公开(公告)号：US20070028142A1

公开(公告)日：2007-02-01

申请号：US11397359

申请日：2006-04-04

申请人： Russell Elsner ,  John Strohm ,  Michael Canney

发明人： Russell Elsner ,  John Strohm ,  Michael Canney

IPC分类号： G06F11/00

CPC分类号： H04L43/0852 ,  H04L43/045 ,  H04L67/36

摘要： A graphic user interface facilitates the hierarchical analysis of timing parameters related to network-based applications. At the top level of the hierarchy, the user is presented a summary of the delays incurred while running an application, or while simulating the running of an application, organized by delay categories, including processing delays at each node, as well as propagation delays at each link between nodes. The interface enables a user to “drill down” into lower levels of the timing information hierarchy by ‘clicking’ on currently displayed information. The information is presented in a form most appropriate to the level of analysis. The presentation forms include, for example, pie-charts, multi-variable timing diagrams (in both absolute and relative forms), data exchange charts, and so on, and ‘zoom’ capabilities are provided as appropriate to the particular display form.

摘要翻译： 图形用户界面便于与基于网络的应用相关的定时参数的分层分析。 在层次结构的顶层，用户被呈现在运行应用程序时产生的延迟，或模拟应用程序的运行情况的总结，这些延迟类别包括延迟类别，包括每个节点的处理延迟，以及传播延迟 节点之间的每个链接。 该接口使用户能够通过“点击”当前显示的信息“向下钻取”到较低级别的定时信息层级。 信息以最适合于分析水平的形式呈现。 演示表格包括例如饼图，多变量时序图（绝对和相对形式），数据交换图表等，并且适当地提供特定显示形式的“缩放”能力。

公开(公告)号：US20070067450A1

公开(公告)日：2007-03-22

申请号：US11507114

申请日：2006-08-19

申请人： Patrick Malloy ,  Michael Canney ,  Ryan Gehl ,  Marc Cohen ,  Eric Nudelman ,  Russell Elsner ,  Marc Schneider

发明人： Patrick Malloy ,  Michael Canney ,  Ryan Gehl ,  Marc Cohen ,  Eric Nudelman ,  Russell Elsner ,  Marc Schneider

IPC分类号： G06F15/173

CPC分类号： H04L43/0823 ,  H04L43/00 ,  H04L43/106

摘要： A system and method for managing captured network traffic data is provided. The invention comprises a plurality of capture agents, each being configured to capture the network traffic associated with one or more applications. Each application is associated with one or more capture agents according to an application profile that is stored and maintained in a capture server. When analysis of an application's network traffic is required, the capture server contacts the corresponding capture agents according to the application profile. The capture server then effects the identification and archiving of the network traffic that corresponds to a user-defined capture condition. A database at the capture server maintains a record that associates the corresponding network traffic with the user-defined capture condition such that the corresponding network traffic can later be retrieved and analyzed using an analysis engine.

摘要翻译： 提供了一种用于管理捕获的网络流量数据的系统和方法。 本发明包括多个捕获剂，每个捕获剂被配置为捕获与一个或多个应用相关联的网络流量。 每个应用程序根据存储和维护在捕获服务器中的应用程序配置文件与一个或多个捕获程序相关联。 当需要分析应用程序的网络流量时，捕获服务器将根据应用程序配置文件与相应的捕获代理进行联系。 然后，捕获服务器对与用户定义的捕获条件相对应的网络流量进行识别和归档。 捕获服务器上的数据库维护一个记录，将相应的网络流量与用户定义的捕获条件相关联，以便随后可以使用分析引擎检索和分析相应的网络流量。

公开(公告)号：US20070140131A1

公开(公告)日：2007-06-21

申请号：US11639863

申请日：2006-12-15

申请人： Patrick Malloy ,  Alain Cohen ,  Ryan Gehl ,  John Strohm ,  Russell Elsner

发明人： Patrick Malloy ,  Alain Cohen ,  Ryan Gehl ,  John Strohm ,  Russell Elsner

IPC分类号： H04L12/26

CPC分类号： H04L43/045 ,  H04L43/026 ,  H04L43/028 ,  H04L43/062

摘要： A network monitoring system and method processes captured message data to create a plurality of categories, provides summary data corresponding to each category, and displays the categorized summary data. The categories preferably include an identification of the source node and destination node of each message, and the summary data includes the amount of traffic communicated between each pair of nodes. The display of this summary data includes a graphic display that provides a visual indication of each pair and the volume of traffic between the nodes of the pair.

