摘要:
A cluster load balancer can be coupled to a network for monitoring network traffic. The cluster load balancer can include one or more computing devices. The one or more computing devices can be configured to receive a data packet, the data packet comprising a device identifier of a first device connected to a network for a communication session, wherein the data packet is a user plane data packet or a control plane data packet; generate a probe identification based on the device identifier of the first device in the data packet; add the probe identification to the data packet; and transmit the data packet with the probe identification to a second device in communication with a plurality of network probes. The second device can be configured to forward the data packet to a network probe of the plurality of network probes based on the probe identification in the data packet.
摘要:
A system and method is provided for calculating session initiation protocol (SIP) key performance indicators (KPIs) for multimedia communication in a network accessing network packets monitored over time. The method includes accessing network packets monitored over time, detecting a SIP response message of the monitored network packets, and accounting for the detected SIP response message in a time window of a series of consecutive time windows that includes the SIP response message's associated observed time. The SIP response message has an associated observed time at which the monitored SIP message was observed during monitoring. The method further includes pairing a SIP request message expected to be paired with the detected SIP response message with the detected SIP response message and accounting for the paired SIP request message in the time window with which the detected SIP response message is accounted. The method further includes calculating a KPI for the time window using the detected SIP response message and its paired SIP request message that are accounted for in the time window.
摘要:
A method for monitoring performance of customized applications at transaction level in a computer network is provided. The method includes receiving, from a user, information related to a customized application. The received information includes at least an application definition and information related to customized application protocol. A template is generated for the customized application based on the received information. Performance of the customized application is monitored at transaction level using the generated template.
摘要:
Actions of servers and other network devices within a network are monitored to detect whether the servers and network devices are performing tasks, using protocols, and communicating through ports that are consistent with legitimate (or “permissible”) purposes. That is, rather than attempting to belatedly identify malware signatures and screen all traffic into and out of a network for these signatures, embodiments of the present invention scrutinize devices (such as servers and other network infrastructure elements) for malware behavior that is inconsistent with an identified set of actions known to be consistent with legitimate tasks performed by the network device.
摘要:
A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.
摘要:
A method for determining Over-The-Top (OTT) applications includes receiving, by an active agent, a list of OTT service platforms to be monitored. The received list includes URLs associated with various applications that are delivered by the OTT service platforms. The active agent connects to the URLs to determine information uniquely identifying OTT applications. The active agent stores the information in a repository. A network monitor monitors data flows between a plurality of sources and destinations on a network. Each of the data flows includes a plurality of data packets of the various applications that are delivered OTT. The network monitor extracts at least a portion of header information from each of monitored data packets. The network monitor identifies an OTT application occurring on the network based on the extracted header information and based on the information uniquely identifying various applications stored in the repository.
摘要:
A system and computer-implemented method to manage alerts, wherein the method includes receiving anomaly triggers associated with detected anomalies, associating an anomaly trigger of the received anomaly triggers with an alert, tracking the alert using a state machine, determining whether to change a state of the state machine if a subsequent anomaly trigger associated with the alert is received or if a predetermined amount of time passes without receiving trigger information, and generating an alarm based on the state of the state machine.
摘要:
A method for performing root cause analysis of failures in a computer network is provided. The method includes receiving an Adaptive Service Intelligence (ASI) data set related to one or more failures reported in the computer network from a plurality of interfaces. One or more impact events associated with the reported failures are identified based on the received ASI data set. Each of the identified impact events is correlated with one or more cause events. A situation record is selectively generated based on the correlation results.
摘要:
A method for processing a plurality of fragments of IP packet flows in a communication network includes receiving the plurality of packet fragments. The received packet fragments are associated with one or more packet flows. A first set of packet flows is selected from the one or more received packet flows. The first set of packet flows corresponds to a subset of the plurality of packet segments received during a first predetermined time interval. Only packet fragments associated with the first set of packet flows are reassembled into full packets.