Correlating captured packets with synthetic application testing

Correlating captured packets with synthetic application testing is provided. A device captures packets associated with a plurality of processes that include one or more synthetic transactions and one or more transactions responsive to user input. A packet capture data set can lack process identifiers (PIDs). The device captures first finger-printing data including first PIDs and attributes associated with the plurality of processes, and second finger-printing data comprising second PIDs corresponding to the one or more synthetic transactions. The device applies a first filter generated from the second PIDs in the second finger-printing data to a first finger-printing data set, and a second filter generated from the filtered attributes of a filtered finger-printing data set to the packet capture data set. The device provides a filtered packet capture data set to manage a performance of one or more processes of the plurality of processes.

BACKGROUND

Digital services can be provided by servers to client devices over a network, such as the Internet. For example, servers can provide access to web sites, applications, content, or other digital services. Providers or users of the digital services can periodically test the digital services and content to evaluate the performance of the digital services, or identify issues associated with providing the digital services. However, due to the sharing of various networks used by client devices to access digital services, it can be challenging to analyze data packets to evaluate the test of the digital service.

SUMMARY

Systems and methods of this technical solution are directed to correlating captured packets with one or more synthetic transactions. Client devices can access, via a network, a digital service (e.g., cloud service or application) hosted or provided by a service provider. The application can be a software-as-a-service (“SaaS”) that executes on a server remote from the client device. To evaluate a performance of the service, a synthetic transaction generator can conduct a synthetic transaction with packets. However, since the client device executing the synthetic transaction generator can provide, via a same one or more network interfaces, data packets not related to the synthetic transaction, it may not be possible to distinguish the packets corresponding to the synthetic transaction from the packets not corresponding to the synthetic transaction. Thus, systems and methods of this technical solution can provide a captured packet correlator that captures the data packets, captures metadata associated with the data packets, and, using the metadata, filters the data packets to generate a data set corresponding to the synthetic tests.

At least one aspect is directed to a method. The method can be performed by one or more processors. For example, the method can be performed by one or more processors of a client device or one or more processors of a cloud computing system via a virtual machine. The method can include the one or more processors capturing packets associated with a plurality of processes communicated via one or more network interfaces of the computing device to generate a packet capture data set. The plurality of processes can include one or more synthetic transactions and one or more transactions responsive to user input. The packet capture data set can lack process identifiers (PIDs). The method can include the one or more processors capturing first finger-printing data including first PIDs and attributes associated with the plurality of processes to generate a first finger-printing data set. The method can include the one or more processors capturing second finger-printing data comprising second PIDs corresponding to the one or more synthetic transactions to generate a second finger-printing data set. The method can include the one or more processors applying a first filter generated from the second PIDs in the second finger-printing data to the first finger-printing data set to generate a filtered finger-printing data set including filtered attributes. The method can include the one or more processors applying a second filter generated from the filtered attributes of the filtered finger-printing data set to the packet capture data set to generate a filtered packet captured data set. The method can include the one or more processors providing the filtered packet capture data set to manage a performance of one or more processes of the plurality of processes.

At least one aspect is directed to a system. The system can include one or more processors. For example, the system can be performed by one or more processors of a client device or one or more processors of a cloud computing system via a virtual machine. The system can include the one or more processors capturing packets associated with a plurality of processes communicated via one or more network interfaces of the computing device to generate a packet capture data set. The plurality of processes can include one or more synthetic transactions and one or more transactions responsive to user input. The packet capture data set can lack process identifiers (PIDs). The system can include the one or more processors capturing first finger-printing data including first PIDs and attributes associated with the plurality of processes to generate a first finger-printing data set. The system can include the one or more processors capturing second finger-printing data comprising second PIDs corresponding to the one or more synthetic transactions to generate a second finger-printing data set. The system can include the one or more processors applying a first filter generated from the second PIDs in the second finger-printing data to the first finger-printing data set to generate a filtered finger-printing data set including filtered attributes. The system can include the one or more processors applying a second filter generated from the filtered attributes of the filtered finger-printing data set to the packet capture data set to generate a filtered packet captured data set. The system can include the one or more processors providing the filtered packet capture data set to manage a performance of one or more processes of the plurality of processes.

At least one aspect is directed to a non-transitory computer readable medium. The medium can include instructions stored thereon. The instructions, when executed by one or more processors, can cause the one or more processors to perform operations. The operations can include the one or more processors capturing packets associated with a plurality of processes communicated via one or more network interfaces of the computing device to generate a packet capture data set. The plurality of processes can include one or more synthetic transactions and one or more transactions responsive to user input. The packet capture data set can lack process identifiers (PIDs). The operations can include the one or more processors capturing first finger-printing data including first PIDs and attributes associated with the plurality of processes to generate a first finger-printing data set. The operations can include the one or more processors capturing second finger-printing data comprising second PIDs corresponding to the one or more synthetic transactions to generate a second finger-printing data set. The operations can include the one or more processors applying a first filter generated from the second PIDs in the second finger-printing data to the first finger-printing data set to generate a filtered finger-printing data set including filtered attributes. The operations can include the one or more processors applying a second filter generated from the filtered attributes of the filtered finger-printing data set to the packet capture data set to generate a filtered packet captured data set. The operations can include the one or more processors providing the filtered packet capture data set to manage a performance of one or more processes of the plurality of processes.

