Source: http://www.google.com/patents/US7996556?dq=mezick
Timestamp: 2015-05-05 15:35:55
Document Index: 126919568

Matched Legal Cases: ['Application No. 05820894', 'application No. 200580031604', 'Application No. 05820894', 'application No. 0583164', 'application No. 05853162', 'Application No. 200580045932', 'application No. 200580031604', 'Application No. 200580045932']

Patent US7996556 - Method and apparatus for generating a network topology representation based ... - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inAdvanced Patent SearchPatentsA method is disclosed for generating a network topology representation based on inspection of application messages at a network device. According to one aspect, a network device receives a request packet, routes the packet to the destination, and extracts and stores correlation information from a copy...http://www.google.com/patents/US7996556?utm_source=gb-gplus-sharePatent US7996556 - Method and apparatus for generating a network topology representation based on inspection of application messages at a network deviceAdvanced Patent SearchPublication numberUS7996556 B2Publication typeGrantApplication numberUS 11/090,920Publication dateAug 9, 2011Filing dateMar 24, 2005Priority dateDec 6, 2004Fee statusPaidAlso published asCN101371237A, CN101371237B, EP1839174A2, EP1839174A4, US7987272, US8312148, US8549171, US20060123425, US20060123467, US20060123477, US20110208867, US20140032690, WO2006062814A2, WO2006062814A3Publication number090920, 11090920, US 7996556 B2, US 7996556B2, US-B2-7996556, US7996556 B2, US7996556B2InventorsKollivakkam Raghavan, Tefcros Anthias, Parley Van Oleson, Sunil Potti, Raj De Datta, Stephen ChoOriginal AssigneeCisco Technology, Inc.Export CitationBiBTeX, EndNote, RefManPatent Citations (115), Non-Patent Citations (100), Referenced by (32), Classifications (8), Legal Events (2) External Links: USPTO, USPTO Assignment, EspacenetMethod and apparatus for generating a network topology representation based on inspection of application messages at a network device
US 7996556 B2Abstract
A method is disclosed for generating a network topology representation based on inspection of application messages at a network device. According to one aspect, a network device receives a request packet, routes the packet to the destination, and extracts and stores correlation information from a copy of the request packet. When the network device receives a response packet, it examines the contents of a copy of the response packet using context-based correlation rules and matches the response packet with the appropriate stored request packet correlation information. It analyzes recorded correlation information to determine application-to-application mapping and calculate application response times. Another embodiment inserts custom headers that contain information used to match a response packet with a request packet into request packets.
1. A method of generating a network topology representation based on inspection of application messages at a network device, the method comprising the computer-implemented steps of:
receiving a request packet at the network device from a request application;
associating request packet correlation information with a request application message in the request packet at the network device;
storing the request packet correlation information;
routing the request packet to a request packet destination;
receiving a response packet at the network device from a response application responding to the request application message;
associating response packet correlation information with a response application message in the response packet at the network device;
correlating the response packet correlation information for the response application message with the stored request packet correlation information for the request application message;
storing the response packet correlation information;
routing the response packet to a response packet destination;
analyzing the stored request packet correlation information and the stored response packet correlation information;
wherein the request application message and the response application message are messages exchanged in an application layer of the Open System Interconnection (OSI) Layer Model;
wherein the stored request packet correlation information identifies the request application at the application layer of the OSI Layer Model;
wherein the stored response packet correlation information identifies the response application at the application layer of the OSI Layer Model;
wherein the request packet and the response packet are Transport Control Protocol (TCP) packets;
wherein the analyzing step determines an application-to-application mapping at the application layer of the OSI Layer Model between the request application and the response application;
wherein the analyzing step calculates application response times and a response relevant metric;
wherein the application-to-application mapping, the application response times and the response relevant metric are published to outside applications;
2. A method as recited in claim 1, further comprising: reporting an alarm if a given metric violates a predetermined threshold level.
3. A method as recited in claim 1, wherein the correlating step uses content-based correlation rules to correlate application interactions.
4. A method as recited in claim 1, wherein the stored request packet correlation information and the stored response packet correlation information that falls outside of a sliding window is discarded.
reporting an alarm if the response packet is not received for the request packet and/or violates a predetermined metric.
6. A non-transitory computer-readable volatile or non-volatile storage medium storing one or more sequences of instructions for generating a network topology representation based on inspection of application messages at a network device, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:
associating a response packet correlation information with a response application message in the response packet at the network device;
analyzing stored request packet correlation information and the stored response packet correlation information;
wherein the request application message and the response application message are messages exchanged in an application layer format of the Open System Interconnect (OSI) Layer Model;
wherein the analyzing step calculates application response times and/or any other relevant metric;
wherein the application-to-application mapping, the application response times and the response relevant metric are published to outside applications.
7. A non-transitory computer-readable storage medium as recited in claim 6, further storing instructions, which when executed by the one or more processors, cause the one or more processors to perform: reporting an alarm if a given metric violates a predetermined threshold level.
8. A non-transitory computer-readable storage medium as recited in claim 6, wherein the instructions for correlating the response packet correlation information use content-based correlation rules to correlate application interactions.
9. A non-transitory computer-readable storage medium as recited in claim 6, wherein the stored request correlation information and the stored response correlation information that fails outside a sliding window is discarded.
10. A non-transitory computer-readable storage medium as recited in claim 6, further storing instructions, which when executed by the one or more processors, cause the one or more processors to perform: reporting an alarm if the response packet is not received for the request packet and/or violates a predetermined metric.
11. An apparatus for generating a network topology representation based on inspection of application messages at a network device, comprising:
means for receiving a request packet at the network device from a request application;
means for associating request packet correlation information with a request application message in the request packet at the network device;
means for storing the request packet correlation information;
means for routing the request packet to a request packet destination;
means for receiving a response packet at the network device from a response application responding to the request application message;
means for associating response packet correlation information with a response application message in the response packet at the network device;
means for correlating the response packet correlation information for the response application message with the stored request packet correlation information for the request application message;
means for storing the response packet correlation information; and
means for routing the response packet to a response packet destination;
means for analyzing the stored request packet correlation information and the stored response packet correlation information;
wherein the analyzing means determines application-to-application mapping at the application layer of the OSI Layer Model;
wherein the analyzing means calculates application response times and a response relevant metric;
means for reporting an alarm if a given metric violates a predetermined threshold level.
13. An apparatus as recited in claim 11, wherein the correlating means uses content-based correlation rules to correlate application interactions.
14. An apparatus as recited in claim 11, wherein the stored request packet correlation information and the stored response packet correlation information that fails outside of a sliding window is discarded.
means for reporting an alarm if a response packet is not received for a request packet and/or violates a predetermined metric.
This application is continuation-in-part of U.S. patent application Ser. No. 11/005,978, entitled �PERFORMING MESSAGE AND TRANSFORMATION ADAPTER FUNCTIONS IN A NETWORK ELEMENT ON BEHALF OF AN APPLICATION�, filed on Dec. 6, 2004 the contents of which is incorporated by reference in its entirety for all purposes as though fully disclosed herein.
The present invention generally relates to network elements in computer networks. The invention relates more specifically to a method and apparatus for generating a network topology representation based on inspection of application messages at a network device.
Computer �X� might be remote from computer �Y.� In order for computer �X� to send the message to computer �Y,� computer �X� might send the message through a computer network such as a local area network (LAN), a wide-area network (WAN), or an inter-network such as the Internet. In order to transmit the message through such a network, computer �X� might use a suite of communication protocols. For example, computer �X� might use a network layer protocol such as the Internet Protocol (EP) in conjunction with a transport layer protocol such as the Transport Control Protocol (TCP) to transmit the message.
For example, a router �U� might receive the packets from computer �X� and determine, based on the packets being destined for computer �Y,� that the packets should be forwarded to another router �V� (the next �hop� on the route). Router �V� might receive the packets from router �U� and send the packets on to computer �Y.� At computer �Y,� the contents of the packets may be extracted and reassembled to form the original message, which may be provided to application �B.� Applications �A� and �B� may remain oblivious to the fact that the packets were routed through routers �U� and �V.� Indeed, separate packets may take separate routes through the network.
