Source: http://www.google.com/patents/US20020105911?dq=inventor:%22Arthur+R.+Hair%22&ei=VAy0Tsa4NYTl0QGQiqWiBA
Timestamp: 2016-12-04 20:47:41
Document Index: 512849099

Matched Legal Cases: ['art 600', 'art 1013', 'art 1013', 'art 1235', 'art 1535', 'art 1536']

Patent US20020105911 - Apparatus and method for collecting and analyzing communications data - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inPatentsA method for monitoring data on a first communication line. Data is received from the first communication line and a plurality of packets are extracted from the data. Statistics are then recursively generated, the statistics corresponding to the plurality of packets....http://www.google.com/patents/US20020105911?utm_source=gb-gplus-sharePatent US20020105911 - Apparatus and method for collecting and analyzing communications dataAdvanced Patent SearchTry the new Google Patents, with machine-classified Google Scholar results, and Japanese and South Korean patents.Publication numberUS20020105911 A1Publication typeApplicationApplication numberUS 09/863,593Publication dateAug 8, 2002Filing dateMay 23, 2001Priority dateNov 24, 1998Also published asCA2351175A1, CA2351175C, CN1214567C, CN1328744A, CN1700657A, DE19983761B3, DE19983761B9, DE19983761T0, DE19983761T1, EP1145541A1, EP1145541A4, EP1145541B1, US7492720, US8102782, US8873410, US20090232016, US20120092343, WO2000031963A1, WO2000031963A8, WO2000031963A9Publication number09863593, 863593, US 2002/0105911 A1, US 2002/105911 A1, US 20020105911 A1, US 20020105911A1, US 2002105911 A1, US 2002105911A1, US-A1-20020105911, US-A1-2002105911, US2002/0105911A1, US2002/105911A1, US20020105911 A1, US20020105911A1, US2002105911 A1, US2002105911A1InventorsParag Pruthi, Andrew Heybey, Thekkthalackal KurienOriginal AssigneeParag Pruthi, Andrew Heybey, Kurien Thekkthalackal V.Export CitationBiBTeX, EndNote, RefManPatent Citations (10), Referenced by (329), Classifications (27), Legal Events (3) External Links: USPTO, USPTO Assignment, EspacenetApparatus and method for collecting and analyzing communications data
DETAILED DESCRIPTION OF THE INVENTION [0030] PCT International Patent Application No. PCT/US99/27969, filed Nov. 23, 1999, and U.S. Provisional Patent Application Serial No. 60/109,718, filed Nov. 24, 1998, are incorporated by reference herein in their entireties as though fully set forth herein. [0031] Referring now to the drawing, in which like reference numerals refer to like elements throughout, FIG. 1 illustrates an exemplary network monitor 102 according to the present invention which is coupled to an exemplary network N1 106 via a first communication line 104. The network monitor 102 receives (monitors) data communications (traffic) on communication line 104 and provides real-time metrics or statistics of the data traffic on the communication line 104. [0032] The communication line 104 may use a single data link layer protocol to transport traffic of a multitude of different higher hierarchical protocol layer protocols. One such hierarchical protocol structure 200 is illustrated in FIG. 2. The data link layer protocol 202, Ethernet in this exemplary case, of traffic between the network N1 106 and the router 108 may include encapsulated IPX, IP, ARP, or other network layer 204 traffic. The IP traffic may include encapsulated UDP, TCP, ICMP or other transport layer 206 traffic. The TCP traffic may include encapsulated Web, FTP, Domain Name Service, or other application layer 208 traffic. [0033] The network monitor 102 according to the present invention includes hardware and software (discussed below) which collects and analyzes network traffic in such a way that it can generate a variety of real-time statistics on such traffic at one or multiple protocol layers. The real-time statistics generated by network monitor 102 enable quality and quantity of service analysis, billing based on quality of service and quantity of service, dynamic network resource allocation and planning, customer profiling based on data content, network security analysis, and session playback. Exemplary statistics include byte counts, bit counts, one-way or roundtrip delays, response times, retransmitted bytes, originating bytes per host, terminating bytes per host, originating-terminating host pair counts, web abort rates, throughput, goodput, and percent retransmitted bytes due to delays or losses. These statistics may selectively be provided based on traffic on the first communication line 104 on one or multiple protocol layers between the data link layer and the application layer. [0034] Operation of an exemplary network monitor 302 shown in FIG. 3 is described with reference to the flow chart in FIG. 4. The network monitor 302 includes a first network interface 304 coupled to a first communication line 308 by a first connection 312 and a second network interface 306 coupled to a second communication line 310 by a second connection 314. The first interface 304 receives first data (a bitstream) from the first communication line 308 (step 402) and the bitstream is then segregated into packets (step 404). The term segregate is used herein to mean that previously defined packets are being extracted from the bitstream. The bitstream may be segregated into packets by either the interface 304 or by the host computer 316. The packets are stored in memory 318 which is hierarchical in this embodiment and includes a short-term memory 320 and at least one longer-term memory 322. A processor and query engine 316, optionally controlled by a user interface 324, then processes the packets as described below with reference to FIG. 4. [0035] In an exemplary embodiment, the network monitor 302 is coupled to the first communication line 308 in a non-intrusive manner. That is, it does not directly hinder the flow of traffic on the communication line. The network monitor 302 may be coupled to the communication line 308, for example, by plugging the first connection 312 into a port or jack on a switch or router, by breaking the communication line 308 and installing a Y-connector to which the first connection 312 is coupled, by connecting the first connection to a hub, using an optical splitter, or by connecting the network monitor 302 to a monitoring jack in a central office. [0036] Processor and query engine 316 converts the packets into records and stores the records in memory (steps 414-422). Processor and query engine 316 includes suitable programming to generate statistics corresponding to the packets (steps 406-412). Although the generation of statistics for the packets may be accomplished in a variety of ways, one preferred approach processes a set of packets received over a predetermined timer interval or “sampling time” (step 406) to generate corresponding statistics (step 408). The processing is then repeated in a recursive fashion to successive sets of packets received during successive time periods (step 410). During such processing, suitable programming stores the generated statistics in memory at appropriate intervals of time, such intervals preferably on the same order as the time intervals corresponding to the sets of packets. [0037] The conversion of the packets into records permits a wide variety of further statistics to be generated as now described. The records are generated by first determining the type of each packet (step 414) and then filtering the packets (step 416) based on their determined types. An index is generated (step 418) for each packet and the packet is then converted into an indexed record (step 420) and stored in memory (step 422). Further statistics are then generated (step 426) using the statistics previously generated for the packets and records are then provided to one or more applications such as a display device (step 428), a router for dynamically adjusting network routing based on the further statistics (step 430), and a billing service for billing clients based on quality or quantity of service as determined based on the generated statistics (step 432). [0038] Application of the process of FIG. 4 is now described for an Ethernet communication line including encapsulated IP packets which encapsulate TCP packets which encapsulate web traffic (See FIG. 2). The Ethernet bitstream is received from the communication line (step 402) and is segregated into packets (step 404). The packets are divided into sets, each set including packets received during one of successive one-second time periods (exemplary time period) (step 406). The number of bits received during each one-second time period (exemplary statistic) is calculated (step 408). Successive statistics are generated for successive time periods by receiving the next set of packets corresponding to the next one-second time period (step 412) and then calculating the number of bits in those packets (step 408). The bit counts for each one-second time interval are stored in memory (step 412) as they are generated. [0039] A type (e.g. IP, ARP, . . . ) of each packet is determined (step 414). If a user only wishes to analyze traffic of IP packets, the packets are filtered to pass only the IP packets (step 416). The time when the network monitor received each IP packet is used as an index for the each respective IP packet (418). An indexed record is then generated (step 420) for each IP packet and is stored in memory (step 422). An exemplary record having the index as a first field F1 and the packet as a second field F2 is illustrated below. F1: Index (time of receipt) F2: Packet or portion of packet [0040] In addition to the filtering (step 416) only passing IP packets, the filter may also be used to pass only a portion of the packet, such as only the IP portion, by truncating the Ethernet overhead portion so the record above contains only the IP portion in the second field F2. Alternatively, the record may include a plurality of fields, each corresponding to a portion of the IP packet such as a source address or destination address, and filtering may be performed based on any one or more of the plurality of fields. [0041] Any number of statistics can be generated from the stored records alone, or in combination with statistics for the packets generated in steps 406-412. In this example, a further statistic known to the art of interest includes the ratio of the number of bits in IP packets received to the number of bits in all packets received for each successive minute (step 426). The calculation of this statistic is facilitated according to the present invention, because the stored packets are already all IP packets and are indexed by time of receipt. As such, the calculation is performed by sorting the records by index, reading the set of records for each successive minute, and adding the number of bits in each set of records. The number of bits in all packets per minute may be calculated by summing the previously calculated bit counts generated on a per second basis in groups of sixty (thereby equaling one minute). Thus, the further statistic is generated using both the stored records and the stored statistics, which reduces the number of additional calculations needed and the time to generate such further statistic. [0042] A specific example of the filtering and storing methods performed by a network monitor according to the present invention was described above with regard to FIG. 4. The flexibility of data collection and analysis methods of a network monitor 500 according to the present invention are described below with regard to the data flow diagram of FIG. 5. [0043] An incoming bitstream is packetized by a packetizer 502. Decoding of the bitstream may be automatically performed for known protocols or may be performed according to user-specified parameters for custom or proprietary protocols. For example, if a new data link layer protocol is introduced, network monitor 500 includes suitable programming to respond to user-defined protocols, entered using the user interface 520. The inventive network monitor 500 thus recognizes packet structures of the new protocol to packetize an incoming bitstream. The network monitor could then perform its data collection and analysis methods through the higher protocol layers. This flexibility is not limited to the data link layer. In other words, the network monitor 500 according to the present invention is able to collect and analyze data communications for custom protocols at other protocol layers. [0044] The packets may be directly stored into the short-term memory 510 using path A. This is useful for storing all data received from the communication line. The short-term memory 508 may periodically transfer data to a long-term memory 510 to prevent overflow. Although illustrated as having only a single short-term memory 508 and a single long-term memory 510, the teachings of the present invention are applicable to other hierarchical memory structures including a plurality of memory devices. For example, the memory may include a random access memory (RAM), a disk memory, and a tape memory. As the RAM fills, data is transferred to the disk memory. As the disk memory fills, data is transferred to the tape memory. As the tape memory fills, tapes are