DETAILED DESCRIPTION

Following below are more detailed descriptions of various concepts related to, and implementations of, methods, apparatus, and systems of correlating packets with synthetic transactions. For example, the methods, apparatus, and systems can provide a captured packet correlator that captures data packets communicated between a client application and a remote service to generate a packet capture file and uses finger-printing data to filter the packet capture file to retain filtered packets associated with synthetic transaction packets. The technical solution can provide the filtered packets to a data processing system to process the filtered packets in real-time in order to evaluate the performance of the services. The technical solution can isolate the data packets corresponding to the synthetic tests from other data packets when the data packets can lack associated metadata that indicates an originating process identifier (PID). The various concepts introduced above and discussed in greater detail below may be implemented in any of numerous ways.

Organizations can provide digital services, such as a website or application, over a network. To test the availability or performance of the digital service, the organization can execute synthetic transactions. A synthetic transaction can refer to simulating activities performed by an application or client device accessing the digital service. The synthetic transaction can be performed at any time and can facilitate evaluating the availability and performance of a digital service at times when human users may be less active or not active. For example, if a business service becomes unavailable over the weekend, users of that service may not find out until Monday morning. However, by using synthetic transactions to test the availability and performance of a service at regular intervals (e.g., every hour) the operator can be alerted to any problems shortly after they occur and can take remedial action. By regularly performing the same types of synthetic transactions, a system of this technical solution can establish a baseline for normal behavior of a digital service. Upon detecting a deviation from the established baseline, the system can generate an alert notifying the operator of the digital service of a performance or availability issue.

For example, the digital service can include a collaboration service web site, sales management platform, or productivity software (e.g., word processing, spreadsheet application, presentation application, or cloud storage). The client device that accesses the digital service can be located at a residential location, such as their home location, house, apartment, or condominium. In some cases, the client device can include or refer to a physical device located at the residential location, and in some cases the client device can include or refer to a virtual machine hosted or running on one or more processors or servers in a cloud computing environment. The user's residential location can refer to a location that is different from a commercial location, such as the office or building of an organization. A synthetic transaction generator can execute on the client device. The synthetic transaction generator can execute in a container on the client device.

An illustrative synthetic business transaction test on the collaboration service web site can include the following sequence of individual tests: 1) log into the web site homepage; 2) join a meeting; 3) wait in the meeting; 4) leave the meeting; and 5) log out. The system can detect a problem with one or more of these tests. To debug or better understand the problem in order to resolve the problem, an operator of the digital service can view the contents of the data packets that were sent between the client device and the web server providing the digital service. Viewing the contents allows for detailed troubleshooting, including inspecting the different hypertext transfer protocol (“HTTP”) headers generated by both the client device and the server, the HTTP response codes generated for different subcomponents of an HTTP page, or code such as Javascript.

To obtain the data packets transmitted between the client device at the residential location and the server hosting the digital service, the client device can include a synthetic transaction generator that generates a packet capture trace file. The synthetic transaction generator can include or refer to a packet monitoring probe. The synthetic transaction generator can be a standalone device or software component executed by a client device. The synthetic transaction generator can generate data packets associated with one or more synthetic transactions which are used to perform synthetic tests to manage performance of the client applications on the client device and the digital service.

However, it may be challenging to isolate the data packets corresponding to the synthetic tests from other data packets such as packets associated with background host processes or other applications of the client device. The network traffic between the client device and the digital service that is captured during a synthetic network test can include both of the data packets related to the synthetic tests and the data packets not related to the synthetic tests. Additionally, both of the data packets can be communicated through one or more same network interfaces. The data packets can lack associated metadata that indicates an originating process identifier (PID).

Thus, this technical solution can provide a captured packet correlator that captures the data packets, captures metadata associated with the data packets, and, using the metadata, filters the data packets to generate a data set corresponding to the synthetic tests. By doing so, this technical solution can isolate data packets related to synthetic tests and provide the data packets to manage the performance of the client applications and the digital service being tested. This technical solution can be achieved without the need to create artificial network interfaces to facilitate the packet capture.

FIG.1illustrates an example system100to generate synthetic transactions with packets. In brief overview, the system100can include, access or otherwise interface with one or more of a client device102, service provider system104and data processing system106. The client device102can include one or more processors. The client device102can include at least one synthetic transaction generator108. The client device102can include a client application110. The client device102can include at least one captured packet correlator112. The client device102can include at least one data repository114. The client device102can include one or more network interfaces116. The client device102can communicate with a service provider system104via a network105. The client device102can communicate with a data processing system106via network105.

The data processing system106can include at least one application performance manager118. The data processing system106can include at least one analytics appliance120. The analytics appliance120can be a hardware appliance or software-based virtual appliance executed by one or more processors of the data processing system106.

The service provider system104can be hosted by a third-party cloud service provider. The service provider system104can be hosted in a public cloud, a co-location facility, or a private cloud. The service provider system104can be hosted in a private data center, or on one or more physical servers, virtual machines, or containers of an entity or customer. The service provider system104can provide a remote service122. The remote service122can be accessed or tested over a network105. The remote service122can be a software-as-a-service (SaaS) application, such as a word processing application, spreadsheet application, presentation application, electronic message application, file storage system, productivity application, or any other SaaS application. The service provider system104can be hosted on or refer to cloud310depicted inFIG.3B.