In order to reduce the amount of application modification required to allow an application to converse with other applications that might use different message formats and/or application layer protocols, intermediary network elements separate from such applications may be designed to receive messages, �translate� the messages, and then send the messages. This translation may be achieved by looking for a specified bit pattern beginning at a specified bit location in a packet, and then altering bits at the specified bit location if the specified bit pattern is found. For example, a network appliance �J� might be designed to receive messages that have been sent using HTTP and send those messages using FTP instead. For another example, a network appliance �K� might be designed to receive messages that are in XML format and translate those messages into EDI format. Thus, if application �A� sends messages in XML using HTTP, and application �B� receives messages in EDI using FTP, then application �A� can be configured so that messages that application �A� normally would address to application �B� are addressed to network appliance �J� instead. The network administrator can configure network appliance �J� to send messages to network appliance �K,� and the network administrator can configure network appliance �K� to send messages to application �B.�
Further, the ability to track application interactions is vital to a network administrator. The network administrator works best with a comprehensive analysis of the network performance and application interaction and response times. Given the network and application analysis, the network administrator would be able to pinpoint bottlenecks in the network, unresponsive or overloaded applications, and application interactions. However, gathering the information needed to perform such an analysis is difficult because of dissimilar server hardware and software, differing message formats and/or application layer protocols, etc.
Server approaches tie cooperating servers together by having each server monitor its incoming and outgoing traffic and correlating the aggregate information. The drawback to this approach is that each server must be modified to intercept messages between applications and analyze the messages. In addition, cooperating servers must communicate and transfer analysis data to a central server for overall analysis. A technique for gathering message data for analysis that is more centralized and does not require server modifications is needed.
FIG. 24 is a diagram that illustrates an AONS monitoring architecture;
FIG. 26A is a block diagram that illustrates one embodiment of a router in which a supervisor blade directs some packet flows to an AONS blade;
FIG. 26B is a block diagram that illustrates one embodiment of a router in which a supervisor blade directs some packet flows to an AONS blade which insert custom headers into request packets before routing the packets;
FIG. 27A is a block diagram that illustrates one embodiment of an AONS blade in which a public subscription bladelet makes stored traffic information available to outside applications; and
FIG. 27B is a block diagram that illustrates one embodiment of an AONS blade in which a database bladelet sends traffic information to an external database.
A method and apparatus for generating a network topology representation based on inspection of application messages at a network device is described. In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, to one skilled in the art that the present invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to avoid unnecessarily obscuring the present invention.
3.5.1 AONS General Overview 3.5.2 AONS Terminology 3.5.3 AONS Functional Overview 3.5.4 AONS System Overview 3.5.5 AONS System Elements 3.5.6 AONS Example Features 3.5.7 AONS Functional Modules 3.5.8 AONS Modes of Operation 3.5.9 AONS Message Routing 3.5.10 Flows, Bladelets�, and Scriptlets� 3.5.11 AONS Services 3.5.12 AONS Configuration and Management 3.5.13 AONS Monitoring 3.5.14 AONS Tools 3.5.15 AONS Network Topology Generation 4.0 Implementation Mechanisms-Hardware Overview
The needs identified in the foregoing Background, and other needs and objects that will become apparent for the following description, are achieved in the present invention, which comprises, in one aspect, a method for generating a network topology representation based on inspection of application messages at a network device. According to one embodiment, the network device monitors traffic between a plurality of client applications and server applications.
In an embodiment, a non-intrusive approach involves transparently intercepting a message in the form of packets at the network device and keeping a copy of the packets for correlation and analysis while routing the original packets to the destination. If a response message is not received within a certain threshold time, then an error is reported for that request message. When the network device receives a response message, it routes the response message to the appropriate destination. It then examines the contents of a copy of the response message using context-based correlation rules and matches the response message with the appropriate stored request message information. The network device analyzes the recorded correlation information to determine application-to-application mapping. In addition, useful metrics like application response times, size of request message, size of response messages are collected and stored by the network device to provide additional visibility into the performance of the applications. In order to keep the data current, a sliding window may be used to compute these metrics. Data recorded outside of the sliding window is discarded.
Another embodiment inserts custom headers into request packets as they pass through the network device. The network device receives a request packet message and inserts a custom header into the request packet in a protocol specific manner. The custom header contains information used to match a response message with a request message. It then routes the message to the destination and extracts and stores correlation information from a copy of the request message. If a response message is not received within a certain threshold time, then an error is reported for that request message. In this embodiment, the applications are aware of the presence of the network device and are programmed to return this custom header in the response message. When the network device receives a response message, it extracts the custom header from the response message and routes the response message to the appropriate destination. It then matches the information in the response message's custom header with stored request message information to correlate requests and responses. The network device analyzes recorded correlation information to determine application-to-application mapping and calculate application response times and other useful statistics.
When the network device has correlated traffic information, the information is made accessible to UI applications by publishing the traffic information to outside applications.
In block 208, at least a portion of the message is processed via the performance, relative to at least the portion of the message, of the actions that are associated with the particular message classification. For example, in response to determining that the message belongs to the �purchase order� message classification, network element 104 may perform one or more specified actions that are associated with the �purchase order� message classification. The specified actions may include, for example, modifying the message's format (e.g., from XML to EDI) and sending the message toward server application 112 using a different application layer protocol (e.g., FTP) than the protocol that client application 110 used to send the message. Examples of other possible actions are described below.
In block 310, based on one or more information items indicated in the headers of the data packets, an application layer protocol that was used to transmit a message contained in the payload portions of the data packets (hereinafter �the message�) is determined. The information items may include, for example, a source IP address in an IP header, a destination EP address in an IP header, a TCP source port in a TCP header, and a TCP destination port in a TCP header. For example, network element 104, and more specifically AONS blade 604, may store mapping information that maps FTP (an application layer protocol) to a first combination of IP addresses and/or TCP ports, and that maps HTTP (another application layer protocol) to a second combination of IP addresses and/or TCP ports. Based on this mapping information and the IP addresses and/or TCP ports indicated by the data packets, network element 104 may determine which application layer protocol (FTP, HTTP, Simple Mail Transfer Protocol (SMTP), etc.) was used to transmit the message.
Therefore, in one embodiment, supervisor blade 602 sends only some selected packets to AONS blade 604. The technique by which supervisor blade 602 selects these packets may be referred to as �filtering.� As a result of filtering, AONS blade 604 does not receive as many packets with which AONS blade 604 is likely to do nothing.
In one embodiment, AONS messages are encapsulated in an AONP (AON Protocol) message that contains AONP headers, and are translated to a �canonical� format. AONP is a mechanism to enable federation between two or more AONS nodes. For example, a first AONS node may know that it is acting in conjunction with a second or other AONS node; thus the AONS nodes are �federated.� The first AONS node might have performed one or more actions, such as encryption, signing, authentication, etc., relative to a particular message. The first AONS node may indicate, in one or more AONP headers, the actions that the first AONS node performed. Upon receiving the AONP message, the second AONS node may determine from the AONP headers that the actions have been performed. As a result, the second AONS node may forego performing those actions, or perform other functions in an efficient and optimal way. Reliability, logging and security services are provided from an AONS message perspective.
The set of protocols or methods that applications typically use to communicate with each other are called �application access protocols� (or methods) from an AONS perspective. Applications can communicate to the AONS network (typically end point proxies: a client proxy and a server proxy) using any supported application access methods. Some examples of application access protocols include: IBM MQ Series, Java Message Service (JMS), TIBCO, Simple Object Access Protocol (SOAP) over Hypertext Transfer Protocol (HTTP)/HTTPS, Simple Mail Transfer Protocol (SMTP), File Transfer Protocol (FTP), Java Database Connectivity (JDBC), TCP, etc. Details about various access methods are explained in later sections of this document.
In addition, in one embodiment, AONS provides content translation services from one format to another based on the needs of applications. A typical deployment might involve a first AONS node that receives an application message (the client proxy) translating the message to a �canonical� format, which is carried as an AONS message through the AONS network. The server proxy might translate the message from the �canonical� format to the format understood by the receiving application before delivering the message. However, proxies are not required. For understanding some of the non-industry standard formats, a message dictionary may be used.