replaced for continuous or long-term data storage for archival purposes, for example. As indicated by the double arrow to the short-term memory 508 and between the memories 508, 510, data stored in the memories may later be retrieved for analysis or for one of the applications 522-530 discussed below. [0045] Storing all packets directly into memory may be desired for security applications 528. For example, the network monitor may be programmed to store all communications for a period of 1 week and then overwrite the oldest stored data. If a breach in security is detected within a week of its occurrence, the stored data may be analyzed by the network monitor to determine the source and extent of the breach. [0046] The packetized data may alternatively be provided by the packetizer 502 to the index generator 504. The index generator 504 generates an index corresponding to one or more of the received packets. Examples of an index corresponding to a packet include a time stamp to indicate the time it was received by the network monitor, the type of packet (protocol and/or layer), the size of packet, a packet number (1, 2, 3, . . . ), an interface number, an application, and an associated session. Record generator 506 receives the packets and the generated index and generates a record including the generated index. Alternatively, the record generator 506 may combine the received packet and index with an existing record previously stored in memory 508, 510. The record generator may also receive a packet directly via path C and generate an unindexed record including the packet or may combine the packet into an existing record previously stored in memory 508, 510. [0047] For example, a single record may be generated corresponding to an ATM session. When a first cell (a fixed size packet) corresponding to the ATM session is received, it may be indexed and an indexed record may be generated and stored in the memory 508, 510. The index may be an identifier of the ATM session, for example. When further cells corresponding to the ATM session are received, not necessarily in order, the record generator 506 may directly receive these cells via path C, read the previously stored indexed record from memory 508, 510, and then combine the newly received cell into the indexed record. In addition to simply combining packets belonging to a common ATM session in a common record, the record generator 506 may also orient the received ATM cells within the record in their correct order. [0048] The record/packet type identifier 512 receives packets or records from either the record generator 506 or from the memory 508 and then characterizes the received packets or records by identifying its corresponding “type” or “property”. The type or property of a packet or record is a versatile identifier and may be programmed via the user interface 520. Examples of packet or record types or properties include the number of corresponding bits or bytes, its protocol layer, its protocol type at a particular protocol layer, a source address, a destination address, an end-user ID, and an application ID. The records or packets are then filtered in the packet type filter 516 based on the property or type identified by the record/packet type identifier 512. The filtered records or packets are then indexed, indexed and turned into records, or directly stored into memory 508, 510. [0049] The time period filter 514 receives records or packets from the record generator or the memory 508, 510, and filters them based on the time they were received from the communication line by the network monitor. The records or packets are then segregated into groups corresponding to packets received by the network monitor during respective successive time periods. The statistic generator 518 then generates statistics for each of the successive time periods corresponding to packets received during each respective successive time period. [0050] The filtered packets and the generated statistics may be stored in memory. The paths between the functional blocks in FIG. 5 illustrate that the contents of memory, may then again be used to perform further filtering or statistic generation. Thus, a network monitor according to the present invention may recursively collect and analyze data by generating statistics based on previously generated statistics or stored packets. [0051] In addition to programming the network monitor for a custom protocol as described above, the user interface 520 may also define the operating parameters of the functional blocks within the network monitor. For example, a user may specify the index to be used by the index generator 504, the time period to be used by the time period filter 514, and the statistics to be generated by the statistic generator 518 for each of the successive time periods. [0052] The collected data and the corresponding analysis generated by the network monitor 500 may be provided to one or more applications 522-530. For example, a display device 522 may display statistics, records or packets responsive to user selection as further described below with regard to the display screens in FIGS. 10-28. [0053] The statistics generated by the network monitor 500 may be provided to a network administrator or router 524 to allow for dynamic routing of communications and network bandwidth management, also known as “yield management”, on a network responsive to statistics corresponding to network performance. It is readily appreciated that, by measuring one-way delays and by providing traffic statistics on a protocol-by-protocol basis at different protocol layers, a network monitor according to the present invention can identify these asymmetries by quantifying traffic flows to allow a network administrator to properly size network resources according to the measured flows. [0054] Communication networks can be optimized at the service layer because the network monitor according to the present invention includes suitable programming to analyze traffic flows at any protocol layer. Although different services may have different service requirements, these services are often integrated in a single communication network. Nonetheless, services such as real-time multimedia, voice over IP, data, and Intranet may each have unique network service requirements. For example, for voice over IP, due to low tolerances in voice transmissions degradation, a lower quality of service including delay or loss of data may not be tolerated. In contrast, data transmission can proceed in a lossy environment due to error recovery by retransmission. An exemplary router 524 is configured to route traffic corresponding to different services differently depending on their service requirements. [0055] The network monitor according to the present invention includes programmed features which identify flows corresponding to each individual service and/or user and provide for analysis of interactions with different services. This information may be used by a router, for example, to make real-time or non-real-time decisions on optimizing network topologies, routes, or service segregation, etc. to achieve an optimal configuration suitable for providing each and every service with its own unique quality of service requirement. [0056] A billing system 526 may be configured to receive quality and/or quantity of service statistics corresponding to different services and different hosts and bill clients accordingly. This allows clients to be billed based on these statistics rather than providing flat rate billing for previously unmeasured service. For example, a client may use her unlimited Internet service for voice over IP communication. According to the present invention, the network monitor 500 may generate statistics for a particular client on the number, duration, and destination of voice over IP calls. The statistics are then converted to billing information by the billing system 526 and the client is billed accordingly. Thus, an Internet subscriber that uses the Internet for voice over IP calls, may now be billed according to the quantity, duration, and destination of calls as is done for non-Internet telephone service. Clients may similarly be billed based on a number of e-commerce transactions, a number of stock trades, a number of requests for real-time stock quotes, and other transactions. Alternatively, clients may have service contracts including different billing rates depending on a quality of service provided and may be billed accordingly. A network monitor may also be used to ensure compliance with service contracts which guarantee minimum service standards or service level agreements. [0057] As described above, the collected data may be used for security 528 to identify breaches in security, to identify improper network use or illegal activity. For example, packets may be filtered to identify particular files which have been FTP'd to a server, to identify who telnetted (logged onto) a particular machine or server, and to see what they typed once logged on. [0058] Statistics from a network monitor may be correspond to a user or a group of users for profiling the user or group. Much Internet advertising is directed to customers based on a customer profile generated by asking a user to answer a few questions. A network monitor according to the present invention can filter each received packet based on its contents to build individual customer profiles. For example, a node which monitors the Philadelphia customer base may look at every packet from every user before it enters the Internet. Also, the returned traffic to these users can be analyzed by looking (filtering) for specific text within the packets or for the web sites visited by the user. A profile per user or group of users may then be generated based on the filtered data to target content to the user which will be of interest to the user such as targeted email. The method described above for filtering may similarly be used by law enforcement or security officials to monitor communications to detect unlawful activity or to monitor activity of selected users. [0059] The network monitor may also be used to provide data to a playback device 530 to playback client sessions which were monitored from the communications line. All received packets may be recorded and then filtered based on a particular session. The session may be identified based on information included in the packets themselves or based on session information received in special packets or channels such as SDR (session directory protocol). The packets corresponding to the session may then be played back in a fashion originally presented to the user. This method may be used to replay all web activity of a user or of voice over IP conversations. [0060] The network monitor may be configured by a user to monitor communication lines that transport traffic using a proprietary or custom protocol. Along with a suitable physical layer interface between the network monitor and the communication line, a user may enter proprietary protocol parameters using the user interface. The parameters define the structure of packets within the bitstream transported on the communication line for the network monitor to segregate the packets from the bitstream. Additional parameters may also define fields within a packet so the network monitor could be configured with custom queries to provide statistics based on the content of these packet fields. The network monitor may similarly be programmed to receive and analyze data corresponding to custom protocols at layers higher than the link layer. [0061] In an exemplary network, the data transmission protocol provides for each packet to include a time stamp field. Packets transmitted from a source to a destination include a time stamp value in the time stamp field indicating a time of transmission by the source. When the packet is received at the destination, the destination can compute the one-way transmission duration or delay from the source to the destination by subtracting the time stamp value from a current time value. This protocol allows for simpler one-way transmission delay and quality of service measurements by eliminating the need for communication between network monitors to match packet pairs at separate network monitors. [0062] For a network including many separate intermediate transmission paths between the source and the destination, the one-way end-to-end transmission duration information does not provide information regarding a particular bottleneck somewhere between the source and destination. For improved bottleneck diagnosis, rather than only calculate end-to-end delays, a network monitor according to the present invention can be coupled to one of the intermediate separate transmission paths between the source and destination. The network monitor can receive the time stamp value from a packet traversing the network from the source to the destination. The time stamp value may be subtracted to the current time at time of receipt of the packet by the network monitor to determine an intermediate duration value. One or more intermediately spaced monitors may be used as described above to locate the