The data processing system106, client device102, or service provider system104can include or execute on one or more processors or computing devices (e.g., computing device303depicted inFIG.3C) and communicate via network105. The network105can include computer networks such as the Internet, local, wide, metro, or other area networks, intranets, satellite networks, and other communication networks such as voice or data mobile telephone networks. The network105can be used to access information resources such as web pages, web sites, domain names, or uniform resource locators that can be presented, output, rendered, or displayed on at least one computing device, such as a laptop, desktop, tablet, personal digital assistant, smart phone, portable computers, or speaker. For example, via the network105, the client device102can access information or data provided by the remote service122.

The network105may be any type or form of network and may include any of the following: a point-to-point network, a broadcast network, a wide area network, a local area network, a telecommunications network, a data communication network, a computer network, an ATM (Asynchronous Transfer Mode) network, a SONET (Synchronous Optical Network) network, a SDH (Synchronous Digital Hierarchy) network, a wireless network and a wireline network. The network105may include a wireless link, such as an infrared channel or satellite band. The topology of the network105may include a bus, star, or ring network topology. The network may include mobile telephone networks using any protocol or protocols used to communicate among mobile devices, including advanced mobile phone protocol (“AMPS”), time division multiple access (“TDMA”), code-division multiple access (“CDMA”), global system for mobile communication (“GSM”), general packet radio services (“GPRS”) or universal mobile telecommunications system (“UMTS”). Different types of data may be transmitted via different protocols, or the same types of data may be transmitted via different protocols.

Each of the client device102, data processing system106, or service provider system104can include or utilize at least one processing unit or other logic device such as programmable logic array engine, or module configured to communicate with one another or other resources or databases. The components of the client device102, data processing system106, and service provider system104can be separate components or a single component. The system100and its components can include hardware elements, such as one or more processors, logic devices, or circuits.

Still referring toFIG.1, and in further detail, the client device102can include a client application110. The client application110can refer to or include any program configured to access a (e.g., digital) remote service122provided by a server system (e.g., service provider system104). The client application110can include, for example, a web browser that can communicate using a network protocol with a server system that provides a digital server. The client application110can include a mobile application, desktop application or other type of application that can access a remote service122provided by the server system. The client application110can at least one of generate, send, or receive packets that are sent to or received from the server system. The packets can be responsive to a user input. The packets can be associated with at least one of background host processes or user interaction with an operating system of the client device102or the client application110. A background host process can refer to or include a computer process that can run behind the scenes without user intervention, such as logging, system monitoring, scheduling, or user notification.

The client device102can be located or deployed at any location in the network environment depicted inFIG.1. The client device102can be deployed at a location115. For example, the location115can refer to a residential location or non-commercial location, such as a user's home, house, apartment, condominium or other residential place. The location115can refer to where a user lives. The location115can be different from a commercial location or building at which an organization or entity may have its place of business. For example, the location115can be different from where the data processing system106is located or where the service provider system104is located.

The client device102can include a synthetic transaction generator108designed, constructed and operational to simulate activities performed by a client application110accessing the remote service122. The synthetic transaction generator108can be configured with one or more functions or components of client application110in order to simulate the activities performed by the client application110to access the remote service122. In some cases, the synthetic transaction generator108can communicate with the server (e.g., service provider system104) to perform activities simulating accessing the remote service122. In some cases, the synthetic transaction generator108can invoke or launch the client application110. For example, the synthetic transaction generator108can launch the client application110and control the client application110in order to simulate the activity associated with the remote service122. The synthetic transaction generator108can be a standalone application that includes the functionality of the client application110in order to conduct a synthetic transaction with the remote service122.

The synthetic transaction generator108can generate a synthetic transaction. The synthetic transaction can be associated with a synthetic network test. For example, a synthetic network test can include a test that performs a domain name system (DNS) resolve to get the internet protocol (“IP”) address for an internet hosted application and then performs an HTTP GET to download the document object model (“DOM”) of the remote service122(e.g., a web site).

The client device102and service provider system104(or remote service122) can establish a secure communication channel or secure communication session. For example, the client device102and the service provider system104can communicate using HTTPS requests and responses. HTTPS responses and requests can refer to HTTP responses and requests that are encrypted, such an encryption based on the TLS protocol. The client device102and service provider system104can communicate network packets responsive to establishing the secure communication channel/session.

The client device102can include a captured packet correlator112designed, constructed and operational to correlate packets with metadata (e.g., processes and attributes) associated with synthetic network test traffic. In other words, the captured packet correlator112can isolate synthetic network test traffic, such as packets generated by the synthetic transaction generator108, from background host traffic, such as packets generated or provided by the client application110. In implementations, the client device102can be referred to as the captured packet correlator112. For example, the captured packet correlator112can be a standalone device or component that includes hardware and software that can isolate synthetic network test traffic.

The captured packet correlator112can include a packet collector124designed, constructed and operational to collect (e.g., capture, receive, record, etc.) packets and finger-printing data. The packet collector124can capture the finger-printing data packets separately and in parallel to capturing the finger-printing data.