Within AONS network 702, key building blocks include AONS Endpoint Proxies (AEPs) 704-710, which are located at the edge of the AONS network and serve as the entry and exit points, and an AONS Router (AR), which is located within the AONS network. Visibility into application intent may begin within AEP 704 placed at the edge of a logical AONS �cloud.� As a particular client application of client applications 714A-N attempts to send a message across the network to a particular server application destination of server applications 716A-N and 718A-N, the particular client application will first interact with AEP 704.
A typical message flow involves a particular client application 714A submitting a message to the AEP Client Proxy (CP) 704 through one of the various access protocols supported by AONS. On receiving this message, AEP CP 704 assigns an AONS message id to the message, encapsulates the message with an AONP header, and performs any necessary operations related to the AONS network (e.g. security and reliability services). Also, if necessary, the message is converted to a �canonical� format by AEP CP 704. The message is carried over a TCP connection to AR 710 along the path to the destination application 718A. The AONS routers or switches along the path perform the infrastructure services necessary for the message and can change the routing based on the policies configured by the customer. The message is received at the destination AEP Server Proxy (SP) 706. AEP SP 706 performs necessary security and reliability functions and translates the message to the format that is understood by the receiving application, if necessary. AEP SP 706 then sends the message to receiving application 718A using any of the access protocols that application 718A and AONS support. A detailed message flow through AONS network 702 is described in later sections.
An AONS node may perform specified actions in response to determining that the delivery of a message will cause a failure. For example, an AONS node may determine that a message is larger than the maximum size that can be accepted by a server application for which the message is destined. In response, the AONS node may prevent the message from being forwarded to the server application. Instead, the AONS node may log the message for later inspection by an administrator. For another example, in response to determining that a message contains a virus or other malignant content, an AONS node may �inoculate� the message (e.g., by encrypting and/or compressing the message content), and then store the �inoculated� message in a log for later inspection by an administrator.
An �AEP Client Proxy� is an AONS node that performs the services necessary for applications on the sending side of a message (a client). In the rest of this document, an endpoint proxy also refers to a client or server proxy. Although AONS nodes may fulfill the roles of proxies, they are typically not designated as such; �AEP proxy� is a term used to define a role. The typical responsibilities of the client proxy in processing a message are: message pre-classification & early rejection, protocol management, message identity management, message encapsulation in an AONP header, end point origination for reliable delivery, security end point service origination (encryption, digital signature, authentication), flow selection & execution/infrastructure services (logging, compression, content transformation, etc.), routing�next hop AONS node or destination, AONS node and route discovery/advertising role and routes, and end point origination for the reliable delivery mechanism (guaranteed delivery router).
In one embodiment, supported platforms include: Cisco Catalyst 6503, Cisco Catalyst 6505, Cisco Catalyst 6509, and Cisco Catalyst 6513. These products are typically deployed in data centers. Other products, such as �branch office routers� (e.g., the Cisco Volant router series) and �edge routers� are also supported. In one embodiment, supported supervisor modules include: Sup2 and Sup720. In one embodiment, specific functional areas relating to the platform include: optimized TCP, SSL, public key infrastructure (PKI), encryption/decryption, interface to Cat6K supervisor, failover/redundancy, image management, and QoS functionality. Although some embodiments of the invention are described herein with reference to PKI keys, embodiments of the invention are not limited to PKI keys. Other keys and/or tokens, such as Kerberos tokens and/or PGP tokens, may be used in conjunction with embodiments of the invention.
In implicit mode, applications are unaware of AONS presence. Messages are addressed to receiving applications. Messages are redirected to AONS via configuration of application �proxy� or middleware systems to route messages to AONS, and/or via configuration of networks (packet interception). For example, domain name server (DNS)-based redirection could be used to route messages. For another example, a 5-tuple-based access control list (ACL) on a switch or router could be used. Network-based application recognition and content switching modules may be configured for URL/URI redirection. Message-based inspection may be used to determine message types and classifications. In implicit mode, applications communicate with each other using AONS as an intermediary (implicitly), using application-native protocols.
At circumscribed numeral 10, AEP SP 1610 sends a reliable messaging (RM) acknowledgement (ACK) to AONS router 1608. At circumscribed numeral 11, AONS router 1608 receives the RM ACK and sends the RM ACK to AEP CP 1606. At circumscribed numeral 12, AEP CP 1606 receives the RM ACK and, in response, deletes the copy of the message that is stored in data store 1612. Because the delivery of the message has been acknowledged, there is no further need to store a copy of the message in data store 1612. Alternatively, if AEP CP 1606 does not receive the RM ACK within a specified period of time, then AEP CP 1606 resends the message. If the resend is not successful within a timeout period, a �delivery-failure� notification message will be send to the original sending application.
3.5.10 Flows, Bladelets�, and Scriptlets�
FIG. 21, FIG. 22, and FIG. 23 are diagrams that illustrate entities within an AONS configuration and management framework. An AONS management console (AMC) is the centralized hub for configuration and management of AONS policies, flows, Scriptlets� and other manageable entities. Configurable data is pushed to the AMC from an AONS design studio (flow tool) and the AONS admin may then provision this data to the production deployment. A promotion process is also provided to test and validate changes via a development to staging/certification to production rollout process. An AONS management agent (AMA) resides on individual AONS blades and provides the local control and dispatch capabilities for AONS. The AMA interacts with the AMC to get updates. The AMA takes appropriate actions to implement changes. The AMA is also used for collecting monitoring data to report to third party consoles.
3.5.15 AONS Network Topology Generation
With the emergence of the Internet and web based applications, applications and networks have become extremely complex. The increase in business to business traffic where applications communicate with other applications without human intervention has further complicated this picture by increasing the speed and volume of messages that need to be processed. As the number of such applications increases, the complexity of the topology comprising these applications and networks increase in complexity in a non-linear, exponential manner. The actual topologies are often unknown to the owners, operators, and maintainers of these applications. Troubleshooting problems in such an environment typically involves several teams working together to isolate the cause of the problem, often following trial and error methods. For instance, in a common scenario, when a business user complains that the application that he is using is not responding in a timely fashion, several people, like database administrators, network administrators, and IT support personnel in addition to the application developers spend a lot of time monitoring databases, networks and servers to diagnose and narrow down the cause of the problem. This is typically a time consuming process that may take several days to complete.
Having AONS in the data path of the network offers a unique ability to gather network traffic information to create a topological representation of applications using the network. Traffic between clients and servers can be seamlessly and transparently monitored by AONS. Data gathered from the monitored traffic can be passed from AONS to an external dashboard and used to display a topological representation of the applications using the network. By keeping track of different metrics, the dashboard can identify bottlenecks in the system based on response times between applications, network bandwidth usage or any other useful metric. By highlighting such hot spots on the dashboard, it becomes very easy to determine if a problem is due, for example, to a network delay or bottleneck, a slow responding or non-responsive server application, or a client application that is not sending packets. AONS further allows the system administrator to pinpoint areas where load balancing should be used to alleviate bottlenecks.
AONS can be non-intrusive or intrusive, depending on the granularity of traffic information desired. In general, an intrusive approach offers better granularity of information than a non-intrusive approach. In a non-intrusive approach a customer can activate AONS network traffic analysis without having to modify server or client applications that are being mapped.
In one embodiment, AONS is configured to monitor and analyze network traffic. FIG. 25 illustrates an AONS router 2502 in a network. The AONS router 2502 monitors traffic between a plurality of client applications and server applications. In this example, client application 2501 sends a request (e.g., a Purchase Order Status request) 2504 to server application 2503. The request 2504 is routed through the AONS router 2502. The AONS router records the occurrence of the request 2504 and routes the request 2504 to the server application 2503.
When the server application 2503 responds to the request 2504, it sends a reply message 2505. The AONS router 2502 receives the reply 2505 and routes the reply 2505 to the client application 2501. The AONS router 2502 correlates the reply 2505 to the request 2504 and records the response time, client application, server application, and any other pertinent information needed to create a topological mapping of the network.
Expanding this concept to a large enterprise application, the AONS router is capable of recording and correlating traffic between a large number of client and server applications. The AONS router can correlate traffic using a non-intrusive method or an intrusive method, without requiring the modification of server or client applications.
