Abstract:
Network traffic filtering is provided to enable gathering of data and statistics related to client/server traffic corresponding to valid and desired client to server/server to client traffic.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This application claims priority of U.S. provisional patent application 61/228,927, filed Jul. 27, 2009, entitled METHOD AND APPARATUS OF FILTERING STATISTIC, FLOW AND TRANSACTION DATA ON CLIENT/SERVER. 
    
    
     BACKGROUND OF THE INVENTION 
     This invention relates to networking analysis, and more particularly to filtering statistic, flow and transaction data on client/server for improved monitoring and analysis of network traffic. 
     In a complex computer networking environment, large amounts of traffic may be exchanged, whereas a network technician may be interested in analyzing only traffic between clients and servers, and in particular situations only between specific client/server sets. 
     SUMMARY OF THE INVENTION 
     In accordance with the invention, network traffic is observed and determination is made of client, server and protocol, and if the observed traffic is of the desired type and represents client/server traffic within a group of interest to a user, the traffic or information about the traffic is passed on for further processing or analysis. 
     Accordingly, it is an object of the present invention to provide an improved network analysis system for gathering client/server traffic information. 
     It is a further object of the present invention to provide an improved network monitoring device that enables observation of traffic of specifically desired client/server/protocols. 
     It is yet another object of the present invention to provide improved methods of network monitoring and analysis to provide filtering to retrieve data or statistics related to client/server/protocols of interest. 
     The subject matter of the present invention is particularly pointed out and distinctly claimed in the concluding portion of this specification. However, both the organization and method of operation, together with further advantages and objects thereof, may best be understood by reference to the following description taken in connection with accompanying drawings wherein like reference characters refer to like elements. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram of a network with a network analysis product interfaced therewith; 
         FIG. 2  is a block diagram of a monitor device for filtering client/server/protocol traffic; and 
         FIG. 3  is a flow chart of determination steps. 
     
    
    
     DETAILED DESCRIPTION 
     The system according to a preferred embodiment of the present invention comprises a monitoring system and method and an analysis system and method for filtering statistic, flow and transaction data on client/server criteria. 
     Referring to  FIG. 1 , a block diagram of a network with an apparatus in accordance with the disclosure herein, a network may comprise plural network devices  10 ,  10 ′ which are denoted clients in this consideration, which communicate over a network  12  by sending and receiving network traffic  17 , some of which is traffic between clients  10 ,  10 ′ and server  20 . The traffic may be sent in packet form, with varying protocols and formatting thereof. 
     A network analysis product  14  is also connected to the network, and may include a user interface  16  that enables a user to interact with the network analysis product to operate the analysis product and obtain data therefrom, whether at the location of installation or remotely from the physical location of the analysis product network attachment. 
     The network analysis product comprises hardware and software, CPU, memory, interfaces and the like to operate to connect to and monitor traffic on the network, as well as performing various testing and measurement operations, transmitting and receiving data and the like. When remote, the network analysis product typically is operated by running on a computer or workstation interfaced with the network. 
     The analysis product comprises an analysis engine  18  which receives the packet network data and interfaces with application transaction details data store  21 . 
       FIG. 2  is a block diagram of a test instrument/analyzer  36  via which the invention can be implemented, wherein the instrument may include network interfaces  22  which attach the device to a network  12  via multiple ports, one or more processors  23  for operating the instrument, memory such as RAM/ROM  24  or persistent storage  26 , display  28 , user input devices  30  (such as, for example, keyboard, mouse or other pointing devices, touch screen, etc.), power supply  32  which may include battery or AC power supplies, other interface  34  which attaches the device to a network or other external devices (storage, other computer, etc.). Packet processing module  25  provides processing of packets and storage of data related thereto for use in the analysis product to assist in the filtering of statistic, flow and transaction data related to client/server traffic. 
     In operation, the network test instrument is attached to the network, and observes transmissions on the network to collect information and statistics thereon related to client/server traffic. 
     A set of filters are made based on IP addresses and/or ports, suitably ranges of IP addresses and/or ranges of ports, to select traffic that is within those IP ranges and/or port ranges. 
     In the particular embodiment of use it is desired only to provide information that is relevant to client/server traffic and not to include information that isn&#39;t client/server related. It is further desired to not provide information or data where the client or server falls out of a set of defined IP address ranges and/or port ranges. 
     Accordingly, a vast amount of traffic is observed, but information and statistical results are only desired where it is know that the traffic is client/server and only where the client and/or server is/are part of the client/server set in which the user is interested. 
     To process the information, there are three main step employed. 
     First, determining the traffic type (protocol) and which side of the transaction appears to be the client and which is the server. 
     Once the traffic type is known, the next step (second) is to determine if the traffic type behaves in a client/server relationship or if the traffic type behaves in a peer to peer fashion. The traffic type&#39;s relationship behavior can then be used to make a final determination which side is the client and which side is the server. Based on the known traffic type and the behavior of that traffic, which side is determined as the client and which is determined to be the server, a level of confidence determination can be applied to that specific combination of traffic. 
     The confidence level provides the ability to allow users to drill in to different levels of confidence, for example, allowing a user to observe all the traffic that is of type ‘unknown whether client/server’, ‘best guess is client/server’ and ‘know client/server’. 
     Thirdly, having the observed traffic that is of a level of confidence, the client and/or server addresses of the traffic is used to look up against known clients and/or servers that the user cares about. If it fits in the traffic group that the user wants to see, then the information is passed on for further use in analysis/display/etc. Otherwise, the information is discarded or handled in some other way, so that it doesn&#39;t pollute the statistics traffic the user cares to analyze and view. 
       FIG. 3  is a flow chart illustrating the analysis process in analyzing observed network traffic data from real time (or from the application transaction detail data store). The analysis process is suitably performed by analysis engine  18 , which may be implemented by processor(s)  23 /packet processing module  25 , for example. In block  38 , the traffic is analyzed to determine client, server and traffic type (or protocol), that is, determining which ‘side’ of the traffic flow is which and the type of traffic. 
     Decision block  40  then determines whether the traffic is the type of traffic that would fall into the client/server type of relationship. If the determination is that the traffic is not of the type, then it is either discarded (for purposes of statistics or processing relative to client/server of interest) or handled in an alternative manner for other purposes in block  42 . 
     In the alternative, if the decision block  40  determination of whether the traffic is the type of traffic that would fall into the client/server type of relationship is that it is of that type, then in decision block  44 , a determination is made whether the traffic is within the client and/or server group of interest, by, for example, looking up the server address for this traffic against the known servers that are in the servers of interest (e.g., those specified by the user for monitoring . . . ). If the determination is that the traffic is not within the client and/or server group of interest, then it is either discarded (for purposes of statistics or processing relative to client/server of interest) or handled in an alternative manner for other purposes in block  42 . 
     If the traffic is within the server group of interest, then the traffic data or information about the traffic is passed on (block  46 ) for further storage, processing, analysis, etc., to ultimately provide information to a user regarding desired client/server traffic. 
     In accordance with the above, the invention provides more focused information relative to client/server traffic exchanges that are of interest. 
     In use, an interface is provided to allow a user to easily configure a set or sets of IP addresses, IP address ranges and/or IP networks that describe the set of application clients and/or servers that are of interest for monitoring. The information the user enters is merged with a measure of confidence of the client/server determination to provide only data for application metrics that are accurate, relevant and meaningful to the user. 
     While a preferred embodiment of the present invention has been shown and described, it will be apparent to those skilled in the art that many changes and modifications may be made without departing from the invention in its broader aspects. The appended claims are therefore intended to cover all such changes and modifications as fall within the true spirit and scope of the invention.