The packet collector124can collect packets associated with a number of processes of the client device102. The number of processes can include one or more synthetic transactions generated by the synthetic transaction generator108. The number of processes can include one or more transactions responsive to user input (“user transactions”). For example, the user transactions can include, or otherwise be associated with, background host processes (e.g., operating system updates, synching network shares, domain controller communications) or user interaction with an operating system operating system.

The number of processes can be communicated (e.g., sent, transmitted) between the client device102and the remote service122. The number of processes can be communicated via one or more network interfaces116. The one or more network interfaces116can include one or more of an Ethernet interface, a Wi-Fi interface, or a virtual private network (VPN) interface. In implementations, the synthetic transactions can be communicated on a different one or more of the network interfaces116than the one or more of the network interfaces116on which the user transactions are sent. In implementations, the synthetic transactions and the user transactions can be sent on the same one or more network interfaces116.

The packet collector124can collect the packets associated with the number of processes to generate a packet capture (“PCAP”) data set126. In implementations, the PCAP data set126may not include any metadata containing a process identifier (“PID”) such as a PID that originated the packets. The packet collector124can store the PCAP Data Set126in the data repository114.

The packet collector124can capture finger-printing data. The packet collector124can capture first finger-printing data that includes metadata such as PIDs and attributes associated with the number of processes. Each PID can identify a process that a packet originated from. Each attribute can identify characteristics related to transmission of the one or more packets. The attributes can include at least one of a source IP address, a destination IP address, a source port, or a destination port. The source IP address and source port can correspond to one of the client device, the synthetic transaction generator108, or the client application110, and the destination IP address and destination port can correspond to one of the service provider system104or the remote service122, or vice versa. The attributes can include a protocol being used for transmission of the more packets. The protocol can include transmission control protocol (“TCP”), user datagram protocol (“UDP”), or Internet Control Message Protocol (“ICMP”). The attributes can include a domain name server (“DNS”) query name.

The attributes can include events. The events can include TCP events or UDP events. The event can include at least one of an indication that a packet was sent, a timestamp of the packet transmission, the source IP address, the destination IP address, the source port, or the destination port.

The packet collector124can capture the metadata (e.g., attributes such as TCP events, UDP events, and DNS query names) using an event tracing script for an operating system running on the client device102. For example, the packet collector124can use Event Tracing for Windows (ETW). An event tracing script can refer to or include a tracing mechanism for events raised by user-mode applications or kernel-mode device drivers. Event tracing script can include or interface with an event provider that writes events to an event tracing session. When the events are written, the event tracing script or program can add additional information about the event, such as the time the event took place, process identifier, a thread that generated the event, a processor number, or CPU usage data of the logging thread.

The synthetic transaction generator108can run a synthetic test. The packet collector124can capture second finger-printing data that includes PIDs associated with the one or more synthetic transactions corresponding to the synthetic test. The packet collector can capture the packets and the metadata associated with the number of processes while the synthetic test is running.

The packet collector124can capture finger-printing data to generate a finger-printing data set128. For example, the packet collector124can capture first finger-printing data to generate a first finger-printing data set. The packet collector124can capture second finger-printing data to generate a second finger-printing data set. The finger-printing data set128can include the first finger-printing data set and the second finger-printing data set. The packet collector124can store the finger-printing data set128in the data repository114.

The captured packet correlator112can include a filter130designed, constructed and operational to filter packets and finger-printing data. The filter130can access the finger-printing data set128stored in the data repository114. The filter130can access the PIDs corresponding to the one or more synthetic transactions from the second finger-printing data set of the finger-printing data set128. The filter130can generate a first filter from the PIDs corresponding to the one or more synthetic transactions. The filter130can apply the first filter to the first finger-printing data set of the finger-printing data set128. The filter130can apply the first filter to generate a filtered finger-printing data set132. The filtered finger-printing data set132can include attributes and PIDs corresponding to the one or more synthetic transactions. The filter130can store the filtered finger-printing data set132in the data repository114. The filter130can discard a subset of the finger-printing data set128not included in the filtered finger-printing data set132. For example, the filter130can remove, delete, disregard, erase, or otherwise not use the subset of the finger-printing data set128.

The filter130can access the attributes corresponding to the one or more synthetic transactions from the filtered finger-printing data set132stored in the data repository114. The filter130can generate a second filter from the attributes corresponding to the one or more synthetic transactions. The filter130can apply the second filter to the PCAP data set126. The filter130can apply the second filter to generate a filtered PCAP data set134. The filter130can store the filtered PCAP data set134in the data repository114. The filter130can discard a subset of the PCAP data set126not included in the filtered PCAP data set134.

The captured packet correlator112can access the filtered PCAP data set134stored in the data repository114. The captured packet correlator112can provide the filtered PCAP data set to the data processing system106. The data processing system106(e.g., the performance manager118or the analytics appliance120) can manage a performance of one or more of the processes such as a process corresponding to the client application110or the remote service122.

The data processing system106can include an application performance manager118. The application performance manager118can allow a user or operator of the data processing system106to select a packet trace via a graphical user interface (“GUI”). A user of the data processing system106can drill down or navigate through the GUI provided by the application performance manager118to identify, evaluate, generate or otherwise assess various metrics, such as the synthetic transaction test response time, the ISP, location information, the unique ID of the synthetic transaction generator108or the captured packet correlator112, and the laptop name or user identifier.