The recorded traffic information allows AONS to analyze application-to-application communication, calculate application response times, application redundancy, etc.
A notification mechanism allows the AONS router to apply thresholds based on pre-defined metrics (e.g., a certain server application must respond within a specified time limit) and notify an administrator if these thresholds are violated, e.g., if a threshold is designated to not be exceeded, then the administrator is notified if the threshold is exceeded, likewise, if a threshold is designated as to not be fallen below, then the administrator is notified if the monitored value falls below the threshold value. These thresholds, which can be set by any user depending on their access levels, can be used to drive business workflow processes for escalation and notification. Knowledge of the application performance metrics can also enable customers to achieve Service Level Agreement (SLA) metrics, by efficiently distributing available resources. Since AONS is in the flow of traffic, notifications are in real time, allowing for faster reaction times from the network administrator or even self-correcting application topologies.
In an embodiment, that is completely non-intrusive and transparent to the applications in an enterprise whose topology is being discovered, a copy of the message is forwarded to the AONS node, while the original message is sent to the destination. In this implementation, there is no loss of performance since the original packets can be copied extremely fast using the hardware capabilities of the switch/router (for example, using SPAN). The correlation IDs are extracted from the copy by the AONS node and saved in an in-memory table to later match up with the response. Similarly, a copy of the response is also sent to the AONS node whereby the correlation ID extracted from the response packets is used to determine the topological mapping between the source and destination application.
FIG. 26A illustrates a non-intrusive network traffic monitoring AONS embodiment. The AONS router 2600 contains at least a supervisor blade 2601 and an AONS blade 2602. The router 2600 has a plurality of input and output ports 2605-2610. A packet 2603A enters into the router 2600 through port 2606. The supervisor blade 2601 passes a copy of the packet 2604 to the AONS blade 2602. The supervisor blade 2601 sends the packet 2603A to the destination out of port 2609. There is no performance impact at the packet level.
The supervisor blade 2601 allows a system administrator to specify what traffic to intercept, e.g., the system administrator can specify that all traffic from a VLAN is to be intercepted by the AONS blade 2602.
The AONS blade 2602 records state information of traffic that it sees. The AONS blade 2602 maintains a table of connections for packets that it encounters. The contents of each request are examined and analyzed by the AONS blade 2602 using context-based correlation rules. For example, the packet may contain an ID and the response packet will contain the same ID. The connection table contains the ID from the request packet. The AONS blade 2602 extracts the ID from the response packet and correlates it with the ID in the connection table.
For example, Table 1 shows a portion of a connection table where connection A2 is being tracked. Request time and response times (and any other relevant metric) are recorded for each request/response pair. The request packet time is the time when AONS receives the request packet. The response packet time is the time when AONS receives the response packet. The time that it takes the server application to respond to the request (response time) is calculated by subtracting the request packet time from the response packet time, e.g., t2−t1. If a response packet is not received within a certain threshold time or violates other predetermined metrics (e.g., max time allowed, received packet size is too large, sender is invalid, etc.), then an error is recorded for that request packet entry. The individual response times and any other relevant metric are aggregated to compute an average response time or relevant metric. A sliding window may be used to calculate the average to more accurately reflect the current state of the application topology where data recorded outside of the sliding window are discarded.
From the information recorded in the connection table, the AONS blade 2602 can calculate the response time and application correlation information. The information collected by the AONS node can be published to external applications to visualize the application topology as well as to identify application hot spots.
pkt time
A2 t1 t2 1
t1″
t1″ + Δ
One embodiment inserts custom headers into the messages as they pass through the AONS blade. The AONS blade sends the request message to the destination application after assigning a unique correlation ID to the request message and the time of the request. When the application responds, the correlation ID is used to correlate the request and response and build the application topology. FIG. 26B illustrates an AONS router 2600 with a supervisor blade 2601 and an AONS blade 2602 configured to insert custom headers into packets. A packet 2603A enters into the router 2600 through port 2606. The supervisor blade 2601 sends the packet 2604 to the AONS blade 2602. The AONS blade 2602 inserts a custom header into the message before routing the packet to the destination 2611 through port 2609. The custom header contains an identifier that is associated with information, such as a connection ID, request time etc, which will help AONS correlate the response packet when it is received.
When a message is received by the AONS node, if a custom header is present, then it is identified as a response message to a message that the AONS blade 2602 had previously routed. The AONS blade 2602 extracts the custom header from the packet and routes the packet 2611 to the destination through port 2609. The AONS blade 2602 uses the custom header information to correlate the response packet with the request packet information that was previously recorded.
The custom headers are used by the AONS blade to correlate responses to the packet from destination applications. An application will respond with a packet that includes the custom header which is possible since most protocols allow insertions of custom headers in the response packet. When the AONS blade encounters the custom header in the response packet, it correlates the header with the matching packet that it previously recorded and records application information and timing.
The system administrator can also configure AONS to monitor specific application routes by using different rules.
Once the AONS blade has correlated traffic information, the information must be made accessible to UI applications that will display the traffic information in a graphical format. FIG. 27A illustrates an embodiment that publishes the AONS traffic information to outside applications. The AONS blade 2700 contains bladelets 2702 customized for specific tasks. The AONS blade 2700 stores the traffic information in the local data store 2703 in a well-published format. A publishing engine 2701 makes the traffic information stored in the local data store 2703 available to applications that have subscribed to receive this information. Third party applications can consume the traffic information and display the network in a topological graphical user interface (GUI). Application routes and timing can be displayed on the topological GUI. A route would show that an interaction between certain applications is occurring or that a business specific context is being used. Color-coded routes would instantly inform the system administrator of bottlenecks in the network. Alarms could also be displayed for specific routes. A system administrator could click on a route to obtain more detailed information.
The topological GUI allows a system administrator to: identify request/response patterns to improve application performance; identify bottlenecks in real time to improve operational efficiency; and create smarter load balancing strategies to improve overall performance.
In another embodiment, the AONS nodes that receive the request and response messages are different nodes and the correlation between the request and response is done by using AONP to communicate the correlation ids between the nodes and building the topology map.
In yet another embodiment, when the request or response packets are processed by routers that are not AONS enabled, an AONS agent can be deployed in the router that intercepts the request and forwards it to an AONS router, using AONP, where the correlation ids are extracted. A similar action happens on the response which is used to build the application topology.