bottleneck in a network. In an exemplary embodiment each of the source, destination, and network monitor include a GPS (global positioning satellite) interface for receiving the current time used to calculate the transmission duration. [0063] One of the metrics that a network monitor according to the present invention can provide is an indication of the number of aborted connections for a particular source-destination pair, for a particular source or destination, and information on the ratio of aborted connections to total connections for a particular source or destination. An exemplary method of identifying troubled TCP (transmission control protocol) servers is described with regard to the flow chart 600 in FIG. 6. [0064] As known to those skilled in the art, a TCP session is normally opened by the client and is then closed by the server when it has no more data to send to the client. If a TCP session is closed by the client, this indicates that the session is being terminated prematurely. Using the web as an example, a client (user using browser) may close the session for reasons including simply changing one's mind regarding the need for the desired data or due to impatience due to delay in receiving desired data. [0065] The network monitor receives a packet from a communication line (step 602) and identifies whether the packet belongs to a TCP session (step 604). The network monitor may identify whether the packet is a TCP packet by identifying and decoding a protocol field in the packet which identifies which of several transport layer protocols the packet belongs to. Once a packet is identified as TCP, the TCP client and TCP server are identified (step 606). The packet is then examined to determine whether it opens or is initiating the TCP connection (step 608). If the packet is the opening or initiating packet of a TCP session, a count of the total number of TCP sessions for the previously identified (in step 606) TCP server is incremented (step 610). [0066] If the packet is not an opening packet, the network monitor next determines whether the packet is closing the TCP connection (step 612). If not, the network monitor gets the next packet (step 602). Otherwise, the network monitor determines (step 614) whether the connection is being closed by the server, by examining the FIN bit for example, or whether the connection is being closed by the client. Closure by the server indicates normal termination of the session and the network monitor gets the next packet (step 602). Closure by other than the server indicated premature termination of the session and a premature closure count corresponding to the particular server is incremented (step 616). The ratio of premature closures to the total TCP sessions of the particular server is calculated (step 620) and compared to a predetermined threshold value (step 622). If the ratio of premature closures exceeds the threshold, the particular server is identified as a “troubled server” (step 624). [0067] As known to those skilled in the art, in some networks all packets corresponding to a particular TCP session may not travel through the same communication line and therefore may not be detected by a single network monitor interface. A network monitor can be placed in proximity to or on a server or client to “catch” all packets. Alternatively, multiple network monitor interfaces may be used as described above to store records corresponding to packets. The stored records may then be analyzed to determine which servers may be “troubled”. In an exemplary embodiment, remote network monitors each look for FIN packets, using a filter, for example, and upon detecting a FIN packet they send a message including the contents of the FIN packet to a central monitor that makes the “troubled server” determination. [0068] Although the teachings regarding measuring aborted connections and identifying troubled servers are described above with regard to TCP sessions, these teachings are generally applicable to other protocols and to other protocol layers and are not limited to identifying troubled TCP servers. For example, in another protocol, a session may be both opened and closed by the same node, whether it be the client or the server. In addition, the session payloads may be transmitted in separate packets from or on separate communication links from the session control messages. [0069] In a futher alternative embodiment shown in FIG. 7, a system 701 for monitoring communications according to the present invention may include one or more network monitors each coupled to respective communication lines in a network as shown in FIG. 7. First, second, and third network monitor 700, 710, 720 are coupled to the first, second, and third communication lines 702, 712, 722, respectively. Each network monitor 700, 710, 720 collects and analyzes data received from its respective communications line as described above with regard to the data flow diagram in FIG. 5. [0070] In addition to providing independent data collection and analysis, a system including a plurality of network monitors 700, 710, 730 may correlate data received at the different network monitors to provide improved network performance analysis. For example, one-way delay may be calculated for data traveling from the first communication line 702 to the second communication line 712. [0071] An exemplary method of calculating the one-way delay is illustrated by the flow chart in FIG. 8. Generally, the “same” packet is identified at two separate network monitors and the difference in time between when it was received by each monitor is used to calculate the one-way delay. The “same” packet is identified by zeroing out portions of the packet that change between the separate network monitors. [0072] Each of the first and second network monitors 700, 710 receives data (step 802, 806) from its respective communication line 702, 712. The packetizer 502 segregates the received data into packets (steps 803, 807) and each the index generator (504) associates the time of receipt (time stamp) of each packet with each packet. The record generator 506 generates a record including the time stamp of corresponding to each packet and a unique portion of the data packet (UDPD) and stores the record in memory 508, 510 (steps 804, 808). [0073] The UPDP is a portion of the received packet that makes the data unit uniquely identifiable. For example, for an Ethernet communications line and an IP payload, the Ethernet header is removed from the packet, the IP ttl and checksum fields are zeroed, and the IP header and the 20 succeeding bytes are saved and incorporated by the record generator 506 into a UPDP record. The UPDP may be different for different protocols and may be programmed using the user interface. [0074] The UPDP records of the first network monitor 700 are compared to the UPDP records of the second network monitor 710 to match pairs of UPDPs (step 810)). [0075] The first and second network monitors may communicate via a communication link 7:30. [0076] The communication link 730 may be implemented by communication of the network monitors through the network they are monitoring (in-band). Alternatively, the communication link 730 may be implemented by communication external to the network over a telephone line, a radio connection, or a satellite connection, for example (out-of-band). [0077] For each matched pair of UPDPs, the corresponding time stamp ts2 from the second network monitor is subtracted from the corresponding time stamp ts 1 from the first network monitor (step 812). This time difference ts1−ts2 represents the duration for the data corresponding to the UPDP to travel from the second network monitor 710 to the first network monitor 700. By calculating the UPDP, the transmission duration of a certain payload between first and second communication lines 702, 712 using the same or different communication protocols may be determined according to the method described above. [0078] In an exemplary embodiment, the time difference ts1−ts2 is normalized (steps 814, 816) to account for the delay of the first communication line 702. The delay is normalized by subtracting the delay xmit-delay for the packet corresponding to the UPDP to traverse the first communication line from the time difference as illustrated by the equation below: [0079] Normalized Network Delay=(ts1−ts2)−(link_speed/packet_length) [0080] where link_speed is the transmission rate on the first communication line 712, and packet_length is the length of the packet on the first communication line which contained the UPDP. The calculated network delay may include components due to queuing delay and to transmission delay. As illustrated by the data flow diagram in FIG. 5, the statistic generator 518 can receive the packet for which is UPDP record is to be generated, the statistic generator 518 calculates the number of bits in the packet and provide this statistic to the record generator for incorporation into the UPDP record for use in a normalization calculation. Round-trip times may be estimated by similarly calculating the delay from the first to the second network monitor and adding this delay to the delay between from the second to the first network monitor. [0081] The accuracy of the calculated transmission delay depends on the synchronization of the time clocks of the first and second network monitors 700, 710. The network monitors may communicate via communication line 730 to synchronize their respective clocks. In an exemplary embodiment, the network monitors are synchronized by receiving a time signal from a common time source 740. In an exemplary embodiment, the transmission delay is generated at a level of accuracy less than 10 microseconds, that is, the difference between the calculated delay and the actual delay is less than 10 microseconds. In a preferred embodiment, the common time source 740 is a system of global satellites such as the global positional satellites (GPS) and each network monitor 700, 710 includes a receiver for receiving a time signal from one or more global satellites. When the two communication lines to be monitored are proximate to each other, one of the first and second network monitors 700, 710 may include a master GPS receiver and the other may include a slave GPS receiver coupled to the master. [0082] An exemplary network monitor is implemented with a host computer having an interface computer on a network interface card (NIC) coupled to the communication line it is monitoring. As described above, data received by the NIC may be processed before being sent to the host computer. Also as described above, the network monitor may use the time of receipt of data from the communication line for generating network communication statistics or metrics. In order to accurately record the time when data is received from the communication line, the interface computer associates a time of receipt with the data (time stamps the data). By having the interface computer rather than the host computer time stamp the data, inaccuracies in the time of receipt due to a delay in transferring data from the interface computer to the host computer are reduced or eliminated. [0083] In an exemplary embodiment, the interface computer includes an interface clock and the host computer has a host clock. The host clock and the interface clock are synchronized so the host computer can use the time stamp to accurately generate statistics corresponding to the received data. In an exemplary embodiment, the interface clock is implemented as a counter. As each packet is received from the communications line, the current value of the counter is associated with that packet. The packet is later transferred to the host computer with the counter value. The host computer includes a host clock synchronized with an absolute time reference. As described above, the absolute time reference may be provided by a global positioning satellite. [0084] The host clock and the interface clock are synchronized by correlating the counter values associated with each packet by the interface computer with the absolute time reference. The method of synchronizing the interface clock with the host clock is described with reference to the flow charts in FIGS. 9A and 9B with regard to the host computer and the interface computer, respectively. Generally, the host computer periodically requests the value of the interface clock counter from the interface computer and uses this value to correlate the counter to the host clock. [0085] Referring to FIGS. 9A an 9B, if the host computer has received a set of packets from the interface computer (step 902), the host computer proceeds to request the counter value (step 906) from the interface computer by sending a “get counter” message to the interface computer. In an exemplary embodiment, the interface computer stores a set of packets in a memory of the host computer by a direct memory access (DMA) operation and then interrupts the host computer to indicate the transfer of packets. If the host computer has not received a set of packets, the host computer waits for packets for a timeout period (step 904), after which it requests the counter value (step 906). The host computer records the host clock's time (step 906) when it requests the interface counter value. [0086] When the interface computer receives a “get counter” message (step 920) from the host computer, the interface computer then determines (step 922) whether it is currently idle or whether it is receiving data from the communication line. If not idle, the interface computer sends (step 924) a “try again” message to the host computer. If idle, the interface computer then reads the counter value and subtracts a precomputed interrupt service time (step 926) to generate an adjusted counter value. The interface computer then sends (step 928) the adjusted counter value to the host computer. [0087] The precomputed interrupt service time corresponds to the duration of time between when the interface computer receives the counter request from the host to when the interface computer provides the host computer with the adjusted counter value. The precomputed interrupt service time may be determined experimentally using a logic analyzer, for example to measure the duration of time between when the interface receives the request for the counter until the interface provides the counter value. To match the experimental delay measurements to the delay during normal operation, the experimental request is provided to the interface when the interface is known to be idle and the interface only services a request during normal operation when idle. As known to those skilled in the art, the response time of the interface computer may be taken repeatedly to generate an average service time for use during operation. [0088] Upon receipt of the counter value, the host computer computes (step 912) an estimate of the relative frequency of the interface clock counter to the host computer clock. The relative frequency may be used to correlating counter values associated with packets received from the interface computer until the next execution of the synchronization routine. In an exemplary embodiment, the host computer subtracts a host interrupt service time from the time recorded in step 906 before computing the relative frequency to account for the delay between the time when the host receives the count from the interface to the time when the host computes the relative frequency. [0089] In an exemplary embodiment, a multiple network interfaces each coupled to a respective communication line are implemented as a single unit and share a common clock. Thus, synchronization with only the common clock synchronizes the host clock with the time stamps associated with data received from any of the respective communication lines. [0090] FIGS. 10-28 are exemplary screen displays illustrating a graphical user interface (GUI) for displaying data collected and analyzed by a network monitor and for controlling data analysis by a network monitor according to the present invention. The display in FIG. 10 includes a tables frame 1010, a second frame 1030, and a buttons frame 1050. The tables frame 1010 includes a first portion 1011 with selectable boxes for user selection and text input boxes and a second portion 1012 with tables of statistics corresponding to received data. The tables 1023 which appear below the selectable buttons, boxes and fields include entries corresponding to the particular data being analyzed. The plots frame 1030 includes plots 1032, 1034 illustrating statistics corresponding to received data. The buttons frame 1050 includes a set of user-configurable buttons. [0091] The text input boxes and the selectable boxes in the first portion 1011 of the tables frame 1010 may optionally be fixed to prevent user selection of the options and prevent user entry in the text boxes. The functions associated with the options and boxes displayed in FIG. 10 are described below: [0092] 1. Start: The start field 101 specifies the beginning time from which the traffic is analyzed and its results are displayed in the GUI. [0093] 2. Stop: The Stop field 1014 specifies the ending time to which the traffic is analyzed and its results are displayed in the GUI. Thus the Start/Stop fields 1013, 1014 specify the time between which the traffic has been analyzed and presented to the user via the GUI. The contents of the Start and Stop fields 1013, 1014 may be displayed in multiple formats. For example, the contents are shown in a date format in FIG. 10. Alternatively, the contents may be displayed as +/− hours to indicate that a time relative to the current time, the term “now” may be used to represent the current time, or the term “never” may be used to represent that the data should be continuously updated. [0094] 3. Window: The Window field 1015 indicates the time intervals at which to compute values to be plotted in the second frame 1030. For example, if a user enters “1” as the Window field, then the values in the plot field are plotted every second. The user may enter the values in the Window field in using units as appropriate to indicate the resolution of the plots (e.g. 1 s, 1 ms, 100 us, . . . to indicate a time resolution if the unit of the horizontal scale is time). An empty Window field 1015 indicates that the resolution on the horizontal scale should be automatically set. [0095] 4. Top N: The Top N field 1016 specifies the maximum number of entries for the tables 1023 which appear in the second portion 1012 of the tables frame 1010. If Top N is 10, then the table 1023 will include 10 rows sorted by a particular column value in descending order. If Top N is −10, then the table 1023 will include 10 rows sorted by a particular column value in ascending order (i.e. this becomes the notion of BottomN). [0096] 5. Filter: The Filter window 1017 describes a filter to be applied to the data to be displayed. For example, Filter could be “protocol IEEE802.3” to display results for packets with link layer protocol IEEE802.3. For data previously filtered to show only IP traffic, a Filter of “host 10.0.0.1” would display results for IP traffic where either the source or destination host was 10.0.0.1. Various complex filters are also possible. [0097] 6. Do DNS: The Do DNS checkbox 1018 converts entries in the tables 1023 from a numerical representation to a textual representation. For example, in IP a numerical representation (the IP address) is used to identify a host. A DNS (Domain Name Server) may contain a mapping from this numerical representation of the IP address to a textual representation. For example, the IP address 10.0.0.1 may be converted to the textual representation foo.niksun.com when the Do DNS checkbox is checked. For protocols other than DNS the label given to the checkbox will vary accordingly with an equivalent functionality. [0098] 7. Help: The help buttons 1019 next to each field when selected cause display of context-sensitive assistance. For example, if the help button next to Filter 1017 is selected, a help window for Filters would pop up. [0099] 8. Refresh: The Refresh button 1020 refreshes the contents of all frames. [0100] 9. Forward and Backward Buttons: The forward 1021 and backward 1022 buttons at the top of first portion 1011 of the tables frame 1010 function similar to the “Forward” and “Back” buttons of a browser with the added feature of keeping the contents of all frames aligned. In contrast, clicking the “Forward” and “Back” buttons of a browser causes forward of backward movements on a frame by frame basis hence loosing correspondence between the various frames. [0101] The plots frame 1030 includes plots 1032, 1034 , text input boxes and selectable boxes and buttons. The text input boxes and the selectable boxes may optionally be fixed to prevent user selection of the options and prevent user entry in the text boxes. The functions associated with the options and boxes displayed in the plots frame 1030 of FIG. 10 are described below: [0102] 1. Update Tables and Plots: This button 1036 updates the tables and frames in a coordinated manner. For example, if a user zooms in by selecting a portion of the plot with a mouse, then clicking this button 1036 would update the plots and tables for the selected time range that was zoomed into. [0103] 2. Byte/Packet Counts (and Bit/Packet Rates) (and Utilization): This button 1037 changes between one of three options upon selection: “Byte/Packet Counts”, “Bit/Packet Rates”, and “Utilization”. The plots also change from Byte/Packet Counts over a certain window, to Bit and Packet Rates (i.e. number of bits or packets per second), to Utilization accordingly. In an exemplary embodiment, the byte plot displays normalized values relative to the link speed (i.e. bit rate divided by link or channel or virtual circuit capacity in bits per second). [0104] 3. Toggle Parent Plot: This button 1038 toggles the line on the plots as described below. [0105] 4. Toggle Plot of Average: Selection of the Toggle Plot of Average button 1039 toggles whether the average value (not shown) of the y-axis of the plots is displayed. [0106] 5. Play/Forward/Stop/Fast Forward/Rewind/Fast Rewind/Pause Buttons: These buttons 1040 control the playing of the plots on the screen to allow the plots to be updated over time and to scroll with time. The tables 1023 in the table frame 1010 are be updated to match the plots 1032, 1034. [0107] 6. Top Plot: The top plot 1032 shown in FIG. 10 is a Link Level Bit Rate plot in bytes/second. [0108] 7. Bottom Plot: The bottom plot 1034 in FIG. 10 is a Link Level Packet Rate blot in packets/second. [0109] The table 1023 in the tables frame 1010 is automatically generated based upon protocols found to be active in the interval specified by the Start 1013 and Stop 1014 fields. In FIG. 10, the table 1023 shows that between the Start and Stop times, 264K (K=1000's) IP packets and 919 ARP packets were received by the network monitor. The IP packets and ARP packets containing 99 M and 55K bytes, respectively (M=1,000,000). [0110] The entries in the table 1023 are selectable to sort data by the selected field. For example, if the packets heading in the table was clicked then the table would be sorted by the packets column in descending order of activity and if this header is clicked again, then it would be sorted in the opposite order. Selection of the other table headings similarly sorts the entries. [0111] [0111]FIG. 11 illustrates the zooming capability of the present invention. The start/stop time interval of 7:18/12:02 in FIG. 10 is narrowed to the 9:00/10:00 time interval in FIG. 11. The table 1023 and plots 1032, 1034 have been updated accordingly. The start 1013 and stop 1014 field values may be adjusted by either manual entry in the fields 1013, 1014 themselves, or by graphical selection, by a mouse for example, of an interval of time in the plots 1032, 1034. Upon selection, the display will zoom into the selected interval. Zooming in on the plots causes the plots to be regenerated for the interval selected by the user. Selection of the “Update Tables and Plots” button 1036 will then synchronize data in the tables frame 1010 to the plots 1032, 1034. The plots could also be updated automatically, if the user selected the “auto-synch” feature (not shown). The “Update Tables and Plots” button 1036 allows a user to zoom in several times to a desired time interval without updating the data. This provides the advantage of reducing unnecessary processing by the network monitor until the final interval is chosen. [0112] The protocols listed as entries in the table 1023 in FIG. 10 are selectable by a user, as hyper-links, for example, to list protocols encapsulated within the selected protocol. Clicking or selecting the IP entry in table 1023 in FIG. 10 results in the display of FIG. 12. The selection causes the plots 1032, 1034 in the plots frame 1030 of FIG. 10 to automatically update to show only IP traffic in plots 1232, 1243 in FIG. 12. [0113] The plots illustrate all traffic from the link layer as a line chart 1235 and all IP traffic as a bar chart. This dual-display format provides a graphical representation of the perspective between all traffic of one level (IP in this case) compared to all traffic of a previous level (Ethernet in this case). [0114] The contents of the tables in the tables frame 1210 are also updated to correspond to IP traffic. Table 1223 lists all IP protocols which were in use on the link being monitored between the “Start” and “Stop” times. In this particular case, only TCP, UDP and ICMP IP protocols were found. Activity by IP hosts may also be displayed. By scrolling down the table frame 1210, the table of IP counts by source host is seen as illustrated in FIG. 13 for the case where TopN=2. [0115] In FIG. 13, traffic is displayed in a source host table 1302 for traffic generated by hosts, in a destination host table 1304 for traffic received by a host, and in a host table 1306 for traffic generated and received by a host. Clicking on a link 1308 in the tables frame 1310 will generate a display of a “host-pairs” table 1402 shown in FIG. 14. [0116] The host-pairs table 1402 lists the total number of packets and bytes sent between pairs of hosts for each identified pair. [0117] Selection of a “destination host” such as 10.0.0.47 (1404 in FIG. 14) will further filter the traffic by the selected “destination host” to show only traffic destined for host 10.0.0.47. This is illustrated in FIG. 15 where table 1502 shows traffic destined to 10.0.0.47, all from host 128.32.130.10 in this case for traffic monitored between the start and stop interval. [0118] Thus, we see that only host 128.32.130.10 was sending traffic to 10.0.0.47 between the “Start” and “Stop” times. Note that the plots 1532, 1534 in the plots frame 1530 now show this activity between these two hosts as a bar chart 1535 and all IP traffic as a line chart 1536. Colors may also be used to distinguish the data in the plots or tables. [0119] If the TCP entry in table 1223 in FIG. 12 is selected, we move up the protocol stack and the tables frame 1610 is updated as shown in FIG. 16 to include TCP level counts for each underlying application 1612. For example, there were 27K HTTP (web) packets which contained 21 MegaBytes which were received during the designated time interval. [0120] In FIG. 16, if the “TCP flows” button 1604 is selected, all TCP flows are displayed with their time durations and performance metrics as shown in FIG. 17. A TCP flow contains a set of packets belonging to one TCP session between two hosts. Each flow may be plotted or its corresponding packets viewed by selecting the “plot” button 1702 or the “pkts” button 1704, respectively, corresponding to the desired TCP flow. Note that if the Do DNS option had been selected, all TCP host IP addresses would be replaced by their respective names (e.g. foo.niksun.com). A user may aggregate flows by clicking on other links such as the ones that identify a particular host such as 10.0.0.47. If a user clicks on 10.0.0.47 (1706), aggregated flows for host 10.0.0.47 will be displayed as shown in FIG. 18. [0121] [0121]FIG. 18 shows all TCP flows originating from host 10.0.0.47. The display in FIG. 18 is generated by applying a filter selective to the 10.0.0.47 host to the data displayed in FIG. 17. Further filters can similarly be applied by clicking on other hosts (hyperlinks) in FIG. 18. For example, in the “Term host” column, if a user selects host 10.0.0.5 (1802), then all TCP flows between host 10.0.0.47 (as source) and host 10.0.0.5 (as destination) are displayed. [0122] A “TCP performance” selection may be provided, in the screen display of FIG. 16, for example, for generating TCP performance tables. By clicking on the “TCP performance” hyperlink, performance tables 1902 for TCP are displayed as shown in FIG. 19. The whole tables frame is displayed in FIG. 19 or clarity. The display includes a “Troubled TCP Clients” table and a “Troubled TCP Servers” table for the worst two performing TCP clients and servers (TopN field value of 2). Over the time interval specified by the Start and Stop fields, the tables show the following measurements for each TCP client or server: [0123] 1. No. of Connections: This is the total number of TCP connections to the client or server. [0124] 2. TCP Data Bytes: This shows the total number of data bytes carried by all the TCP connections. [0125] 3. TCP goodput (Bytes/sec): This shows the TCP payload throughput (application throughput) or TCP goodput. That is, the total number of application bytes divided by time it takes to send these bytes averaged over the number of connections. [0126] 4. TCP throughput (Bytes/sec): This shows the total number of bytes carried in the TCP connections divided by time (TCP flow rate). [0127] 5. Avg RTT: This shows the average Round Trip Time between the client and server over the number of connections. [0128] 6. Avg Response: This shows the average response time from the server to the client. [0129] 7. Retransmit %: This shows the percentage of TCP bytes which were retransmitted (due to congestion, loss, or delay, or any other reason). [0130] The TCP performance tables may be customized to add other metrics or delete existing metrics via the user interface. [0131] Selecting the http hyperlink in FIG. 16 results in the display of statistics for web traffic (http) as shown in FIG. 20. [0132] An “http performance” selection may be provided, in the screen display of FIG. 20, for example, for generating http performance tables. By clicking on the “http performance” hyperlink, performance tables 2102 for http are displayed as shown in FIG. 21. The whole tables frame is displayed in FIG. 21 for clarity. The display includes a “Troubled WWW Clients” table and a “Troubled WWW Servers” table for the worst two performing WWW clients and servers (TopN field value of 2). [0133] The metrics in the http performance tables 2102 may be generated online and displayed to the user as troubled www clients and www servers or may be fed directly to a network management system for immediate action. These metrics can help a network administrator to identify bad servers and connections. This information may also be used to as the basis to notify the web server operator to buy more bandwidth or to fix his server. Further, it can be used to notify clients that they may need more bandwidth or they may need to choose another service provider. Accordingly, these metrics may be used to improve the quality of service given to users and ultimately may provide further revenue to the network administrator. For example, in the table “Troubled WWW Servers”, the second server listed (204.162.96.10) had about 33% web aborts. This could indicate a potential loss of 33% of the customers from this web site. [0134] The tables frame 1610 is updated as shown in FIG. 16 to include TCP level counts for each underlying application 1612. For example, there were 27K HTTP (web) packets which contained 21 MegaBytes which were received during the designated time interval. [0135] Upon selection of the UDP hyperlink 1240 in FIG. 12, we move up the protocol stack and the display of FIG. 22 is provided to illustrate levels of UDP traffic. In the tables frame 2210, a “UDP Level Counts” tables is displayed showing activity for each UDP application or UDP port. For example, the display indicated that there were 453 domain packets which contained 69 KiloBytes. [0136] Note that UDP bandwidth usage was only about 0.32% of the total IP (see table 1223 in FIG. 12). Thus, the plots frame shows only IP traffic (RED graph) which dwarfs the UDP traffic (in BLUE). By clicking on the “Toggle Parent Display” the user can now zoom the Y-axis only on the UDP traffic (this is not illustrated) as the plot for IP (parent plot) will be removed. [0137] Selection of the “MBONE” button 2202 in FIG. 22 results in display of an application layer analysis of MBONE (Multimedia backbone) sessions as shown in FIG. 23. [0138] Selection of the “View Packets” button 2204 in the buttons frame 2250 in FIG. 22 gives a dump of all packets as shown in FIG. 24. Since the network monitor can record all packets, all packets and their contents can be viewed. The links in the display of FIG. 24 allow a user to flexibly filter the data streams. If the user clicks on 10.0.0.12 (2402), then the next screen of dumps will only contain packets to and from 10.0.0.12. In that next screen, if a user selected 10.0.0.5, then the updated display would show only packets between 10.0.0.12 and 10.0.0.5. A user could also further qualify the dump by selecting ports. Various options for dumping packets can be applied by selecting a type of dump from the selections 2404 at the top of the screen display. [0139] Selection of the “Recommend” button 2206 in the buttons frame 2250 of FIG. 22 results in the display of real-time capacity or bandwidth recommendations for the network. Upon detection of selection of the “Recommended” button 2206, the network monitor uses a mathematical model to interpret the data being viewed by the user to provide recommendations on bandwidth usage by an application (or other types of traffic) or on setting of link/switch capacity to obtain a specific quality of service. Several such statistics 2502 are shown in FIG. 25. A user may enter desired quality of service values such as loss rates and maximum delays to obtain recommendations on the capacity required to support the desired quality of service for the type of traffic analyzed. FIGS. 25 and 26 illustrate the recommendations which can be provided. [0140] In an exemplary embodiment, the user may select a particular application and a “busy-period” for which she wants to “size” the network resources for a particular quality of service level. Appropriate subroutines in the network monitor then analyze the particular application traffic and extract or estimate “model parameters”. Using the mathematical model, and estimates of the parameters, as well as parameters of quality of service (such as packet loss rates, network delays, frame rates, etc.) the model computes statistics such as statistical multiplexing gains, capacity requirements, and buffer allocations and provides the user with optimal recommendations of switch/router configurations, network resources, or server parameters to maximize network utilization while meeting the quality of service requirements. Such recommendations can be computed on a real-time basis where the statistic is updated for every packet or a set of packets belonging to different services and feedback can be provided to network elements along the path for each flow on optimal configurations to enable dynamic resource allocation to meet service quality requirements. [0141] The x-axis 2602 of the graph represents the number of users and the y-axis 2604 represents capacity in bits/second. For a desired number of users, the capacity can be read off the chart or from a display of corresponding tabular results. FIG. 27 illustrates a display similar to that in FIG. 22 for the case where the Do DNS button was selected so the IP addresses are resolved to their registered names. [0142] [0142]FIG. 28 is a display showing statistics that are displayed upon selection of the “Statistics” button 2208 in the buttons frame 2250 in FIG. 22. Upon selection of the “statistics” button 2208, the network monitor computes various statistics based on data currently being viewed by the user. Exemplary statistics include packet size distributions, protocol distributions, bandwidth usage per client, bandwidth usage by domain, average response time per server, average round-trip time between server-client pair, and performance metrics. [0143] The present invention is not limited to a particular division of functions between the host computer and the interface computer. The functions of the host computer and the interface computer may be performed by a single computer. Interface with a network monitor according to the present invention is not limited to the user interface and may be via the network being monitored or another communication line. [0144] Although illustrated and described above with reference to certain specific embodiments, the present invention is nevertheless not intended to be limited to the details shown. Rather, various modifications may be made in the details within the scope and range of equivalents of the claims and without departing from the spirit of the invention. Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS5521907 *Apr 25, 1995May 28, 1996Visual Networks, Inc.Method and apparatus for non-intrusive measurement of round trip delay in communications networksUS5615323 *Mar 12, 1996Mar 25, 1997Concord Communications, Inc.Displaying resource performance and utilization informationUS5787253 *May 28, 1996Jul 28, 1998The Ag GroupApparatus and method of analyzing internet activityUS5790605 *Jul 28, 1995Aug 4, 1998Motorola, Inc.Method for determining voting windows in a diversity repeaterUS5812528 *Nov 17, 1995Sep 22, 1998Telecommunications Techniques CorporationMeasuring round trip time in ATM network virtual connectionsUS5864536 *Aug 28, 1996Jan 26, 1999Siemens AktiengesellschaftMethod and apparatus for adapting a transmission bit rate of a data multiplexer operating according to an asynchronous transfer modeUS5905736 *Apr 22, 1996May 18, 1999At&T CorpMethod for the billing of transactions over the internetUS5991881 *Nov 8, 1996Nov 23, 1999Harris CorporationNetwork surveillance systemUS6006264 *Mar 30, 1998Dec 21, 1999Arrowpoint Communications, Inc.Method and system for directing a flow between a client and a serverUS6085243 *Dec 13, 1996Jul 4, 20003Com CorporationDistributed remote management (dRMON) for networks* Cited by examinerReferenced byCiting PatentFiling datePublication dateApplicantTitleUS6604139 *Dec 14, 2001Aug 5, 2003Networks Associates Technology, Inc.Voice protocol filtering system and methodUS6804197 *Oct 24, 2000Oct 12, 2004Agilent Technologies, Inc.Clock switching for a synchronous memory in network probe circuitryUS6950405 *Jul 16, 2001Sep 27, 2005Agilent Technologies, Inc.Traffic stream generator having a non-consecutive addressing mechanismUS7197559 *Oct 19, 2001Mar 27, 2007Mercury Interactive CorporationTransaction breakdown feature to facilitate analysis of end user performance of a server systemUS7222190 *Dec 7, 2001May 22, 2007Internap Network Services CorporationSystem and method to provide routing control of information