The data processing system106can include an analytics appliance120. The analytics appliance120can be designed, constructed and operational to generate a metric or otherwise provide an indicator of the availability or performance of the remote service122being tested. The analytics appliance120can access the data packets and analyze the data packets. The analytics appliance120can identify a test status code in the packets that can indicate whether the test was a success. The analytics appliance120can determine a duration of the test, and generate a metric based on the duration of the test. The analytics appliance120can parse data in the data packets, such as data in the HTTP request and response data packets. The data can include codes indicating a status or state of the HTTP request or response.

The data processing system106can compare the metric generated for the test with a performance threshold stored in a threshold data structure, and generate an alert based on the comparison. The data processing system106can transmit the alert or a notification to an operator device, such as the client device102, via a push notification, electronic message, text message, or other electronic communication.

In some cases, the data processing system106can be configured to provide an indication to adjust a configuration of the client device102, remote service122or service provider system104based on the performance information or comparison between the metric and the threshold performance. The data processing system106can (e.g., automatically or responsive to the comparison) adjust or modify a configuration of the client device102or remote service122(e.g., application) executed by the one or more servers to improve performance of the remote service122. For example, the data processing system106can restart a server of the service provider system104that hosts the remote service122, allocate additional memory or storage to the remote service122, allocate a faster processor to the remote service122, allocate additional network bandwidth to the remote service122, or download a patch or software update to the remote service122.

FIG.2is an illustration of a method of correlating captured packets with one or more synthetic transactions, in accordance with an implementation. The method200can be performed by one or more system, component or module depicted inFIG.1,3A,3B, or3C, including, for example, a computing device (e.g., client device102), captured packet correlator (e.g., captured packet correlator112), data processing system (e.g., data processing system106), cloud service provider system (e.g., service provider system104), or one or more processors of any of the above. At operation202, the data processing system can capture packets associated with a plurality of processors. For example, the captured packet correlator can capture packets associated with a plurality of processes to generate a packet capture data set. The plurality of processes can include one or more synthetic transactions and one or more transactions responsive to user input. The packet capture data set can lack process identifiers (PIDs). The PIDs can identify processes from which the packets originated.

The plurality of processes can be communicated via one or more (e.g., two or more) network interfaces of the computing device. The one or more network interfaces include one or more of an Ethernet interface, a Wi-Fi interface, or a virtual private network (VPN) interface. The captured packet correlator can capture packets associated with one or more synthetic transactions on a first one or more of the network interfaces and packets associated with one or more transactions responsive to user input on a second one or more of the network interfaces different from the first one or more of the network interfaces. The first one or more network interfaces can be overlapping with the second one or more network interfaces. The first one or more network interfaces can be the same as the second one or more network interfaces.

At operation204, the data processing system can capture first finger-printing data. The captured packet correlator can capture first finger-printing data including first PIDs and attributes associated with the plurality of processes to generate a first finger-printing data set. The attributes can include at least one of a source internet protocol (IP) address, a destination IP address, a source port, a destination port, a protocol, or a domain name server (DNS) query name. The attributes can include events. The captured packet correlator can capture events on transmission control protocol (TCP) and user datagram protocol (UDP) packets. The captured packet correlator can capture events using an event tracing script for an operating system running on the computing device.

At operation206, the data processing system can capture second finger-printing data. For example, the captured packet correlator can capture second finger-printing data comprising second PIDs corresponding to the one or more synthetic transactions to generate a second finger-printing data set. The captured packet correlator can capture the packets separately and in parallel to the capturing of the first and second finger-printing data. The captured packet correlator can capture the first finger-printing data separately and in parallel to the capturing of the second finger-printing data.

At operation208, the data processing system can apply a first filter. For example, The captured packet correlator can apply a first filter generated from the second PIDs in the second finger-printing data to the first finger-printing data set to generate a filtered finger-printing data set including filtered attributes. For example, the captured packet correlator can compare a PID from the first finger-printing data set to one or more of the second PIDs in the second finger-printing data set to determine if the PID matches one of the second PIDs. If the match is found, the captured packet correlator can add the PID and the attributes associated with the PID to the filtered finger-printing data set. The captured packet correlator can discard, or otherwise filter out, a subset of the first finger-printing data set not included in the filtered finger-printing data set.

At operation210, the data processing system can apply a second filter. For example, the captured packet correlator can apply a second filter generated from the filtered attributes of the filtered finger-printing data set to the packet capture data set to generate a filtered packet capture data set. For example, the captured packet correlator can compare an attribute from the packet capture data set to one or more of the filtered attributes in the filtered finger-printing data set to determine if the attribute matches one of the filtered attributes. If the match is found, the captured packet correlator can add the attribute and the packet and other attributes associated with the attribute to the filtered packet capture data set. The captured packet correlator can discard, or otherwise filter out, a subset of the packet capture data set not included in the filtered packet capture data set.

At operation212, the data processing system can provide the filtered packet capture data set to manage a performance. For example, the captured packet correlator can provide the filtered packet capture data set to manage a performance of one or more processes of the plurality of processes. For example, the captured packet correlator can provide the filtered packet capture data set to a data processing system to manage a performance of one or more processes of the plurality of processes. The filtered packet capture data set can include only the packets associated with the synthetic transaction, and lack packets associated with other background host processes or user interaction with the operating system of the client device. The data processing system can compare data the filtered packet capture data set corresponding to the one or more processes to a performance threshold. The data processing system can generate an alert based on the comparison, for example, if the data exceeds the threshold.