FIG. 27B illustrates another embodiment where a database bladelet 2704 is used to transfer traffic information from the AONS blade 2700 to an external database 2705 at periodic intervals. The external database 2705 is accessed by UI applications.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS4688026Apr 21, 1986Aug 18, 1987Scribner James RMethod of collecting and using data associated with tagged objectsUS5339073Mar 25, 1991Aug 16, 1994Identec LimitedAccess control equipment and method for using the sameUS5646616Jun 26, 1995Jul 8, 1997Murata Kikai Kabushiki KaishaPicking systemUS5790542Jun 27, 1996Aug 4, 1998Hyundai Electronics Industries Co.Destination address detection apparatus for hardware packet routerUS5796743Nov 30, 1993Aug 18, 1998General Electric CompanyData word indicator in a system for assembling transport data packetsUS5850187Mar 27, 1996Dec 15, 1998Amtech CorporationIntegrated electronic tag reader and wireless communication linkUS5887176Jun 28, 1996Mar 23, 1999Randtec, Inc.Method and system for remote monitoring and tracking of inventoryUS6012090 *Mar 14, 1997Jan 4, 2000At&T Corp.Client-side parallel requests for network services using group name associationUS6021135Oct 24, 1997Feb 1, 2000Fujitsu LimitedCell assembly and multiplexing device, and demultiplexing deviceUS6070187Mar 26, 1998May 30, 2000Hewlett-Packard CompanyMethod and apparatus for configuring a network node to be its own gatewayUS6111517Dec 30, 1996Aug 29, 2000Visionics CorporationContinuous video monitoring using face recognition for access controlUS6115079Feb 14, 1998Sep 5, 2000Mcrae; Michael W.Programmable video channel controllerUS6115378Jun 30, 1997Sep 5, 2000Sun Microsystems, Inc.Multi-layer distributed network elementUS6125391Oct 16, 1998Sep 26, 2000Commerce One, Inc.Market makers using documents for commerce in trading partner networksUS6145079Mar 6, 1998Nov 7, 2000Deloitte & Touche Usa LlpSecure electronic transactions using a trusted intermediary to perform electronic servicesUS6226675Oct 16, 1998May 1, 2001Commerce One, Inc.Participant server which process documents for commerce in trading partner networksUS6300903Dec 8, 1999Oct 9, 2001Time Domain CorporationSystem and method for person or object position location utilizing impulse radioUS6321264 *Aug 28, 1998Nov 20, 20013Com CorporationNetwork-performance statistics using end-node computer systemsUS6337856May 20, 1998Jan 8, 2002Steelcase Development CorporationMultimedia data communications systemUS6341130Sep 2, 1998Jan 22, 2002Lucent Technologies, Inc.Packet classification method and apparatus employing two fieldsUS6356951Mar 1, 1999Mar 12, 2002Sun Microsystems, Inc.System for parsing a packet for conformity with a predetermined protocol using mask and comparison values included in a parsing instructionUS6363477 *Aug 28, 1998Mar 26, 20023Com CorporationMethod for analyzing network application flows in an encrypted environmentUS6510434Dec 29, 1999Jan 21, 2003Bellsouth Intellectual Property CorporationSystem and method for retrieving information from a database using an index of XML tags and metafilesUS6510464Dec 23, 1999Jan 21, 2003Verizon Corporate Services Group Inc.Secure gateway having routing featureUS6539281Apr 23, 2001Mar 25, 2003Accenture Global Services GmbhOnline medicine cabinetUS6553489Jan 12, 2000Apr 22, 2003Cisco Technology, Inc.System and method for secure and efficient universal port configurationUS6587431Dec 18, 1998Jul 1, 2003Nortel Networks LimitedSupertrunking for packet switchingUS6597918Aug 30, 2000Jul 22, 2003Samsung Electronics Co., Ltd.Apparatus and method for transmitting/receiving long message in digital portable terminalUS6611526May 8, 2000Aug 26, 2003Adc Broadband Access Systems, Inc.System having a meshed backplane and process for transferring data therethroughUS6678827May 6, 1999Jan 13, 2004Watchguard Technologies, Inc.Managing multiple network security devices from a manager deviceUS6683881May 28, 1999Jan 27, 2004Ericsson Inc.Interface between an SS7 gateway and an IP networkUS6718326Aug 10, 2001Apr 6, 2004Nippon Telegraph And Telephone CorporationPacket classification search device and methodUS6745041Jul 19, 2001Jun 1, 2004TekelecMethods and systems for communicating between subscribers of different application-layer mobile communications protocolsUS6771646Jun 30, 2000Aug 3, 2004Hi/Fn, Inc.Associative cache structure for lookups and updates of flow records in a network monitorUS6772211Apr 30, 2002Aug 3, 2004Transtech Networks Usa, Inc.Content-aware web switch without delayed binding and methods thereofUS6772223Apr 10, 2000Aug 3, 2004International Business Machines CorporationConfigurable classification interface for networking devices supporting multiple action packet handling rulesUS6785732Sep 11, 2000Aug 31, 2004International Business Machines CorporationWeb server apparatus and method for virus checkingUS6792002Feb 1, 2001Sep 14, 2004Fujitsu LimitedPacket transfer systemUS6813690Oct 16, 2001Nov 2, 2004Network Appliance, Inc.Caching media data using content-sensitive identifiersUS6816455May 9, 2001Nov 9, 2004Telecom Italia S.P.A.Dynamic packet filter utilizing session trackingUS6826694Oct 22, 1999Nov 30, 2004At&T Corp.High resolution access controlUS6832249 *May 18, 2001Dec 14, 2004Intellectual Ventures Patent Holdings Iii, LlcGlobally accessible computer network-based broadband communication system with user-controllable quality of information delivery and flow priorityUS6862270Jul 14, 2000Mar 1, 2005At&T Corp.Architectural reference model for QoS-driven wireless LANsUS6868426Jul 7, 2000Mar 15, 2005Jeffrey W. MankoffVirtual document organizer system and methodUS6944678Jun 18, 2001Sep 13, 2005Transtech Networks Usa, Inc.Content-aware application switch and methods thereofUS6950822Nov 25, 2002Sep 27, 2005Oracle International CorporationTechniques for increasing efficiency while servicing requests for database servicesUS6963282Dec 5, 2003Nov 8, 2005Microsoft CorporationWireless self-describing buildingsUS6965599Nov 17, 2000Nov 15, 2005Fujitsu LimitedMethod and apparatus for relaying packets based on class of serviceUS6996842Jan 30, 2001Feb 7, 2006Intel CorporationProcessing internet protocol security trafficUS7031314Apr 19, 2002Apr 18, 2006Bytemobile, Inc.Systems and methods for providing differentiated services within a network communication systemUS7032031May 15, 2001Apr 18, 2006Cloudshield Technologies, Inc.Edge adapter apparatus and methodUS7057511Feb 12, 2002Jun 6, 2006Symbol Technologies, Inc.Method, system, and apparatus for communicating with a RFID tag populationUS7064660May 14, 2002Jun 20, 2006Motorola, Inc.System and method for inferring an electronic rendering of an environmentUS7065086 *Aug 16, 2001Jun 20, 2006International Business Machines CorporationMethod and system for efficient layer 3-layer 7 routing of internet protocol (�IP�) fragmentsUS7075412May 29, 2003Jul 11, 2006Thingmagic L.L.C.Methods and apparatus for operating a radio deviceUS7081819Jul 9, 2003Jul 25, 2006Neology, Inc.System and method for providing secure identification solutionsUS7089586May 2, 2001Aug 8, 2006Ipr Licensing, Inc.Firewall protection for wireless usersUS7103886Oct 19, 2001Sep 5, 2006Sap AgSystem, method, computer program product for communicating data for objects that are transported from first location to second locationUS7111076Dec 22, 2000Sep 19, 2006Intel CorporationSystem using transform template and XML document type definition for transforming message and its replyUS7111163Jul 10, 2000Sep 19, 2006Alterwan, Inc.Wide area network using internet with quality of serviceUS7114008May 15, 2001Sep 26, 2006Cloudshield Technologies, Inc.Edge adapter architecture apparatus and methodUS7126907Aug 31, 2001Oct 24, 2006Tropic Networks Inc.Label switched communication network, a method of conditioning the network and a method of data transmissionUS7129837Apr 8, 2004Oct 31, 2006Savi Technology, Inc.Continuous