over data networksUS7249178 *Mar 28, 2003Jul 24, 2007International Business Machines CorporationNon-intrusive recursive dispatching of nested service collections for aggregating web servicesUS7260627 *Aug 16, 2002Aug 21, 2007Infrastructure Innovations, LlcReal time mesh measurement system stream latency and jitter measurementsUS7269157Apr 10, 2001Sep 11, 2007Internap Network Services CorporationSystem and method to assure network service levels with intelligent routingUS7356586 *Apr 14, 2003Apr 8, 2008Network General TechnologyFiltering system and method for voice protocol network analysisUS7359979Sep 30, 2002Apr 15, 2008Avaya Technology Corp.Packet prioritization and associated bandwidth and buffer management techniques for audio over IPUS7373403 *Aug 22, 2002May 13, 2008Agilent Technologies, Inc.Method and apparatus for displaying measurement data from heterogeneous measurement sourcesUS7383582 *Aug 2, 2002Jun 3, 2008Federal Network Systems, LlcSystems and methods for performing electronic surveillanceUS7436826 *Jul 25, 2001Oct 14, 2008Dell Products L.P.System and method for detecting and indicating communication protocolsUS7450568 *Dec 5, 2003Nov 11, 2008Cisco Technology, Inc.System and method for managing a VolP networkUS7454494 *Jan 7, 2003Nov 18, 2008Exfo Service Assurance Inc.Apparatus and method for actively analyzing a data packet delivery pathUS7457862 *Oct 22, 2001Nov 25, 2008Avaya, Inc.Real time control protocol session matchingUS7460837 *Sep 29, 2004Dec 2, 2008Cisco Technology, Inc.User interface and time-shifted presentation of data in a system that monitors activity in a shared radio frequency bandUS7461163 *Aug 2, 2007Dec 2, 2008Infrastructure Innovations LlcReal time mesh measurement system stream latency and jitter measurementsUS7489687May 31, 2002Feb 10, 2009Avaya. Inc.Emergency bandwidth allocation with an RSVP-like protocolUS7525994 *Jan 30, 2003Apr 28, 2009Avaya Inc.Packet data flow identification for multiplexingUS7545752 *Nov 23, 2005Jun 9, 2009Packeteer, Inc.Application service level mediation and method of using the sameUS7561517Oct 29, 2002Jul 14, 2009Internap Network Services CorporationPassive route control of data networksUS7570688 *Apr 30, 2007Aug 4, 2009Adc Dsl Systems, Inc.Non-chronological system statisticsUS7577736 *Oct 15, 2003Aug 18, 2009Nortel Networks LimitedNetwork accounting statistics collectionUS7584298Dec 12, 2003Sep 1, 2009Internap Network Services CorporationTopology aware route controlUS7603460 *Jan 31, 2005Oct 13, 2009Microsoft CorporationDetecting and diagnosing performance problems in a wireless network through neighbor collaborationUS7606160Oct 27, 2006Oct 20, 2009Internap Network Services CorporationSystem and method to provide routing control of information over networksUS7607093 *Apr 4, 2003Oct 20, 2009Agilent Technologies, Inc.Displaying network segment decode information in diagrammatic formUS7617337Feb 6, 2007Nov 10, 2009Avaya Inc.VoIP quality tradeoff systemUS7623527 *Jun 29, 2004Nov 24, 2009International Business Machines CorporationMethod for analyzing network trace, method for judging order among nodes, processor for analyzing network trace, computer-executable program for controlling computer as processor, and method for correcting time difference among nodes in networkUS7627669 *Apr 22, 2004Dec 1, 2009IxiaAutomated capturing and characterization of network traffic using feedbackUS7633942 *Oct 15, 2002Dec 15, 2009Avaya Inc.Network traffic generation and monitoring systems and methods for their use in testing frameworks for determining suitability of a network for target applicationsUS7660269 *Dec 22, 2005Feb 9, 2010International Business Machines CorporationApparatus, method, and program for creating network configuration informationUS7660793Nov 12, 2007Feb 9, 2010Exegy IncorporatedMethod and system for high performance integration, processing and searching of structured and unstructured data using coprocessorsUS7668966Nov 1, 2002Feb 23, 2010Internap Network Services CorporationData network controllerUS7676570Aug 30, 2006Mar 9, 2010Hanoch LevyDetermining client latencies over a networkUS7680790Oct 31, 2007Mar 16, 2010Washington UniversityMethod and apparatus for approximate matching of DNA sequencesUS7701863Dec 12, 2002Apr 20, 2010Alcatel LucentDecentralized SLS monitoring for throughput in a differentiated service environmentUS7702629Dec 2, 2005Apr 20, 2010Exegy IncorporatedMethod and device for high performance regular expression pattern matchingUS7711844Aug 15, 2002May 4, 2010Washington University Of St. LouisTCP-splitter: reliable packet monitoring methods and apparatus for high speed networksUS7716330Oct 19, 2001May 11, 2010Global Velocity, Inc.System and method for controlling transmission of data packets over an information networkUS7725934Dec 7, 2004May 25, 2010Cisco Technology, Inc.Network and application attack protection based on application layer message inspectionUS7730519Sep 17, 2004Jun 1, 2010At&T Intellectual Property I, L.P.Detection of encrypted packet streams using feedback probingUS7733806Sep 14, 2007Jun 8, 2010International Business Machines CorporationMethod and apparatus for non-invasive discovery of relationships between nodes in a networkUS7734637 *Oct 2, 2003Jun 8, 2010Borland Software CorporationMethod and system for automatic detection of monitoring data sourcesUS7747729 *Jun 14, 2002Jun 29, 2010Hanoch LevyDetermining client latencies over a networkUS7752307 *Jul 2, 2007Jul 6, 2010International Business Machines CorporationTechnique of analyzing an information system stateUS7761705 *Sep 17, 2004Jul 20, 2010At&T Intellectual Property I, L.P.Detection of encrypted packet streamsUS7765591 *May 5, 2005Jul 27, 2010Cisco Technology, Inc.Method and system for prioritizing security operations in a communication networkUS7779127 *Mar 9, 2007Aug 17, 2010Hewlett-Packard Development Company, L.P.System and method for determining a subset of transactions of a computing system for use in determing resource costsUS7797406Jul 27, 2006Sep 14, 2010Cisco Technology, Inc.Applying quality of service to application messages in network elements based on roles and statusUS7817636Mar 24, 2008Oct 19, 2010Cisco Technology, Inc.Obtaining information on forwarding decisions for a packet flowUS7827256Jun 21, 2006Nov 2, 2010Cisco Technology, Inc.Applying quality of service to application messages in network elementsUS7827272 *Nov 3, 2003Nov 2, 2010Riverbed Technology, Inc.Connection table for intrusion detectionUS7830812Jan 27, 2004Nov 9, 2010Actix LimitedMonitoring system for a mobile communication network for traffic analysis using a hierarchial approachUS7840482Jun 8, 2007Nov 23, 2010Exegy IncorporatedMethod and system for high speed options pricingUS7840664Aug 29, 2003Nov 23, 2010IxiaAutomated characterization of network trafficUS7840670Oct 28, 2008Nov 23, 2010Exfo Service Assurance, Inc.Apparatus and method for passively analyzing a data packet delivery pathUS7840700Jun 21, 2006Nov 23, 2010Cisco Technology, Inc.Dynamically adding application logic and protocol adapters to a programmable network elementUS7864688 *Dec 21, 2007Jan 4, 2011Sony CorporationCommunication system, method of providing information therein and communication deviceUS7877500Feb 7, 2008Jan 25, 2011Avaya Inc.Packet prioritization and associated bandwidth and buffer management techniques for audio over IPUS7877501Feb 7, 2008Jan 25, 2011Avaya Inc.Packet prioritization and associated bandwidth and buffer management techniques for audio over IPUS7894478 *Jun 6, 2008Feb 22, 2011International Business Machines CorporationMethod and system for network management providing access to application bandwidth usage calculationsUS7894488 *Apr 13, 2006Feb 22, 2011Cisco Technology, Inc.Apparatus and method for monitoring quality metrics associated with a wireless networkUS7895356 *Dec 31, 2003Feb 22, 2011Nec Infrontia CorporationIP router, communication system and band setting method used therein and its programUS7904080Jun 26, 2007Mar 8, 2011Actix LimitedMobile communications network monitoring systemsUS7917299Feb 22, 2006Mar 29, 2011Washington UniversityMethod and apparatus for performing similarity searching on a data stream with respect to a query stringUS7921046Jun 19, 2007Apr 5, 2011Exegy IncorporatedHigh speed processing of financial information using FPGA devicesUS7937470 *Dec 21, 2000May 3, 2011Oracle International Corp.Methods of determining communications protocol latencyUS7945528Feb 10, 2010May 17, 2011Exegy IncorporatedMethod and device for high performance regular expression pattern matchingUS7949650Oct 31, 2007May 24, 2011Washington UniversityAssociative database scanning and information retrievalUS7953743Oct 31, 2007May 31, 2011Washington UniversityAssociative database scanning and information retrievalUS7954114Jan 26, 2006May 31, 2011Exegy IncorporatedFirmware socket module for FPGA-based pipeline processingUS7962582 *Jun 21, 2006Jun 14, 2011Cisco Technology, Inc.Enforcing network service level agreements in a network elementUS7978827Jun 30, 2004Jul 12, 2011Avaya Inc.Automatic configuration of call handling based on end-user needs and characteristicsUS7987272Dec 6, 2004Jul 26, 2011Cisco Technology, Inc.Performing message payload processing functions in a network element on behalf of an applicationUS7991827 *Nov 13, 2002Aug 2, 2011Mcafee, Inc.Network analysis system and method utilizing collected metadataUS7996556Mar 24, 2005Aug 9, 2011Cisco Technology, Inc.Method and apparatus for generating a network topology representation based on inspection of application messages at a network deviceUS8015309Feb 7, 2008Sep 6, 2011Avaya Inc.Packet prioritization and associated bandwidth and buffer management techniques for audio over IPUS8024795May 9, 2003Sep 20, 2011Q1 Labs, Inc.Network intelligence systemUS8041806 *Sep 11, 2006Oct 18, 2011Alcatel LucentTargeted electronic content delivery control systems and methodsUS8055612 *Apr 30, 2008Nov 8, 2011Hyperformix, Inc.System and method for aligning data frames in timeUS8060623Apr 11, 2005Nov 15, 2011Cisco Technology, Inc.Automated configuration of network device portsUS8069102Nov 20, 2006Nov 29, 2011Washington UniversityMethod and apparatus for processing financial information at hardware speeds using FPGA devicesUS8072901 *Sep 29, 2005Dec 6, 2011Cisco Technology, Inc.Technique for efficient probing to verify policy conformanceUS8082304Dec 10, 2004Dec 20, 2011Cisco Technology, Inc.Guaranteed delivery of application layer messages by a network elementUS8090839Jun 21, 2006Jan 3, 2012Cisco Technology, Inc.XML message validation in a network infrastructure elementUS8095507 *Aug 8, 2008Jan 10, 2012Oracle International CorporationAutomated topology-based statistics monitoring and performance analysisUS8095508May 21, 2004Jan 10, 2012Washington UniversityIntelligent data storage and processing using FPGA devicesUS8131697Oct 31, 2007Mar 6, 2012Washington UniversityMethod and apparatus for approximate matching where programmable logic is used to process data being written to a mass storage medium and process data being read from a mass storage mediumUS8144713Oct 5, 2007Mar 27, 2012British Telecommunications Public Limited CompanyTelecommunications systemUS8156101Dec 17, 2009Apr 10, 2012Exegy IncorporatedMethod and system for high performance integration, processing and searching of structured and unstructured data using coprocessorsUS8176154Sep 30, 2002May 8, 2012Avaya Inc.Instantaneous user initiation voice quality feedbackUS8180881 *Nov 13, 2003May 15, 2012Kt CorporationApparatus for analyzing the packet data on mobile communication network and method thereofUS8189490 *Jul 28, 2004May 29, 2012Rohde & Schwarz Gmbh & Co. KgMessage analyzer and analysis methodUS8213323 *Dec 18, 2003Jul 3, 2012Sprint Communications Company L.P.System and method for network performance monitoringUS8218751Sep 29, 2008Jul 10, 2012Avaya Inc.Method and apparatus for identifying and eliminating the source of background noise in multi-party teleconferencesUS8239923Jun 12, 2006Aug 7, 2012Cisco Technology, Inc.Controlling computer program extensions in a network deviceUS8244900Sep 17, 2009Aug 14, 2012Fujitsu LimitedMeasuring method, measuring apparatus and computer programUS8266327Jun 15, 2006Sep 11, 2012Cisco Technology, Inc.Identity brokering in a network elementUS8300545Jun 8, 2009Oct 30, 2012Packeteer, Inc.Application service level mediation and method of using sameUS8312148May 3, 2011Nov 13, 2012Cisco Technology, Inc.Performing message payload processing functions in a network element on behalf of an applicationUS8326819Nov 12, 2007Dec 4, 2012Exegy IncorporatedMethod and system for high performance data metatagging and data indexing using coprocessorsUS8326970Nov 5, 2007Dec 4, 2012Hewlett-Packard Development Company, L.P.System and method for modeling a session-based system with a transaction-based analytic modelUS8332938Sep 17, 2004Dec 11, 2012At&T Intellectual Property I, L.P.Detection of encrypted packet streams using a timerUS8335818 *Jun 2, 2006Dec 18, 2012Thomson LicensingMethod for detection of the activity of a device in a network of distributed stations, as well as a network station for carrying out the methodUS8370470Jan 19, 2001Feb 5, 2013Web.Com