摘要翻译： 网络监控系统和方法处理捕获的消息数据以创建多个类别，提供对应于每个类别的摘要数据，并显示分类的摘要数据。 类别优选地包括每个消息的源节点和目的地节点的标识，并且摘要数据包括在每对节点之间传送的业务量。 该摘要数据的显示包括图形显示器，其提供每对的可视指示和该对的节点之间的流量。

公开(公告)号：US20070067296A1

公开(公告)日：2007-03-22

申请号：US11507112

申请日：2006-08-19

申请人： Patrick Malloy ,  Dana Znamova ,  Alain Cohen ,  Antoine Dunn ,  John Strohm ,  Abbas Ali ,  Russell Elsner

发明人： Patrick Malloy ,  Dana Znamova ,  Alain Cohen ,  Antoine Dunn ,  John Strohm ,  Abbas Ali ,  Russell Elsner

IPC分类号： G06F17/30 ,  G06F7/00

CPC分类号： H04L41/145 ,  H04L41/22

摘要： Data representing application deployment attributes, network topology, and network performance attributes based on a reduced set of element attributes is utilized to simulate application deployment. The data may be received from a user directly, a program that models a network topology or application behavior, and a wizard that implies the data based on an interview process. The simulation may be based on application deployment attributes including application traffic pattern, application message sizes, network topology, and network performance attributes. The element attributes may be determined from a lookup table of element operating characteristics that may contain element maximum and minimum boundary operating values utilized to interpolate other operating conditions. Application response time may be derived using an iterative analysis based on multiple instances of one or more applications wherein a predetermined number of iterations is used or until a substantially steady state of network performance is achieved.

摘要翻译： 利用表示应用程序部署属性，网络拓扑和基于简化的元素属性集合的网络性能属性的数据来​​模拟应用程序部署。 可以直接从用户接收数据，对网络拓扑或应用行为进行建模的程序，以及基于访问过程暗示数据的向导。 模拟可以基于应用部署属性，包括应用流量模式，应用消息大小，网络拓扑和网络性能属性。 可以从可能包含用于内插其他操作条件的元件最大和最小边界操作值的元件操作特性的查找表来确定元素属性。 可以使用基于一个或多个应用的​​多个实例的迭代分析来导出应用响应时间，其中使用预定数量的迭代，或直到达到基本稳定的网络性能状态。

公开(公告)号：US20070047438A1

公开(公告)日：2007-03-01

申请号：US11506649

申请日：2006-08-18

申请人： Patrick Malloy ,  Russell Elsner ,  John Strohm ,  Alain Cohen ,  Steven Niemczyk ,  Marc Schneider

发明人： Patrick Malloy ,  Russell Elsner ,  John Strohm ,  Alain Cohen ,  Steven Niemczyk ,  Marc Schneider

IPC分类号： H04L12/26

CPC分类号： H04L41/5067 ,  H04L41/22

摘要： Transactions within a transmission stream are identified that are related to an activity. The transactions are classified utilizing characteristics that identify the activity. Packets of the transaction are extracted from the transmission stream that corresponds to the activity. The extracted packets are presented in a visualization that identifies the packets and source and sink devices of the packets. The packets may be identified from a network trace. Classifying transactions includes identifying patterns present in packets to identify related transactions and/or packets that are temporally correlated. The characteristics may include heuristics related to a communication protocol of the transactions, examining temporal relationships of the packets, and/or identifying DNS requests related to the packets. The extracted packets may be presented as a tier pair circle wherein related devices are presented around a circumference of the tier pair circle and packet traffic between devices is indicated by a joining line.