security state tracking for intermodal containers transported through a global supply chainUS7134075Apr 26, 2001Nov 7, 2006International Business Machines CorporationConversion of documents between XML and processor efficient MXML in content based routing networksUS7149222Dec 5, 2000Dec 12, 2006Converged Access, Inc.Integrated access point network deviceUS7177952 *Aug 2, 2000Feb 13, 2007Nortel Networks LimitedMethod and system for switching between two network access technologies without interrupting active network applicationsUS7185365Mar 27, 2002Feb 27, 2007Intel CorporationSecurity enabled network access controlUS7205897Mar 1, 2005Apr 17, 2007Sap AktiengesellschaftProduct flow based auto-ID infrastructureUS7215637Dec 14, 2001May 8, 2007Juniper Networks, Inc.Systems and methods for processing packetsUS7215641Nov 2, 2004May 8, 2007Cisco Technology, Inc.Per-flow dynamic buffer managementUS7239634Jun 17, 2002Jul 3, 2007Signafor, Inc.Encryption mechanism in advanced packet switching systemUS7245620Oct 11, 2002Jul 17, 2007Broadcom CorporationMethod and apparatus for filtering packet data in a network deviceUS7296268Dec 18, 2000Nov 13, 2007Microsoft CorporationDynamic monitor and controller of availability of a load-balancing clusterUS7299361Jan 12, 2004Nov 20, 2007Mcafee, Inc.Remote e-mail scanning system and methodUS7321556Oct 28, 2002Jan 22, 2008Ipolicy Networks, IncApplication prioritization policy engineUS7330908Jul 22, 2005Feb 12, 2008Clouldshield Technologies, Inc.System and method for processing packets using location and content addressable memoriesUS7345585Aug 1, 2005Mar 18, 2008Cisco Technology, Inc.Network based device for providing RFID middleware functionalityUS7362763Sep 4, 2003Apr 22, 2008Samsung Electronics Co., Ltd.Apparatus and method for classifying traffic in a distributed architecture routerUS7363353Jul 8, 2002Apr 22, 2008Juniper Networks, Inc.Content service aggregation device for a data centerUS7376755Jun 10, 2003May 20, 2008Pandya Ashish ATCP/IP processor and engine using RDMAUS7415512May 24, 2001Aug 19, 2008Cisco Technology, Inc.Method and apparatus for providing a general purpose computing platform at a router on a networkUS7421695Nov 12, 2003Sep 2, 2008Cisco Tech IncSystem and methodology for adaptive load balancing with behavior modification hintsUS7437451 *May 16, 2002Oct 14, 2008Hewlett-Packard Development Company, L.P.System and method for collecting desired information for network transactions at the kernel levelUS7469300Jan 16, 2003Dec 23, 2008Mobitv, Inc.System and method for storage and retrieval of arbitrary content and application dataUS7475108Jun 16, 2004Jan 6, 2009International Business Machines CorporationSlow-dynamic load balancing methodUS7483421Mar 29, 2004Jan 27, 2009Sony United Kingdom LimitedRouting dataUS7590843Oct 4, 2000Sep 15, 2009Nortel Networks LimitedKey exchange for a network architectureUS7725934Dec 7, 2004May 25, 2010Cisco Technology, Inc.Network and application attack protection based on application layer message inspectionUS20010027104Jan 29, 2001Oct 4, 2001Heino HameleersMethod for data connections in a cellular mobile communication networkUS20010028308Apr 11, 2001Oct 11, 2001Carlos De La HuergaInteractive medication containerUS20010047422Jan 22, 2001Nov 29, 2001Mcternan Brennan J.System and method for using benchmarking to account for variations in client capabilities in the distribution of a media presentationUS20020012433Jan 8, 2001Jan 31, 2002Nokia CorporationAuthentication in a packet data networkUS20020015485 *Oct 15, 2001Feb 7, 2002Bhusri Gurcharan S.Service and information management system for a telecommunications networkUS20020016739Oct 9, 2001Feb 7, 2002Fujitsu LimitedSystem and method for managing expiration-dated products utilizing an electronic receiptUS20020069279Dec 29, 2000Jun 6, 2002Romero Francisco J.Apparatus and method for routing a transaction based on a requested level of serviceUS20020083817Oct 12, 2001Jul 4, 2002Hoshino Gakki Kabushiki KaishaSnare strainer for a snare drumUS20020101848Dec 5, 2000Aug 1, 2002Ivan LeeSystems and methods for on-location, wireless access of web contentUS20020105911May 23, 2001Aug 8, 2002Parag PruthiApparatus and method for collecting and analyzing communications dataUS20020107951Sep 7, 2001Aug 8, 2002William TeagueReport group managementUS20020114274Sep 19, 2001Aug 22, 2002Sturges James H.Packet based network for supporting real time applicationsUS20020126672Jan 10, 2001Sep 12, 2002Nelson ChowMethod and apparatus for a flexible and reconfigurable packet classifier using content addressable memoryUS20020136403Mar 1, 2001Sep 26, 2002Henson Kevin M.Data decryption systemUS20020143981Apr 3, 2001Oct 3, 2002International Business Machines CorporationQuality of service improvements for network transactionsUS20020152399Apr 12, 2002Oct 17, 2002Smith Gregory JSystem and method for providing exploit protection for networksUS20020161907Apr 24, 2002Oct 31, 2002Avery MoonAdaptive multi-protocol communications systemUS20020163933Nov 2, 2001Nov 7, 2002Mathilde BenvenisteTiered contention multiple access (TCMA): a method for priority-based shared channel accessUS20020165957Oct 2, 2001Nov 7, 2002Devoe Jiva GandharaIntelligent dynamic route selection based on active probing of network operational characteristicsUS20030026268 *Mar 11, 2002Feb 6, 2003Siemens Technology-To-Business Center, LlcCharacteristic routingUS20030140140 *Jan 16, 2003Jul 24, 2003Jesse LahtinenMonitoring the flow of a data streamUS20030204626 *Apr 24, 2002Oct 30, 2003Microsoft CorporationMethod and apparatus for efficiently matching responses to requests previously passed by a network nodeUS20030236883 *Sep 4, 2002Dec 25, 2003Yoshiteru TakeshimaProxy server apparatus and method for providing service using the sameUS20040024868 *Mar 12, 2003Feb 5, 2004Drummond Richard VaneileSystem and method for in situ, real-time, supply chain, interoperability verificationUS20050188103 *Dec 30, 2003Aug 25, 2005Nokia CorporationMethod or device for delivering a packet in a scatternetUS20050229243 *Mar 31, 2004Oct 13, 2005Svendsen Hugh BMethod and system for providing Web browsing through a firewall in a peer to peer networkUS20060248225 *Jul 18, 2006Nov 2, 2006Cisco Technology, Inc.System and Method for Providing Source Awareness in a Wireless Application Protocol Network Environment* Cited by examinerNon-Patent CitationsReference1"Cisco Application-Oriented Networking: A Network-Based Intelligent Message Routing System", http://www.cisco.com/en/US/products/ps6438/products-data-sheet0900aecd802c1f9c.html Data Sheet, Cisco Systems, Inc., Jul. 13, 2005, pp. 1-7.2"Cisco Application-Oriented Networking-A Network Embedded Intelligent Message Routing System", http://www.cisco.com/en/US/products/ps6438/prod-bulletin0900aecd802c201b.html Product Bulletin No. 2886, Cisco Systems, Inc. Jul. 13, 2005, pp. 1-3.3"Cisco Catalyst 6500 Series Application-Oriented Networking Module", http://www.cisco.com/en/US/products/ps6438/products-data-sheet0900aecd802c1fe9.html Data Sheet, Cisco Systems, Inc. Jul. 13, 2005, pp. 1-3.4"Cisco Catalyst 6500 Series Application-Oriented Networking Module: Large Photo", Photo, Retrieved from the internet: http://www.cisco.com/en/US/products/ps6448/prod-view-selector.html [Retrieved Jul. 13, 2005], Cisco Systems, Inc. 1 page.5"EPCgl, Frequently Asked Questions", Retrieved from the internet: http://www.epcglobalinc.com/about/faqs.html, [Retrieved Mar. 24, 2005], 9 pages.6"EPCTM Tag Data Standards Version 1.1 Rev.1.24", EPCglobal, Standard Specification, Apr. 1, 2004, 78 pages.7"The EPCglobal Architecture Framework"EPCglobal Final Version of Jul. 1, 2005, pp. 1-53.8"The Global Language of Business", Retrieved from the internet: http://www.ean-int.org/locations.html, [Retrieved Mar. 24, 2005], 5 pages.9"Cisco Application-Oriented Networking: A Network-Based Intelligent Message Routing