Holding Company, Inc.System and method for managing server configurationsUS8370515Mar 26, 2010Feb 5, 2013Avaya Inc.Packet prioritization and associated bandwidth and buffer management techniques for audio over IPUS8374986May 15, 2008Feb 12, 2013Exegy IncorporatedMethod and system for accelerated stream processingUS8379534May 13, 2010Feb 19, 2013At&T Intellectual Property I, L.P.Detection of encrypted packet streams using feedback probingUS8379841Mar 22, 2007Feb 19, 2013Exegy IncorporatedMethod and system for high throughput blockwise independent encryption/decryptionUS8407122Mar 31, 2011Mar 26, 2013Exegy IncorporatedHigh speed processing of financial information using FPGA devicesUS8458081Mar 31, 2011Jun 4, 2013Exegy IncorporatedHigh speed processing of financial information using FPGA devicesUS8458467Apr 5, 2006Jun 4, 2013Cisco Technology, Inc.Method and apparatus for adaptive application message payload content transformation in a network infrastructure elementUS8478680Mar 31, 2011Jul 2, 2013Exegy IncorporatedHigh speed processing of financial information using FPGA devicesUS8489720 *Mar 31, 2004Jul 16, 2013Blue Coat Systems, Inc.Cost-aware, bandwidth management systems adaptive to network conditionsUS8504522Jan 9, 2012Aug 6, 2013Oracle International CorporationAutomated topology-based statistics monitoring and performance analysisUS8515682Mar 11, 2011Aug 20, 2013Washington UniversityMethod and apparatus for performing similarity searchingUS8521684 *Sep 2, 2011Aug 27, 2013Ca, Inc.System and method for aligning data frames in timeUS8543681Oct 15, 2002Sep 24, 2013Volli Polymer Gmbh LlcNetwork topology discovery systems and methodsUS8549024Mar 2, 2012Oct 1, 2013Ip Reservoir, LlcMethod and apparatus for adjustable data matchingUS8549171Mar 24, 2005Oct 1, 2013Cisco Technology, Inc.Method and apparatus for high-speed processing of structured application messages in a network deviceUS8559327Dec 17, 2010Oct 15, 2013Cisco Technology, Inc.Apparatus and method for monitoring quality metrics associated with a wireless networkUS8578016 *Jan 8, 2004Nov 5, 2013International Business Machines CorporationNon-invasive discovery of relationships between nodes in a networkUS8593959Feb 7, 2007Nov 26, 2013Avaya Inc.VoIP endpoint call admissionUS8595104Mar 31, 2011Nov 26, 2013Ip Reservoir, LlcHigh speed processing of financial information using FPGA devicesUS8600856Mar 31, 2011Dec 3, 2013Ip Reservoir, LlcHigh speed processing of financial information using FPGA devicesUS8601143Sep 27, 2011Dec 3, 2013Cisco Technology, Inc.Automated configuration of network device portsUS8620881Jun 21, 2011Dec 31, 2013Ip Reservoir, LlcIntelligent data storage and processing using FPGA devicesUS8626624Mar 31, 2011Jan 7, 2014Ip Reservoir, LlcHigh speed processing of financial information using FPGA devicesUS8631124Jun 27, 2011Jan 14, 2014Mcafee, Inc.Network analysis system and method utilizing collected metadataUS8645686Aug 8, 2012Feb 4, 2014At&T Intellectual Property I, L.P.Detection of encrypted packet streams using a timerUS8655764Mar 31, 2011Feb 18, 2014Ip Reservoir, LlcHigh speed processing of financial information using FPGA devicesUS8670313Dec 13, 2012Mar 11, 2014Centurylink Intellectual Property LlcSystem and method for adjusting the window size of a TCP packet through network elementsUS8687614Dec 7, 2010Apr 1, 2014Centurylink Intellectual Property LlcSystem and method for adjusting radio frequency parametersUS8694626 *Oct 28, 2010Apr 8, 2014IxiaAutomated characterization of network trafficUS8717911May 31, 2007May 6, 2014Centurylink Intellectual Property LlcSystem and method for collecting network performance informationUS8737606Feb 5, 2013May 27, 2014Ip Reservoir, LlcMethod and system for high throughput blockwise independent encryption/decryptionUS8738804Jan 8, 2004May 27, 2014International Business Machines CorporationSupporting transactions in a data network using router informationUS8743700May 30, 2012Jun 3, 2014Centurylink Intellectual Property LlcSystem and method for provisioning resources of a packet network based on collected network performance informationUS8743703May 31, 2007Jun 3, 2014Centurylink Intellectual Property LlcSystem and method for tracking application resource usageUS8750158 *Aug 9, 2012Jun 10, 2014Centurylink Intellectual Property LlcSystem and method for differentiated billingUS8751452Jan 6, 2012Jun 10, 2014Ip Reservoir, LlcIntelligent data storage and processing using FPGA devicesUS8762249Jun 7, 2011Jun 24, 2014Ip Reservoir, LlcMethod and apparatus for high-speed processing of financial market depth dataUS8768805Jun 7, 2011Jul 1, 2014Ip Reservoir, LlcMethod and apparatus for high-speed processing of financial market depth dataUS8768888Jan 6, 2012Jul 1, 2014Ip Reservoir, LlcIntelligent data storage and processing using FPGA devicesUS8774011 *Jun 11, 2010Jul 8, 2014Zte CorporationSystem, apparatus and method for making statistics on point to point protocol negotiation state in wireless systemUS8799403Dec 15, 2009Aug 5, 2014Cisco Technology, Inc.Caching content and state data at a network elementUS8799416Oct 31, 2007Aug 5, 2014Web.Com Holding Company, Inc.System and method for managing server configurationsUS8811160Jan 22, 2013Aug 19, 2014Centurylink Intellectual Property LlcSystem and method for routing data on a packet networkUS8819107 *Apr 20, 2011Aug 26, 2014Fujitsu LimitedRelay apparatus, recording medium storing a relay program, and a relay methodUS8843408Oct 26, 2010Sep 23, 2014Ip Reservoir, LlcMethod and system for high speed options pricingUS8843598Dec 27, 2007Sep 23, 2014Cisco Technology, Inc.Network based device for providing RFID middleware functionalityUS8868715Oct 15, 2002Oct 21, 2014Volli Polymer Gmbh LlcReport generation and visualization systems and methods and their use in testing frameworks for determining suitability of a network for target applicationsUS8868906Nov 19, 2012Oct 21, 2014At&T Intellectual Property I, L.P.Signature specification for encrypted packet streamsUS8879391Sep 30, 2011Nov 4, 2014Centurylink Intellectual Property LlcSystem and method for using network derivations to determine path statesUS8879727Aug 29, 2008Nov 4, 2014Ip Reservoir, LlcMethod and apparatus for hardware-accelerated encryption/decryptionUS8880501Apr 9, 2012Nov 4, 2014Ip Reservoir, LlcMethod and system for high performance integration, processing and searching of structured and unstructured data using coprocessorsUS8898339 *Sep 12, 2004Nov 25, 2014Napatech A/SMethod of transferring data implying a network analyser cardUS8898582 *Mar 9, 2011Nov 25, 2014Salesforce.Com, Inc.Configurable highlights panel for display of database recordsUS8976665Jul 1, 2013Mar 10, 2015Centurylink Intellectual Property LlcSystem and method for re-routing callsUS8983063May 16, 2014Mar 17, 2015Ip Reservoir, LlcMethod and system for high throughput blockwise independent encryption/decryptionUS9014204Nov 6, 2013Apr 21, 2015Centurylink Intellectual Property LlcSystem and method for managing network communicationsUS9020928Sep 27, 2013Apr 28, 2015Ip Reservoir, LlcMethod and apparatus for processing streaming data using programmable logicUS9030959Aug 29, 2013May 12, 2015Cisco Technology, Inc.Apparatus and method for monitoring quality metrics associated with a wireless networkUS9042370Nov 6, 2013May 26, 2015Centurylink Intellectual Property LlcSystem and method for establishing calls over a call path having best path metricsUS9054915Jul 16, 2013Jun 9, 2015Centurylink Intellectual Property LlcSystem and method for adjusting CODEC speed in a transmission path during call set-up due to reduced transmission performanceUS9054986Nov 8, 2013Jun 9, 2015Centurylink Intellectual Property LlcSystem and method for enabling communications over a number of packet networksUS9094257Aug 9, 2012Jul 28, 2015Centurylink Intellectual Property LlcSystem and method for selecting a content delivery networkUS9094261Aug 8, 2013Jul 28, 2015Centurylink Intellectual Property LlcSystem and method for establishing a call being received by a trunk on a packet networkUS9112734Aug 21, 2012Aug 18, 2015Centurylink Intellectual Property LlcSystem and method for generating a graphical user interface representative of network performanceUS9118583Jan 28, 2015Aug 25, 2015Centurylink Intellectual Property LlcSystem and method for re-routing callsUS9154634Oct 21, 2013Oct 6, 2015Centurylink Intellectual Property LlcSystem and method for managing network communicationsUS9167445Jan 30, 2013Oct 20, 2015Ascom Network Testing AbSystems and methods for measuring available bandwidth in mobile telecommunications networksUS9176775Jun 26, 2014Nov 3, 2015Ip Reservoir, LlcIntelligent data storage and processing using FPGA devicesUS9185578Jan 30, 2013Nov 10, 2015Ascom Network Testing AbSystems and methods for measuring available bandwidth in mobile telecommunications networksUS9185579Jan 30, 2013Nov 10, 2015Ascom Network Testing AbSystems and methods for measuring available bandwidth in mobile telecommunications networksUS9197518Jul 25, 2011Nov 24, 2015Nec CorporationQuality-deteriorated part analyzing system, quality-deteriorated part analyzing device, quality-deteriorated part analyzing method, and quality-deteriorated part analyzing programUS9225609Oct 9, 2012Dec 29, 2015Centurylink Intellectual Property LlcSystem and method for remotely controlling network operatorsUS9225646Aug 8, 2013Dec 29, 2015Centurylink Intellectual Property LlcSystem and method for improving network performance using a connection admission control engineUS9237082 *Mar 26, 2012Jan 12, 2016Hewlett Packard Enterprise Development LpPacket descriptor trace indicatorsUS9240906Aug 21, 2012Jan 19, 2016Centurylink Intellectual Property LlcSystem and method for monitoring and altering performance of a packet networkUS9241271Jan 25, 2013Jan 19, 2016Centurylink Intellectual Property LlcSystem and method for restricting access to network performance informationUS9241277Aug 8, 2013Jan 19, 2016Centurylink Intellectual Property LlcSystem and method for monitoring and optimizing network performance to a wireless deviceUS9246786Feb 18, 2013Jan 26, 2016At&T Intellectual Property I, L.P.Detection of encrypted packet streams using feedback probingUS9253661Oct 21, 2013Feb 2, 2016Centurylink Intellectual Property LlcSystem and method for modifying connectivity fault management packetsUS9323794Nov 27, 2012Apr 26, 2016Ip Reservoir, LlcMethod and system for high performance pattern indexingUS9363078Oct 9, 2014Jun 7, 2016Ip Reservoir, LlcMethod and apparatus for hardware-accelerated encryption/decryptionUS9380008Sep 30, 2013Jun 28, 2016Cisco Technology, Inc.Method and apparatus for high-speed processing of structured application messages in a network deviceUS9396222Nov 3, 2014Jul 19, 2016Ip Reservoir, LlcMethod and system for high performance integration, processing and searching of structured and unstructured data using coprocessorsUS9424268 *Aug 26, 2013Aug 23, 2016Ca, Inc.System and method for aligning data frames in timeUS9479341May 31, 2007Oct 25, 2016Centurylink Intellectual Property LlcSystem and method for initiating diagnostics on a packet network nodeUS20020015387 *Aug 1, 2001Feb 7, 2002Henry HouhVoice traffic packet capture and analysis tool for a data networkUS20020016937 *Aug 1, 2001Feb 7, 2002Henry HouhMethod and apparatus for utilizing a network processor as part of a test systemUS20020069272 *Jan 19, 2001Jun 6, 2002Kim Steven D.System and method for managing server configurationsUS20020120727 *Dec 21, 2000Aug 29, 2002Robert CurleyMethod and apparatus for providing measurement, and utilization of, network latency in transaction-based protocolsUS20020133364 *Mar 15, 2001Sep 19, 2002International Business Machines CorporationSystem and method for pricing agent for differentiated services computer networksUS20020133473 *Mar 15, 2001Sep 19, 2002International Business Machines CorporationSystem and method for on-demand pricing for differentiated services computer networksUS20020150117 *Jan 25, 2002Oct 17, 2002Hidekazu BabaData repeater equipment having bandwidth control function, and bandwidth managing apparatusUS20020198984 *Oct 19, 2001Dec 26, 2002Guy GoldsteinTransaction breakdown feature to facilitate analysis of end user performance of a server systemUS20030012141 *Jul 16, 2001Jan 16, 2003Gerrevink Dean VanTraffic stream generator having a non-consecutive addressing mechanismUS20030021272 *Jul 25, 2001Jan 30, 2003Onur CelebiogluSystem and method for detecting and indicating communication protocolsUS20030065769 *Aug 16, 2002Apr 3, 2003Kryskow Joseph M.Real time mesh measurement system stream latency and jitter measurementsUS20030086422 *Dec 28, 2001May 8, 2003Netvmg, Inc.System and method to provide routing control of information over networksUS20030086425 *Oct 15, 2002May 8, 2003Bearden Mark J.Network traffic generation and monitoring systems and methods for their use in testing frameworks for determining suitability of a network for target applicationsUS20030088529 *Nov 1, 2002May 8, 2003Netvmg, Inc.Data network controllerUS20030088671 *Dec 7, 2001May 8, 2003Netvmg, Inc.System and method to provide routing control of information over data networksUS20030091165 *Oct 15, 2002May 15, 2003Bearden Mark J.Report generation