In an illustrative example, one or more aspects of methods200can be performed based at least in part on using the following pseudo-code:

FIG.3Adepicts an example network environment that can be used in connection with the methods and systems described herein. In brief overview, the network environment300includes one or more clients devices102(also generally referred to as clients, client node, client machines, client computers, client computing devices, endpoints, or endpoint nodes) in communication with one or more servers302(also generally referred to as servers, nodes, or remote machine) via one or more networks105. In some embodiments, a client device102has the capacity to function as both a client node seeking access to resources provided by a server and as a server providing access to hosted resources for other clients102.

AlthoughFIG.3Ashows a network105between the clients102and the servers302, the clients102and the servers302can be on the same network105. In embodiments, there are multiple networks105between the clients102and the servers302. The network105can include multiple networks such as a private network and a public network. The network105can include multiple private networks.

The network105can include one or more component or functionality of network105depicted inFIG.3A. The network105can be connected via wired or wireless links. Wired links can include Digital Subscriber Line (DSL), coaxial cable lines, optical fiber lines, shielded twisted pairs, or unshielded twisted pairs. The wired links can connect one or more Ethernet networks. The wireless links can include BLUETOOTH, Wi-Fi, Worldwide Interoperability for Microwave Access (WiMAX), an infrared channel or satellite band. The wireless links can also include any cellular network standards used to communicate among mobile devices, including standards that qualify as 1G, 2G, 3G, 4G, 5G or other standards. The network standards can qualify as one or more generation of mobile telecommunication standards by fulfilling a specification or standards such as the specifications maintained by International Telecommunication Union. Examples of cellular network standards include AMPS, GSM, GPRS, UMTS, LTE, LTE Advanced, Mobile WiMAX, and WiMAX-Advanced. Cellular network standards can use various channel access methods e.g. FDMA, TDMA, CDMA, or SDMA. In some embodiments, different types of data can be transmitted via different links and standards. In other embodiments, the same types of data can be transmitted via different links and standards.

The network105can be any type and/or form of network. The geographical scope of the network105can vary widely and the network105can be a body area network (BAN), a personal area network (PAN), a local-area network (LAN), e.g. Intranet, a metropolitan area network (MAN), a wide area network (WAN), or the Internet. The topology of the network105can be of any form and can include, e.g., any of the following: point-to-point, bus, star, ring, mesh, or tree. The network105can be an overlay network which is virtual and sits on top of one or more layers of other networks105. The network105can be of any such network topology as known to those ordinarily skilled in the art capable of supporting the operations described herein. The network105can utilize different techniques and layers or stacks of protocols, including, e.g., the Ethernet protocol or the internet protocol suite (TCP/IP). The TCP/IP internet protocol suite can include application layer, transport layer, internet layer (including, e.g., IPv6), or the link layer. The network105can be a type of a broadcast network, a telecommunications network, a data communication network, or a computer network.

The network environment300can include multiple, logically grouped servers302. The logical group of servers can be referred to as a data center308(or server farm or machine farm). In embodiments, the servers302can be geographically dispersed. The data center308can be administered as a single entity or different entities. The data center308can include multiple data centers308that can be geographically dispersed. The servers302within each data center308can be homogeneous or heterogeneous (e.g., one or more of the servers302or machines302can operate according to one type of operating system platform (e.g., WINDOWS), while one or more of the other servers302can operate on according to another type of operating system platform (e.g., Unix, Linux, or Mac OS)). The servers302of each data center308do not need to be physically proximate to another server302in the same machine farm308. Thus, the group of servers302logically grouped as a data center308can be interconnected using a network. Management of the data center308can be de-centralized. For example, one or more servers302can comprise components, subsystems and modules to support one or more management services for the data center308.

Server302can be a file server, application server, web server, proxy server, appliance, network appliance, gateway, gateway server, virtualization server, deployment server, SSL VPN server, or firewall. In embodiments, the server302can be referred to as a remote machine or a node. Multiple nodes can be in the path between any two communicating servers.

FIG.3Billustrates an example cloud computing environment. A cloud computing environment301can provide client device102with one or more resources provided by a network environment. The cloud computing environment301can include one or more clients102, in communication with the cloud310over one or more networks105. Clients102can include, e.g., thick clients, thin clients, and zero clients. A thick client can provide at least some functionality even when disconnected from the cloud310or servers302. A thin client or a zero client can depend on the connection to the cloud310or server302to provide functionality. A zero client can depend on the cloud310or other networks105or servers302to retrieve operating system data for the client device. The cloud310can include back end platforms, e.g., servers302, storage, server farms or data centers.

The cloud310can be public, private, or hybrid. Public clouds can include public servers302that are maintained by third parties to the clients102or the owners of the clients. The servers302can be located off-site in remote geographical locations as disclosed above or otherwise. Public clouds can be connected to the servers302over a public network. Private clouds can include private servers302that are physically maintained by clients102or owners of clients. Private clouds can be connected to the servers302over a private network105. Hybrid clouds can include both the private and public networks105and servers302.