System", http://www.cisco.com/en/US/products/ps6438/products�data�sheet0900aecd802c1f9c.html Data Sheet, Cisco Systems, Inc., Jul. 13, 2005, pp. 1-7.10"Cisco Application-Oriented Networking�A Network Embedded Intelligent Message Routing System", http://www.cisco.com/en/US/products/ps6438/prod�bulletin0900aecd802c201b.html Product Bulletin No. 2886, Cisco Systems, Inc. Jul. 13, 2005, pp. 1-3.11"Cisco Catalyst 6500 Series Application-Oriented Networking Module: Large Photo", Photo, Retrieved from the internet: http://www.cisco.com/en/US/products/ps6448/prod�view�selector.html [Retrieved Jul. 13, 2005], Cisco Systems, Inc. 1 page.12"Cisco Catalyst 6500 Series Application-Oriented Networking Module", http://www.cisco.com/en/US/products/ps6438/products�data�sheet0900aecd802c1fe9.html Data Sheet, Cisco Systems, Inc. Jul. 13, 2005, pp. 1-3.13AeroScout Visibility System: Bridging the Gap Between Wi-Fi, Active RFID and Telemetry, AeroScout Enterprise Visibility Solutions, http://www.aeroscout.com/content.asp?page=SystemOverview, printed Apr. 16, 2005, 3 pages.14Alexander, S., et al., DHCP Options and BOOTP Vendor Extensions, RFC 2131, Mar. 1997, 32 pages.15Amended Claims, Application No. 05820894.3-2211/1812870, 6 pages.16Bilorusets, Ruslan et al., "Web Services Reliable Messaging Protocol (WS-ReliableMessaging)", Mar. 2004.17Burns, Michael, et al., "Implementing Address Assurance in the Intel IXP Router", Western Network Processors Conference, Oct. 2002, 17 pages.18Chiu, Kenneth, et al., "Investigating the Limits of SOAP Performance for Scientific Computing", Nov. 7, 2002, IEEE COmputer Society, 8 pages.19Claims, application No. 200580031604.1, 6 pages.20Claims, application No. EP 05820894, 6 pages.21Claims, filing No. 200580031571.0, 8 pages.22Claims, filing No. 200580045932.7, 8 pages.23Claims, International application No. PCT/US05/43599, 8 pages.24Claims, International application No. PCT/US05/46149, 10 pages.25Current Claims for European application 0583164.1, 5 pages.26Current Claims for European application 05853162.5, 6 pages.27Current Claims for European application No. EP 05 85 3162, 6 pages.28Current Claims for European application No. EP 05 85 3164, 5 pages.29Current Claims PCT/US05/40861, 5 pages.30Current Claims PCT/US05/40861, 6 pages.31Current Claims PCT/US05/45625, 8 pages.32Current Claims PCT/US05/45625, 9 pages.33Current Claims, PCT/Us05/41254, 11 pages.34Current Claims, PCT/US05/41254, 12 pages.35Current Claims, PCT/US05/43599, 8 pages.36Current Claims, PCT/US05/44171, 12 pages.37Current Claims, PCT/US05/44171, 9 pages.38Current Claims, PCT/US2006/024375, 5 pages.39Current Claims, PCT/US2006/024375, 6 pages.40Decasper, Dan et al., "Router Plugins: A Software Architecture for Next Generation Routers," IEEE ACM Transactions on Networking, vol. 9, No. 1, Feb. 2000, XP011038838, 14 pages.41Decasper, Dan et al., "Router Plugins: A Software Architecture for Next-Generation Routers," IEEE ACM Transactions on Networking, vol. 9, No. 1, Feb. 2000, XP011038838, 14 pages.42Droms, R., Dynamic Host Configuration Protocol, RFC 2131, Mar. 1997, 43 pages.43European Patent Office, "Communication pursuant to Article 94(3) EPC", Application No. 05820894.3-2211/1812870, dated May 28, 2009, 9 pages.44European Patent Office, "European Search Report", application No. 0583164.1, applicant: Cisco Technology Inc., Dated Nov. 30, 2010, 8 pages.45European Patent Office, "European Search Report", application No. 05853162.5, application Cisco Technology, Inc., Dated Dec. 6, 2010, 11 pages.46European Patent Office, "European Search Report", application No. EP 05820894, Feb. 6, 2009, 8 pages.47European Patent Office, "European Search Report," dated Dec. 6, 2010, application No. EP 05 85 3162, 11 pages.48European Patent Office, "European Search Report," dated Nov. 30, 2010, application No. EP 05 85 3164, 8 pages.49Fujitsu Limited, et al., "Web Services Reliability (WS-Reliability) Ver1.0", Jan. 8, 2003. pp. 1-45.50Fujitsu Limited, et al., "Web Services Reliability (WS-Reliability)," Ver1.0., Jan. 8, 2003. pp. 1-45.51Girardot, Marc et al., "Millau: an encoding format for efficient representation and exchange for XMLover the web," [retrieved on Jan. 31, 2005]. Retrieved from the internet: , 25 pages.52Girardot, Marc et al., "Millau: an encoding format for efficient representation and exchange for XMLover the web," [retrieved on Jan. 31, 2005]. Retrieved from the internet: <URL: http://www9.org/w9cdrom/154/154.html>, 25 pages.53Global Location No. (GLN) Implementation Guide, Uniform Code Council, Inc., May 2002, 13 pages.54Harrington, D., et al, An Architecture for DescribingSimple Network Management Protocol (SNMP) Management Frameworks, RFC 3411, Dec. 2002, 64 pages.55International Preliminary Examining Authority, "Written Opinion of the International Preliminary Examining Authority", International application No. PCT/US05/43599, mailed May 12, 2008, 4 pages.56International Search Authority, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, of the Declaration," PCT/US05/43599, dated Feb. 28, 2007, 8 pages.57International Search Authority, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration," PCT/US05/77141, dated Nov. 30, 2006, 7 pages.58International Search Report dated Feb. 17, 2006, from related International Application No. PCT/US05/15322, 5 pp. including Notification of Transmittal (CISCP378WO).59International Search Report dated Jul. 13, 2006, from (related) International Application No. PCT/US05/16319, 5 pp. including Notification of Transmittal (CISCP43WO).60International Search Report dated Oct. 13, 2005, from (related) International Application No. PCT/US05/16484, 6 pp. including Notification of Transmittal (CISCP377WO).61International Searching Authority, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, of the Declaration," PCT/US05/43599, dated Feb. 28, 2007, 8 pages.62International Searching Authority, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration", International application No. PCT/US05/46149, dated Jul. 20, 2007, 9 pages.63International Searching Authority, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration," PCT/US05/40861, dated Nov. 17, 2006, 7 pages.64International Searching Authority, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration," PCT/US05/41254, dated Mar. 28, 2007, 7 pages.65International Searching Authority, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration," PCT/US05/44171, dated Nov. 30, 2006, 7 pages.66International Searching Authority, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration," PCT/US05/45625, dated Oct. 20, 2006, 7 pages.67International Searching Authority, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Declaration," PCT/US2006/024375, dated Oct. 17, 2006, 10 pages.68International Searching Authority, "Notification of Transmittal of the International Search Report and the Written Opinion of the International Searching Authority, or the Delcaration," PCT/US05/40861, dated Nov. 17, 2006, 7 pages.69International Searching Authority, "Notification of Transmittal of the Internationl Search Report and the Written Opinion of the International Searching Authority, or the Declaration," PCT/US05/45625, dated Oct. 20, 2006, 7 pages.70International Searching Authority, Notification of Transmittal of the International Search Report and the Written Opinion on the International Searching Authority, or the Declaration, International application No. PCT/US05/46149, dated Jul. 20, 2007, 9 pages.71Johnson, R., TFTP Server Address DHCP Option draft-raj-dhc-tftp-addr-option-00.txt, Internet-Draft, Feb. 6, 2005, 7 pages.72Johnston, M., DHCP Preboot Execution Environment (PXE) Options draft-ietf-dhc-pxe-options-01.txt, Internet-Draft, Jan. 21, 2005, 7 pages.73Littlefield, J., Vendor-Identifying Vendor Options for Dynamic Host Configuration Protocol version 4 (DPHCPv4), RFC 3925, Oct. 2004, 9 pages.74Lonvick, C., The BSD Syslog Protocol, RFC 3164, Aug. 2001, 