摘要翻译： 识别与活动相关的传输流内的事务。 交易根据识别活动的特征进行分类。 从与活动相对应的传输流中提取事务的分组。 提取的分组被呈现在标识分组的分组和分组的源和宿设备的可视化中。 可以从网络迹线识别分组。 分类事务包括识别分组中存在的模式以识别与时间上相关的相关事务和/或分组。 特征可以包括与交易的通信协议相关的启发式，检查分组的时间关系和/或识别与分组相关的DNS请求。 提取的分组可以呈现为层对圆，其中相关设备围绕层对圆的周围呈现，并且设备之间的分组业务由连接线指示。

公开(公告)号：US20080019278A1

公开(公告)日：2008-01-24

申请号：US11776736

申请日：2007-07-12

申请人： Steve Niemczyk ,  Patrick Malloy ,  Alain Cohen ,  Russell Elsner

发明人： Steve Niemczyk ,  Patrick Malloy ,  Alain Cohen ,  Russell Elsner

IPC分类号： H04L12/56

CPC分类号： H04L47/10 ,  H04L43/0852 ,  H04L47/11 ,  H04L47/283

摘要： Application messages are segregated into message paths, and the delays of the transmitted packets associated with each message path are independently analyzed to distinguish propagation, bandwidth, congestion, and protocol delays. To further distinguish the congestion delays, all of the paths of the application messages are assessed to identify delays induced by the application, including self-congestion delay, corresponding to pre-congestion delays caused by attempting to send data from a source device faster than the bandwidth of the channel allows, and cross-congestion delay, corresponding to post-congestion delays caused by varying delays beyond a bottleneck link in the channel. The remaining congestion delay is identified as network congestion delay, corresponding to delays caused by network devices other than the source device. After identifying each of the components of delay, the effect of each component on the overall delay is determined to identify where improvements can best be made.

摘要翻译： 应用消息被分离成消息路径，并且独立地分析与每个消息路径相关联的传输分组的延迟，以区分传播，带宽，拥塞和协议延迟。 为了进一步区分拥塞延迟，评估应用消息的所有路径以识别由应用引起的延迟，包括自身拥塞延迟，对应于由源设备尝试从源设备发送数据所导致的预拥塞延迟比 信道的带宽允许和交叉拥塞延迟对应于由频道中的瓶颈链路之外的变化延迟引起的后阻塞延迟。 剩余的拥塞延迟被识别为网络拥塞延迟，对应于由源设备以外的网络设备引起的延迟。 在确定延迟的每个组成部分后，确定每个组件对整体延迟的影响，以确定哪里可以最好地进行改进。

公开(公告)号：US20070097883A1

公开(公告)日：2007-05-03

申请号：US11506651

申请日：2006-08-18

申请人： Yigong Liu ,  Yevgeny Gurevich ,  Pradeep Singh ,  Alain Cohen ,  Vivek Narayanan ,  Russell Elsner ,  Clinton Hart

发明人： Yigong Liu ,  Yevgeny Gurevich ,  Pradeep Singh ,  Alain Cohen ,  Vivek Narayanan ,  Russell Elsner ,  Clinton Hart

IPC分类号： H04L12/28

CPC分类号： H04L41/22 ,  H04L41/12

摘要： A new network topology visualization is produced from an existing network topology using grouping algorithms that are selectively applied to selectable hierarchies of the existing network topological hierarchy. The new network topology is rendered for review. Interaction may be provided through a graphical user interface (GUI). The new network topology is provided as a previewing visualization. The previewing visualization is provided in a tree-view. The previewing visualization provides a visual differentiation between portions of the network topology that are changed by the grouping algorithm and portions that are not changed. The grouping algorithms may be provided as plug-in algorithms. A further new network topology may be rendered in response to receipt of a changed network topology.

摘要翻译： 使用分组算法从现有网络拓扑生成新的网络拓扑可视化，该算法被选择性地应用于现有网络拓扑层次结构的可选层次。 提供新的网络拓扑以供审查。 可以通过图形用户界面（GUI）提供交互。 新的网络拓扑作为预览可视化提供。 预览可视化在树视图中提供。 预览可视化提供了通过分组算法改变的网络拓扑的部分之间的视觉差异，以及未改变的部分。 分组算法可以作为插件算法提供。 响应于接收到改变的网络拓扑，可以呈现进一步的新网络拓扑。