet are identical:

associating the first, second or third, and fourth data packets; and

recording the first and second media slices as a common media slice; and

in response to determining that the second data packet and the third data packet are not identical:

recording the first and second media slices as different media slices.

20. The computer-readable storage medium of claim 19 , further comprising instructions which, when executed by the processor of the computing device, cause the computing device to perform operations comprising:

in response to determining that the first, second or third, and fourth data packets are associated:

inspecting a first timestamp assigned to the first data packet, wherein the first timestamp is generated by the first network element;

inspecting a second timestamp assigned to the second or third data packet, wherein the second timestamp is generated by the second network element;

inspecting a third timestamp assigned to the fourth data packet, wherein the third timestamp is generated by the second network element;

inspecting a fourth timestamp assigned to a fifth data packet, wherein the fifth data packet is recorded at the ingress of the first network element and the fifth data packet is associated with the fourth data packet, wherein the fourth timestamp is generated by the first network element;

estimating a time offset between the first and second network elements using a difference between the first and second timestamp and a difference between the third and fourth timestamp;

applying the time offset to the first, second, third and fourth timestamps to generate first, second, third and fourth corrected timestamps; and

recording in a log the corrected first, second, third, and fourth timestamps with the first, second or third, fourth, and fifth data packets.