Patent ID: 8130767
Filing Date: 2012-03-06
Classification: H04L,Y02D

Abstract:
1. A method of aggregating network traffic flows for network traffic elements characterized by a plurality of characteristics having respective values, the method comprising the steps of: receiving, at a router, network traffic elements that are flowing through the router; the router forming an instantaneous flow profile of the elements flowing through the router; wherein the instantaneous flow profile comprises information on the status of all flows on the router at a given instant; and wherein a flow represents a set of network traffic elements having common values for at least one of: source address, destination address, source port, destination port, and protocol; receiving, at the router, an aggregation characteristic; instead of or in addition to any aggregation taking place at a collector node, the router aggregating, in real time, a first set of two or more different flows from the flow profile having a first common value for the aggregation characteristic, to produce first aggregated flows; instead of or in addition to any aggregation taking place at a collector node, the router aggregating, in real time, a second set of two or more different flows from the flow profile having a second common value for the aggregation characteristic, to produce second aggregated flows; wherein the aggregation characteristic comprises at least one of source prefix, source autonomous system (AS), protocol, data in inner headers, arrival interface, or random sampler; determining whether the first aggregated flows represent more traffic than the second aggregated flows; in response to determining that the first aggregated flows represent more traffic than the second aggregated flows, determining that the first common value represents the noisiest value of the aggregation characteristic.