Patent ID: 7076547
Filing Date: 2006-07-11
Classification: H04L

Abstract:
1. In a system having one or more distributed probes and one or more analyzers coupled to a network, a method for network performance and server application performance monitoring in at least one of the probes, comprising: installing configuration information into the probe; detecting the arrival at the probe of a flow instance of interest based on the configuration information; determining with the probe whether the arriving flow instance is a new flow instance; if the arriving flow instance is a new flow instance, establishing with the probe a state associated with the flow instance; capturing, with the probe, relevant information associated with the flow instance; exporting the relevant information based on a configuration; determining whether an end of the flow instance has been reached; if the end of the flow instance has been reached, destroying the state and exporting the relevant information; if the end of the flow instance has not been reached, continuing to monitor the flow instance; installing configuration information in one or more of the analyzers; and providing at least one of flow information and statistics from one or more of the probes to one or more of the analyzers; wherein one or more of the analyzers use flow matching to uniquely associate events observed at various of the probes with a single flow instance, and perform a set of operations on data based on the configuration information; wherein the flow matching includes: determining a flow instance to be matched; determining one or more down stream probes where a corresponding flow instance is capable of appearing; determining a time window in a way that considers characteristics of the flow instance; and searching the flow instances falling into the time window at the down stream probes; wherein if any records characterized by the same flow identifier and sequence number are found, determining that a matching flow instance has been obtained.