28 pages.75Marc Girardot and Neel Sundaresan. "Millau: an encoding format for efficient representation and exchange of XML over the web" [Retrieved Jan. 31, 2005]. Retrieved from the internet: http://www9.org/w9cdrom/154/154.html 25 pages.76Mockapetris, P., "Domain Names-Concepts and Facilities", RFC 1034, Nov. 1987, 43 pages.77Mockapetris, P., "Domain Names-Implementation and Specifications", RFC 1035, 55 pages.78Mockapetris, P., "Domain Names�Concepts and Facilities", RFC 1034, Nov. 1987, 43 pages.79Mockapetris, P., "Domain Names�Implementation and Specifications", RFC 1035, 55 pages.80Patrick, M., DHCP Relay Agent Information Option, RFC 3046, Jan. 2001, 14 pages.81Pending Claims, Application No. 200580045932.7, 8 pages.82Polk, J., et al., Dynamic Host Configuration Protocol Option for Coordinate-based Location Configuration Information, RFC 3825, Jul. 2004, 15 pages.83Preshun, R., Editor, Version 2 of the Protocol Operations for the Simple Network Management Protocol (SNMP), RFC 3416, Dec. 2002, 31 pages.84Ruslan Bilorusets et al., "Web Services Reliable Messaging Protocol (WS-ReliableMessaging)", Mar. 2004, pp. 1-40.85Schramm, C. et al., "Application-Oriented Network Modeling with Mobile Agents," 1998, IEEE (5 pages).86Schulzrinne, H., Dynamic Host Configuration Protocol (DHCPv4 and DHCPv6) Option for Civic Addresses Configuration Information, draft-ietf-geopriv-dhcp-civil-05, Internet-draft, Feb. 19, 2004.87Sharp R L et al. "Network Security In a Heterogeneous Environment," AT & T Technical Journal, American Telephone and Telegraph Co. New York, US vol. 73, No. 5, Sep. 1, 1994, pp. 52-59.88Sharp R.L. et al. "Network Security In a Heterogeneous Environment", AT&T Journal, American Telephone and Telegraph Co. New York, US, vol. 73, No. 5, Sep. 1, 1994 pp. 52-59.89Simple Network Management Protocol, Internetworking Technologies Handbook, Chapter-56, printed Jul. 14, 2005, 12 pages.90State Intellectual Property Office of the People's Republic of China "The First Office Action" mailed Jun. 27, 2008, Serial No. 200580031604.01, Applicant Cisco Technology, Inc.; 15 pages.91State Intellectual Property Office of the People's Republic of China, "The First Office Action", application No. 200580031604.1, Dated Jun. 27, 2008, 15 pages.92State Intellectual Property Office of the People's Republic of China, "The First Office Action", filing No. 200580031571.0, Dated Dec. 19, 2008, 9 pages.93State Intellectual Property Office of the People's Republic of China, "The First Office Action", filing No. 200580045932.7, Dated Nov. 28, 2008, 8 pages.94Stump, G., et al., The User Class Option for DHCP, RFC 3004, Nov. 2000, 6 pages.95The Patent Office of the People's Republic of China, "The Second Office Action", Application No. 200580045932.7, dated May 8, 2009, 9 pages.96T'Joens, Y., DHCP Reconfigure Extension, RFC 3203, Dec. 2001, 6 pages.97WhereNet, Products, http://wherenet.com/products main.html, printed Apr. 16, 2005, 2 pages.98Written Opinion of the International Searching Authority dated Feb. 17, 2006, from related International Application NO. PCT/US05/15322, 3 pp. (CISCP378WO).99Written Opinion of the International Searching Authority dated Jul. 13, 2006, from (related) International Application No. PCT/US05/16319, 5 pp. (CISCP460WO).100Written Opinion of the International Searching Authority dated Oct. 13, 2005, from (related) International Application No. PCT/US05/16484, 5 pp. (CISCP377WO).Referenced byCiting PatentFiling datePublication dateApplicantTitleUS8171553 *Apr 20, 2006May 1, 2012Fireeye, Inc.Heuristic based capture with replay to virtual machineUS8204984Nov 30, 2007Jun 19, 2012Fireeye, Inc.Systems and methods for detecting encrypted bot command and control communication channelsUS8291499Mar 16, 2012Oct 16, 2012Fireeye, Inc.Policy based capture with replay to virtual machineUS8375444Jul 28, 2006Feb 12, 2013Fireeye, Inc.Dynamic signature creation and enforcementUS8528086Mar 31, 2005Sep 3, 2013Fireeye, Inc.System and method of detecting computer wormsUS8539582Mar 12, 2007Sep 17, 2013Fireeye, Inc.Malware containment and security analysis on connectionUS8548998 *Jan 13, 2010Oct 1, 2013Aorato Ltd.Methods and systems for securing and protecting repositories and directoriesUS8549638Jun 13, 2005Oct 1, 2013Fireeye, Inc.System and method of containing computer wormsUS8561177Nov 30, 2007Oct 15, 2013Fireeye, Inc.Systems and methods for detecting communication channels of botsUS8566946Mar 12, 2007Oct 22, 2013Fireeye, Inc.Malware containment on connectionUS8584239Jun 19, 2006Nov 12, 2013Fireeye, Inc.Virtual machine with dynamic data flow analysisUS8621220 *Mar 2, 2011Dec 31, 2013Ebay Inc.Systems and methods for identity encapsulated cryptographyUS8635696Jun 28, 2013Jan 21, 2014Fireeye, Inc.System and method of detecting time-delayed malicious trafficUS8713170 *Nov 18, 2011Apr 29, 2014The Boeing CompanyServer-side web analytics system and methodUS8776229Aug 28, 2013Jul 8, 2014Fireeye, Inc.System and method of detecting malicious traffic while reducing false positivesUS8793787Jan 23, 2009Jul 29, 2014Fireeye, Inc.Detecting malicious network content using virtual environment componentsUS8832829Sep 30, 2009Sep 9, 2014Fireeye, Inc.Network-based binary file extraction and analysis for malware detectionUS8850571Nov 3, 2008Sep 30, 2014Fireeye, Inc.Systems and methods for detecting malicious network contentUS8898788Mar 12, 2007Nov 25, 2014Fireeye, Inc.Systems and methods for malware attack preventionUS8935779Jan 13, 2012Jan 13, 2015Fireeye, Inc.Network-based binary file extraction and analysis for malware detectionUS8972575Apr 21, 2014Mar 3, 2015The Boeing CompanyServer-side web analytics system and methodUS8984638Nov 12, 2013Mar 17, 2015Fireeye, Inc.System and method for analyzing suspicious network dataUS8990939Jun 24, 2013Mar 24, 2015Fireeye, Inc.Systems and methods for scheduling analysis of network content for malwareUS8990944Feb 23, 2013Mar 24, 2015Fireeye, Inc.Systems and methods for automatically detecting backdoorsUS8997219Jan 21, 2011Mar 31, 2015Fireeye, Inc.Systems and methods for detecting malicious PDF network contentUS9009822Feb 23, 2013Apr 14, 2015Fireeye, Inc.Framework for multi-phase analysis of mobile applicationsUS9009823Feb 23, 2013Apr 14, 2015Fireeye, Inc.Framework for efficient security coverage of mobile software applications installed on mobile devicesUS20080005782 *Apr 20, 2006Jan 3, 2008Ashar AzizHeuristic based capture with replay to virtual machineUS20110225423 *Mar 2, 2011Sep 15, 2011Ebay Inc.Systems and methods for identity encapsulated cryptograhyUS20110258208 *Jan 13, 2010Oct 20, 2011Idan PlotnikMethods and systems for securing and protecting repositories and directoriesUS20120290581 *Jul 20, 2012Nov 15, 2012Reuters America, Llc.Messaging model and architectureUS20130132558 *Nov 18, 2011May 23, 2013The Boeing CompanyServer-Side Web Analytics System and Method* Cited by examinerClassifications U.S. Classification709/237, 709/238International ClassificationG06F15/173, G06F15/16Cooperative ClassificationH04L69/08, H04L51/00, G06F9/546European ClassificationG06F9/54MLegal EventsDateCodeEventDescriptionFeb 9, 2015FPAYFee paymentYear of fee payment: 4Mar 24, 2005ASAssignmentOwner name: CISCO TECHNOLOGY, INC., CALIFORNIAFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:RAGHAVAN, KOLLIVAKKAM;ANTHIAS, TEFCROS;VAN OLESON, PARLEY;AND OTHERS;REEL/FRAME:016423/0705;SIGNING DATES FROM 20050304 TO 20050322Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:RAGHAVAN, KOLLIVAKKAM;ANTHIAS, TEFCROS;VAN OLESON, PARLEY;AND OTHERS;SIGNING DATES FROM 20050304 TO 20050322;REEL/FRAME:016423/0705Owner name: CISCO TECHNOLOGY, INC., CALIFORNIAFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:RAGHAVAN, KOLLIVAKKAM;ANTHIAS, TEFCROS;VAN OLESON, PARLEY;AND OTHERS;SIGNING DATES FROM 20050304 TO 20050322;REEL/FRAME:016423/0705RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services