The cloud310can also include a cloud-based delivery, e.g. Software as a Service (SaaS)312, Platform as a Service (PaaS)314, and Infrastructure as a Service (IaaS)316. IaaS can refer to a user renting the use of infrastructure resources that are needed during a specified time period. IaaS providers can offer storage, networking, servers or virtualization resources from large pools, allowing the users to quickly scale up by accessing more resources as needed. PaaS providers can offer functionality provided by IaaS, including, e.g., storage, networking, servers or virtualization, as well as additional resources such as, e.g., the operating system, middleware, or runtime resources. SaaS providers can offer the resources that PaaS provides, including storage, networking, servers, virtualization, operating system, middleware, or runtime resources. In some embodiments, SaaS providers can offer additional resources including, e.g., data and application resources.

Clients102can access IaaS resources, SaaS resources, or PaaS resources. In embodiments, access to IaaS, PaaS, or SaaS resources can be authenticated. For example, a server or authentication server can authenticate a user via security certificates, HTTPS, or API keys. API keys can include various encryption standards such as, e.g., Advanced Encryption Standard (AES). Data resources can be sent over Transport Layer Security (TLS) or Secure Sockets Layer (SSL).

The client device102and server302can be deployed as and/or executed on any type and form of computing device, e.g. a computer, network device or appliance capable of communicating on any type and form of network and performing the operations described herein.

FIG.3Cdepicts block diagrams of a computing device303useful for practicing an embodiment of the client device102or a server302. As shown inFIG.3C, each computing device303can include a central processing unit318, and a main memory unit320. As shown inFIG.3C, a computing device303can include one or more of a storage device336, an installation device332, a network interface334, an I/O controller322, a display device330, a keyboard324or a pointing device326, e.g. a mouse. The storage device336can include, without limitation, a program340, such as an operating system, software, or software associated with system100or configured to perform one or more function of system100or method200.

The central processing unit318is any logic circuitry that responds to and processes instructions fetched from the main memory unit320. The central processing unit318can be provided by a microprocessor unit, e.g.: those manufactured by Intel Corporation of Mountain View, Calif. The computing device303can be based on any of these processors, or any other processor capable of operating as described herein. The central processing unit318can utilize instruction level parallelism, thread level parallelism, different levels of cache, and multi-core processors. A multi-core processor can include two or more processing units on a single computing component.

Main memory unit320can include one or more memory chips capable of storing data and allowing any storage location to be directly accessed by the microprocessor318. Main memory unit320can be volatile and faster than storage336memory. Main memory units320can be Dynamic random access memory (DRAM) or any variants, including static random access memory (SRAM). The memory320or the storage336can be non-volatile; e.g., non-volatile read access memory (NVRAM). The memory320can be based on any type of memory chip, or any other available memory chips. In the example depicted inFIG.3C, the processor318can communicate with memory320via a system bus338.

I/O devices328can have both input and output capabilities, including, e.g., haptic feedback devices, touchscreen displays, or multi-touch displays. Touchscreen, multi-touch displays, touchpads, touch mice, or other touch sensing devices can use different technologies to sense touch, including, e.g., capacitive, surface capacitive, projected capacitive touch (PCT), in-cell capacitive, resistive, infrared, waveguide, dispersive signal touch (DST), in-cell optical, surface acoustic wave (SAW), bending wave touch (BWT), or force-based sensing technologies. Some multi-touch devices can allow two or more contact points with the surface, allowing advanced functionality including, e.g., pinch, spread, rotate, scroll, or other gestures. Some touchscreen devices, including, e.g., Microsoft PIXELSENSE or Multi-Touch Collaboration Wall, can have larger surfaces, such as on a table-top or on a wall, and can also interact with other electronic devices. Some I/O devices328, display devices330or group of devices can be augmented reality devices. The I/O devices can be controlled by an I/O controller322as shown inFIG.3C. The I/O controller322can control one or more I/O devices, such as, e.g., a keyboard324and a pointing device326, e.g., a mouse or optical pen. Furthermore, an I/O device can also provide storage and/or an installation device332for the computing device303. In embodiments, the computing device303can provide USB connections (not shown) to receive handheld USB storage devices. In embodiments, an I/O device328can be a bridge between the system bus338and an external communication bus, e.g. a USB bus, a SCSI bus, a FireWire bus, an Ethernet bus, a Gigabit Ethernet bus, a Fibre Channel bus, or a Thunderbolt bus.

In embodiments, display devices330can be connected to I/O controller322. Display devices can include, e.g., liquid crystal displays (LCD), electronic papers (e-ink) displays, flexile displays, light emitting diode displays (LED), or other types of displays. In some embodiments, display devices330or the corresponding I/O controllers322can be controlled through or have hardware support for OPENGL or DIRECTX API or other graphics libraries. Any of the I/O devices328and/or the I/O controller322can include any type and/or form of suitable hardware, software, or combination of hardware and software to support, enable or provide for the connection and use of one or more display devices330by the computing device303. For example, the computing device303can include any type and/or form of video adapter, video card, driver, and/or library to interface, communicate, connect or otherwise use the display devices330. In embodiments, a video adapter can include multiple connectors to interface to multiple display devices330.

