Granted Patent B2

US 12,670,003 · App. 17/570,179 · Granted Jun 30, 2026

Inventors: Khawar Deen (Sunnyvale, CA); Navindra Yadav (Cupertino, CA); Anubhav Gupta (Fremont, CA); Shashidhar Gandham (Fremont, CA); Rohit Chandra Prasad (Sunnyvale, CA); Abhishek Ranjan Singh (Pleasanton, CA); Shih-Chun Chang (San Jose, CA)

Assignee: Cisco Technology, Inc.

G06F9/45558G06F3/0482G06F3/04842G06F3/04847G06F16/122G06F16/137G06F16/162G06F16/17G06F16/173G06F16/174G06F16/1744G06F16/1748G06F16/2322G06F16/235G06F16/2365G06F16/24578G06F16/248G06F16/285G06F16/288G06F16/29G06F16/9535G06F21/53G06F21/552G06F21/556G06F21/566G06N20/00G06N99/00G06T11/26H04J3/0661H04J3/14H04L1/242H04L7/10H04L9/0866H04L9/3239H04L9/3242H04L41/046H04L41/0668H04L41/0803H04L41/0806H04L41/0816H04L41/0893H04L41/0894H04L41/12H04L41/16H04L41/22H04L41/40H04L43/02H04L43/026H04L43/04H04L43/045H04L43/062H04L43/08H04L43/0805H04L43/0811H04L43/0829H04L43/0841H04L43/0858H04L43/0864H04L43/0876H04L43/0882H04L43/0888H04L43/10H04L43/106H04L43/12H04L43/16H04L43/20H04L45/306H04L45/38H04L45/46H04L45/507H04L45/66H04L45/74H04L47/11H04L47/20H04L47/2441H04L47/2483H04L47/28H04L47/31H04L47/32H04L61/5007H04L63/0227H04L63/0263H04L63/06H04L63/0876H04L63/1408H04L63/1416H04L63/1425H04L63/1433H04L63/1441H04L63/145H04L63/1458H04L63/1466H04L63/16H04L63/20H04L67/01H04L67/10H04L67/1001H04L67/12H04L67/51H04L67/75H04L69/16H04L69/22H04W72/54H04W84/18G06F2009/4557G06F2009/45587G06F2009/45591G06F2009/45595G06F2221/033G06F2221/2101G06F2221/2105G06F2221/2111G06F2221/2115G06F2221/2145H04L67/535

Abstract

Claims (54)

1 . A computer-implemented method, comprising:

receiving, by a device, network activity data from a first sensor and a second sensor, wherein the first and second sensors are associated with a network node relative to a clock of the network node and wherein the network activity data is associated with at least one timestamp and the network activity data includes network traffic traversing a network;

determining a delta between the at least one timestamp and a second timestamp determined by the device relative to a clock of the device;

determining a latency of a communication channel between the device and the network node;

adjusting the delta based on the latency;

generating a report that includes a new timestamp by synchronizing the at least one timestamp and second timestamp with the adjusted delta associated with the network activity data; and

synchronizing the report with a plurality of other reports from network activity data of a plurality of other sensors.

2 . The method of claim 1 , wherein the at least one timestamp indicates when the sensor sent a report to a collector and is based on a clock of the network node.

3 . The method of claim 1 , further comprising:

generating a timeline from the report and a plurality of other reports from other devices.

4 . The method of claim 1 , wherein the latency is determined on a periodic basis.

5 . The method of claim 1 , wherein the latency is precalculated.

6 . The method of claim 1 , determining the latency further comprising:

sending a request message to the sensor;

receiving an automatic reply packet from the sensor;

determining a timestamp of when the automatic reply packet was received; and

determining the latency based on the timestamp of when the automatic reply packet was received and a timestamp of when the request message was sent.

7 . A device, comprising:

one or more processors;

memory including instructions that, when executed by the one or more processors, cause the device to:

receive network activity data from a first sensor and a second sensor, wherein the first and second sensors are associated with a network node relative to a clock of the network node and wherein the network activity data is associated with at least one timestamp and the network activity data includes network traffic traversing a network;

determine a delta between the at least one timestamp and a second timestamp determined by the device relative to a clock of the device;

determine a latency of a communication channel between the device and the network node;

adjust the delta based on the latency;

generate a report that includes a new timestamp by synchronizing the at least one timestamp and second time stamp with the adjusted delta associated with the network activity data; and

synchronizing the report with a plurality of other reports from network activity data of a plurality of other sensors.

8 . The device of claim 7 , wherein the at least one timestamp indicates when the first or second sensor sent a report to a collector and is based on a clock of the network node.

9 . The device of claim 7 , further comprising instructions, which when executed by the one or more processors, cause the device to:

generate a timeline from the report and a plurality of other reports from other devices.

10 . The device of claim 7 , wherein the latency is determined on a periodic basis.

11 . The device of claim 7 , wherein the latency is precalculated.

12 . The device of claim 7 , further comprising instructions, which when executed by the one or more processors, cause the device to:

send a request message to the sensor;

receive an automatic reply packet from the sensor;

determine a timestamp of when the automatic reply packet was received; and

determine the latency based on the timestamp of when the automatic reply packet was received and a timestamp of when the request message was sent.

13 . A non-transitory computer-readable medium including instructions that, when executed by one or more processors of a device, cause the device to:

receive network activity data from a first sensor and a second sensor, wherein the first and second sensors are associated with a network node relative to a clock of the network node and wherein the network activity data is associated with at least one timestamp and the network activity data includes network traffic traversing a network;

determine a delta between the at least one timestamp and a second timestamp determined by the device relative to a clock of the device;

determine a latency of a communication channel between the device and the network node;

adjust the delta based on the latency;

generate a report that includes a new timestamp by synchronizing the at least one timestamp and second time stamp with the adjusted delta associated with the network activity data; and

synchronizing the report with a plurality of other reports from network activity data of a plurality of other sensors.

14 . The non-transitory computer-readable medium of claim 13 ,

wherein the at least one timestamp indicates when the first or second sensor sent a report to a collector and is based on a clock of the network node.

15 . The non-transitory computer-readable medium of claim 13 , wherein the latency is determined on a periodic basis.

16 . The non-transitory computer-readable medium of claim 13 , wherein the latency is precalculated.

17 . The non-transitory computer-readable medium of claim 13 , further comprising instructions, which when executed by the one or more processors, cause the device to:

send a request message to the sensor;

receive an automatic reply packet from the sensor;

determine a timestamp of when the automatic reply packet was received; and

determine the latency based on the timestamp of when the automatic reply packet was received and a timestamp of when the request message was sent.

18 . The method of claim 1 , wherein the network node is a routing or switching device.

19 . The method of claim 1 , wherein the network node is a server.

Assignments (1)

Continuity (4)

References Cited (400)