Patent ID: 8689326
Filing Date: 2014-04-01
Classification: H04L

Abstract:
1. A device for analyzing and diagnosing network traffic based on information in packets transmitted in a network, the device comprising: means for dividing the packets into k packet types based on protocol type and port number, where k is a natural number greater than zero; means for monitoring a number of first distinct values of one or more pre-specified fields in packet headers with respect to the k packet types, for all packets that have transited monitoring points in the network; means for monitoring a number of second distinct values of one or more pre-specified fields in payloads of the packets with respect to the k packet types, for all packets that have transited the monitoring points in the network; and diagnosis means for extracting one or more monitoring fields F1 from said one or more pre-specified fields in the packet headers and one or more monitoring fields F2 from said one or more pre-specified fields in the payloads of the packets, for establishing monitoring field FX that includes the monitored number of first distinct values of the monitoring fields F1 and the monitored number of second distinct values of the monitoring fields F2, and for judging that the network is abnormal when a ratio determined using the number of first and second distinct values in the monitoring field FX reaches a pre-specified threshold within a pre-specified fixed time interval.