The computing device303can include a storage device336(e.g., one or more hard disk drives or redundant arrays of independent disks) for storing an operating system or other related software, and for storing application software programs such as any program related to the systems, methods, components, modules, elements, or functions depicted inFIG.1or2. Examples of storage device336include, e.g., hard disk drive (HDD); optical drive including CD drive, DVD drive, or BLU-RAY drive; solid-state drive (SSD); USB flash drive; or any other device suitable for storing data. Storage devices336can include multiple volatile and non-volatile memories, including, e.g., solid state hybrid drives that combine hard disks with solid state cache. Storage devices336can be non-volatile, mutable, or read-only. Storage devices336can be internal and connect to the computing device303via a bus338. Storage device336can be external and connect to the computing device303via an I/O device328that provides an external bus. Storage device336can connect to the computing device303via the network interface334over a network105. Some client devices102may not require a non-volatile storage device336and can be thin clients or zero clients102. Some storage devices336can be used as an installation device332and can be suitable for installing software and programs.

The computing device303can include a network interface334to interface to the network105through a variety of connections including, but not limited to, standard telephone lines LAN or WAN links (e.g., 802.11, T1, T3, Gigabit Ethernet, Infiniband), broadband connections (e.g., ISDN, Frame Relay, ATM, Gigabit Ethernet, Ethernet-over-SONET, ADSL, VDSL, BPON, GPON, fiber optical including FiOS), wireless connections, or some combination of any or all of the above. Connections can be established using a variety of communication protocols (e.g., TCP/IP, Ethernet, ARCNET, SONET, SDH, Fiber Distributed Data Interface (FDDI), IEEE 802.11a/b/g/n/ac/ax, CDMA, GSM, WiMax and direct asynchronous connections). The computing device303can communicate with other computing devices303via any type and/or form of gateway or tunneling protocol e.g. Secure Socket Layer (SSL) or Transport Layer Security (TLS), QUIC protocol, or the Citrix Gateway Protocol manufactured by Citrix Systems, Inc. of Ft. Lauderdale, Fla. The network interface334can include a built-in network adapter, network interface card, PCMCIA network card, EXPRESSCARD network card, card bus network adapter, wireless network adapter, USB network adapter, modem or any other device suitable for interfacing the computing device303to any type of network capable of communication and performing the operations described herein.

A computing device303of the sort depicted inFIG.3Ccan operate under the control of an operating system, which controls scheduling of tasks and access to system resources. The computing device303can be running any operating system configured for any type of computing device, including, for example, a desktop operating system, a mobile device operating system, a tablet operating system, or a smartphone operating system.

The computing device303can be any workstation, telephone, desktop computer, laptop or notebook computer, netbook, ULTRABOOK, tablet, server, handheld computer, mobile telephone, smartphone or other portable telecommunications device, media playing device, a gaming system, mobile computing device, or any other type and/or form of computing, telecommunications or media device that is capable of communication. The computer system303has sufficient processor power and memory capacity to perform the operations described herein. In some embodiments, the computing device303can have different processors, operating systems, and input devices consistent with the device.

In embodiments, the status of one or more machines (e.g., client devices102and servers302) in the network105can be monitored as part of network management. In embodiments, the status of a machine can include an identification of load information (e.g., the number of processes on the machine, CPU and memory utilization), of port information (e.g., the number of available communication ports and the port addresses), or of session status (e.g., the duration and type of processes, and whether a process is active or idle). In another of these embodiments, this information can be identified by a plurality of metrics, and the plurality of metrics can be applied at least in part towards decisions in load distribution, network traffic management, and network failure recovery as well as any aspects of operations of the present solution described herein.

The processes, systems and methods described herein can be implemented by the computing device303in response to the CPU318executing an arrangement of instructions contained in main memory320. Such instructions can be read into main memory320from another computer-readable medium, such as the storage device336. Execution of the arrangement of instructions contained in main memory320causes the computing device303to perform the illustrative processes described herein. One or more processors in a multi-processing arrangement may also be employed to execute the instructions contained in main memory320. Hard-wired circuitry can be used in place of or in combination with software instructions together with the systems and methods described herein. Systems and methods described herein are not limited to any specific combination of hardware circuitry and software.

The subject matter and the operations described in this specification can be implemented in digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. The subject matter described in this specification can be implemented as one or more computer programs, e.g., one or more circuits of computer program instructions, encoded on one or more computer storage media for execution by, or to control the operation of, data processing apparatuses. A computer storage medium can be, or be included in, a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of them. While a computer storage medium is not a propagated signal, a computer storage medium can be a source or destination of computer program instructions encoded in an artificially generated propagated signal. The computer storage medium can also be, or be included in, one or more separate components or media (e.g., multiple CDs, disks, or other storage devices). The operations described in this specification can be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

While operations are depicted in the drawings in a particular order, such operations are not required to be performed in the particular order shown or in sequential order, and all illustrated operations are not required to be performed. Actions described herein can be performed in a different order. The separation of various system components does not require separation in all implementations, and the described program components can be included in a single hardware or software product.

The phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. Any references to implementations or elements or acts of the systems and methods herein referred to in the singular may also embrace implementations including a plurality of these elements, and any references in plural to any implementation or element or act herein may also embrace implementations including only a single element. Any implementation disclosed herein may be combined with any other implementation or embodiment.

The foregoing implementations are illustrative rather than limiting of the described systems and methods. Scope of the systems and methods described herein is thus indicated by the appended claims, rather than the foregoing description, and changes that come within the meaning and range of equivalency of the claims are embraced therein.