and visualization systems and methods and their use in testing frameworks for determining suitability of a network for target applicationsUS20030097438 *Oct 15, 2002May 22, 2003Bearden Mark J.Network topology discovery systems and methods and their use in testing frameworks for determining suitability of a network for target applicationsUS20030120789 *Oct 22, 2001Jun 26, 2003Neil HepworthReal time control protocol session matchingUS20030133443 *Oct 29, 2002Jul 17, 2003Netvmg, Inc.Passive route control of data networksUS20030163343 *Feb 27, 2002Aug 28, 2003International Business Machines CorporationMethod and system for dynamically modifying an electronic campaign based on network activityUS20030208614 *May 1, 2002Nov 6, 2003John WilkesSystem and method for enforcing system performance guaranteesUS20030223431 *May 31, 2002Dec 4, 2003Chavez David L.Emergency bandwidth allocation with an RSVP-like protocolUS20030233445 *Jun 14, 2002Dec 18, 2003Ramot University Authority AppliedDetermining client latencies over a networkUS20040037230 *Aug 22, 2002Feb 26, 2004Kroboth Robert H.Method and apparatus for displaying measurement data from heterogeneous measurement sourcesUS20040039806 *Dec 27, 2002Feb 26, 2004Miras BertrandMethods and systems for the synchronized recording and reading of data coming from a plurality of terminal devicesUS20040073641 *Sep 30, 2002Apr 15, 2004Muneyb MinhazuddinInstantaneous user initiation voice quality feedbackUS20040073690 *Sep 30, 2002Apr 15, 2004Neil HepworthVoice over IP endpoint call admissionUS20040073692 *Sep 30, 2002Apr 15, 2004Gentle Christopher R.Packet prioritization and associated bandwidth and buffer management techniques for audio over IPUS20040093413 *Nov 6, 2003May 13, 2004Bean Timothy E.Selecting and managing time specified segments from a large continuous capture of network dataUS20040098611 *Nov 6, 2003May 20, 2004Bean Timothy E.Optimizing retrieval of requested data from a remote deviceUS20040111425 *Oct 2, 2003Jun 10, 2004Bernd GreifenederMethod and system for automatic detection of monitoring data sourcesUS20040133733 *Nov 6, 2003Jul 8, 2004Finisar CorporationStoring, retrieving and displaying captured data in a network analysis systemUS20040151117 *Dec 12, 2002Aug 5, 2004Saravut CharcranoonDecentralized SLS monitoring for throughput in a differentiated service environmentUS20040151206 *Jan 30, 2003Aug 5, 2004Scholte Alexander MartinPacket data flow identification for multiplexingUS20040172470 *Dec 31, 2003Sep 2, 2004Nec CorporationIP router, communication system and band setting method used therein and its programUS20040193713 *Mar 28, 2003Sep 30, 2004International Business Machines CorporationNon-intrusive recursive dispatching of nested service collections for aggregating web servicesUS20040196308 *Apr 4, 2003Oct 7, 2004Blomquist Scott AlanDisplaying network segment decode information in diagrammatic formUS20040199791 *Nov 3, 2003Oct 7, 2004Poletto Massimiliano AntonioConnection table for intrusion detectionUS20040236866 *Aug 29, 2003Nov 25, 2004Diego DugatkinAutomated characterization of network trafficUS20050018694 *Jun 29, 2004Jan 27, 2005International Business Machines CorporationMethod for analyzing network trace, method for judging order among nodes, processor for analyzing network trace, computer-executable program for controlling computer as processor, and method for correcting time difference among nodes in networkUS20050021715 *Apr 22, 2004Jan 27, 2005Diego DugatkinAutomated capturing and characterization of network traffic using feedbackUS20050050098 *Sep 3, 2003Mar 3, 2005Paul BarnettSystem and method for aligning data frames in timeUS20050060403 *Sep 13, 2004Mar 17, 2005Bernstein David R.Time-based correlation of non-translative network segmentsUS20050078606 *Sep 13, 2004Apr 14, 2005Bernstein David R.Pattern-based correlation of non-translative network segmentsUS20050117516 *Oct 27, 2004Jun 2, 2005Samsung Electronics Co., Ltd.Apparatus and method for displaying data rates in a wireless terminalUS20050122958 *Dec 5, 2003Jun 9, 2005Shim Choon B.System and method for managing a VoIP networkUS20050154758 *Jan 8, 2004Jul 14, 2005International Business Machines CorporationMethod and apparatus for supporting transactionsUS20050154776 *Jan 8, 2004Jul 14, 2005International Business Machines CorporationMethod and apparatus for non-invasive discovery of relationships between nodes in a networkUS20050227625 *Sep 29, 2004Oct 13, 2005Diener Neil RUser interface and time-shifted presentation of data in a system that monitors activity in a shared radio frequency bandUS20060015576 *Nov 13, 2003Jan 19, 2006Seo Kyoung-IiApparatus for analyzing the packet data on mobile communication network and method thereofUS20060064579 *Sep 17, 2004Mar 23, 2006Aaron Jeffrey ADetection of encrypted packet streamsUS20060064749 *Sep 17, 2004Mar 23, 2006Aaron Jeffrey ADetection of encrypted packet streams using feedback probingUS20060068769 *Jan 31, 2005Mar 30, 2006Microsoft CorporationDetecting and diagnosing performance problems in a wireless network through neighbor collaborationUS20060083511 *Dec 17, 2003Apr 20, 2006Xyratex Technology LimitedNetwork tap moduleUS20060146729 *Nov 23, 2005Jul 6, 2006Todd KrautkremerApplication service level mediation and method of using the sameUS20060149841 *Dec 20, 2004Jul 6, 2006AlcatelApplication session management for flow-based statisticsUS20060153246 *Dec 22, 2005Jul 13, 2006International Business Machines CorporationApparatus, method, and program for creating network configuration informationUS20060167975 *Nov 23, 2004Jul 27, 2006Chan Alex YCaching content and state data at a network elementUS20060182034 *Dec 12, 2003Aug 17, 2006Eric KlinkerTopology aware route controlUS20060253902 *May 5, 2005Nov 9, 2006Cisco Technology, Inc.Method and system for prioritizing security operations in a communication networkUS20060268921 *Sep 5, 2003Nov 30, 2006Bo EkstromMonitoring in a telecommunication networkUS20060288404 *Jun 12, 2006Dec 21, 2006Mayilraj KirshnanControlling computer program extensions in a network deviceUS20070005786 *Jun 21, 2006Jan 4, 2007Sandeep KumarXML message validation in a network infrastructure elementUS20070005801 *Jun 15, 2006Jan 4, 2007Sandeep KumarIdentity brokering in a network elementUS20070011332 *Jun 21, 2006Jan 11, 2007Kollivakkam RaghavanDynamically adding application logic and protocol adapters to a programmable network elementUS20070067108 *Feb 22, 2006Mar 22, 2007Buhler Jeremy DMethod and apparatus for performing biosequence similarity searchingUS20070073873 *Aug 30, 2006Mar 29, 2007Hanoch LevyDetermining client latencies over a networkUS20070133403 *Feb 7, 2007Jun 14, 2007Avaya Technology Corp.Voip endpoint call admissionUS20070140128 *Oct 27, 2006Jun 21, 2007Eric KlinkerSystem and method to provide routing control of information over networksUS20070156919 *Jun 21, 2006Jul 5, 2007Sunil PottiEnforcing network service level agreements in a network elementUS20070172902 *Jun 21, 2006Jul 26, 2007The Johns Hopkins University, a non-profit organizationBiomarker for ovarian cancerUS20070174841 *Jan 26, 2006Jul 26, 2007Exegy Incorporated & Washington UniversityFirmware socket module for FPGA-based pipeline processingUS20070195872 *Apr 30, 2007Aug 23, 2007Adc Dsl Systems, Inc.Non-chronological system statisticsUS20070242702 *Apr 13, 2006Oct 18, 2007Shim Choon BApparatus and method for monitoring quality metrics associated with a wireless networkUS20070280123 *Jan 27, 2004Dec 6, 2007Atkins Jeffrey BMonitoring System For A Mobile Communication Network For Traffic Analysis Using A Hierarchial ApproachUS20080002596 *Sep 14, 2007Jan 3, 2008Childress Rhonda LMethod and apparatus for non-invasive discovery of relationships between nodes in a networkUS20080004035 *Jun 26, 2007Jan 3, 2008Atkins Jeffrey BMobile Communications Network Monitoring SystemsUS20080005354 *Aug 2, 2007Jan 3, 2008Kryskow Joseph M JrReal time mesh measurement systen stream latency and jitter measurementsUS20080025230 *Jul 27, 2006Jan 31, 2008Alpesh PatelApplying quality of service to application messages in network elements based on roles and statusUS20080059614 *Oct 31, 2007Mar 6, 2008Kim Steven DSystem and Method for Managing Server ConfigurationsUS20080065759 *Sep 11, 2006Mar 13, 2008Michael Peter GassewitzTargeted electronic content delivery control systems and methodsUS20080086274 *Aug 10, 2007Apr 10, 2008Chamberlain Roger DMethod and Apparatus for Protein Sequence Alignment Using FPGA DevicesUS20080109575 *Sep 12, 2004May 8, 2008Xyratex Technology LimitedMethod Of Transferring Data Implying A Network Analyser CardUS20080112399 *Nov 13, 2006May 15, 2008British Telecommunications Public Limited CompanyTelecommunications systemUS20080151744 *Dec 21, 2007Jun 26, 2008Hidehito YakushijiCommunication system, method of providing information therein and communication deviceUS20080151760 *Jul 28, 2004Jun 26, 2008Andreas MichlMessage Analyser and Analysis MethodUS20080159165 *Jul 2, 2007Jul 3, 2008International Business Machines CorporationTechnique of Analyzing An Information System StateUS20080186866 *Feb 1, 2008Aug 7, 2008Fujitsu LimitedCommunication-quality measuring apparatus, communication-quality measuring method, and computer programUS20080188191 *Feb 6, 2007Aug 7, 2008British Telecommunications Public Limited CompanyNetwork monitoring systemUS20080221911 *Mar 9, 2007Sep 11, 2008Ludmila CherkasovaSystem and method for determining a subset of transactions of a computing system for use in determining resource costsUS20080275984 *Jun 6, 2008Nov 6, 2008International Business Machines CorporationMethod and system for network management providing access to application bandwidth usage calculationsUS20080288543 *Apr 30, 2008Nov 20, 2008Paul BarnettSystem and method for aligning data frames in timeUS20080298271 *Aug 4, 2008Dec 4, 2008Fujitsu LimitedCommunication-quality measuring apparatus, communication-quality measuring method, and computer programUS20090073885 *Sep 17, 2008Mar 19, 2009Rehan JalilMethod, system and apparatus for tracking user behavior in a wireless communication networkUS20090086645 *Oct 28, 2008Apr 2, 2009Exfo Service Assurance, Inc.Apparatus and method for passively analyzing a data packet delivery pathUS20090119301 *Nov 5, 2007May 7, 2009Ludmila CherkasovaSystem and method for modeling a session-based system with a transaction-based analytic modelUS20090177626 *May 26, 2008Jul 9, 2009Robert LotteroApparatus and method for investigative analysis of law enforcement casesUS20090190591 *Mar 24, 2008Jul 30, 2009Ganesh Chennimalai SankaranObtaining Information on Forwarding Decisions for a Packet FlowUS20090210525 *Jun 2, 2006Aug 20, 2009Huetter LngoMethod for Detection of the Activity of a Device In a Network of Distributed Stations, as Well as a Network Station for Carrying Out the MethodUS20090245127 *Jun 8, 2009Oct 1, 2009Packeteer, Inc.Application Service Level Mediation and Method of Using SameUS20100008249 *Sep 17, 2009Jan 14, 2010Fujitsu LimitedMeasuring method, measuring apparatus and computer programUS20100036810 *Aug 8, 2008Feb 11, 2010Oracle International CorporationAutomated topology-based statistics monitoring and performance analysisUS20100094858 *Dec 17, 2009Apr 15, 2010Exegy IncorporatedMethod and System for High Performance Integration, Processing and Searching of Structured and Unstructured Data Using CoprocessorsUS20100145755 *Jun 19, 2007Jun 10, 2010Aito Technologies OyArrangement and a related method for providing business assurance in communication networksUS20100192002 *Mar 26, 2007Jul 29, 2010Yu SuMethod and apparatus of testing data communication performance of a network systemUS20100195658 *Oct 5, 2007Aug 5, 2010Robert David CohenTelecommunications systemUS20100232313 *May 13, 2010Sep 16, 2010At&T Intellectual Property I, LpDetection of encrypted packet streams using feedback probingUS20100268524 *Apr 16, 2010Oct 21, 2010Empirix Inc.Method For Modeling User Behavior In IP NetworksUS20110040874 *Oct 28, 2010Feb 17, 2011Diego DugatkinAutomated Characterization of Network TrafficUS20110119370 *Nov 17, 2009May 19, 2011Microsoft CorporationMeasuring network performance for cloud servicesUS20110225527 *Mar 9, 2011Sep 15, 2011Salesforce.Com, Inc.Configurable highlights panel for display of database recordsUS20110282926 *Apr 20, 2011Nov 17, 2011Fujitsu LimitedRelay apparatus, recording medium storing a relay program, and a relay methodUS20120096146 *Sep 2, 2011Apr 19, 2012Paul BarnettSystem and method for aligning data frames in timeUS20120224489 *Jun 11, 2010Sep 6, 2012Zte CorporationSystem, Apparatus and Method for Making Statistics on Point Protocol Negotiation State in Wireless SystemUS20120327816 *Aug 9, 2012Dec 27, 2012Morrill Robert JSystem and method for differentiated billingUS20130185554 *Feb 21, 2013Jul 18, 2013Siemens Enterprise Communications Gmbh & Co. KgMethod for analyzing coded data streams simultaneously transmitted in ip networksUS20130250777 *Mar 26, 2012Sep 26, 2013Michael L. ZieglerPacket descriptor trace indicatorsUS20130346377 *Aug 26, 2013Dec 26, 2013Ca, Inc.System and method for aligning data frames in timeUS20140056157 *Jan 30, 2013Feb 27, 2014Ascom Network Testing AbSystems and Methods for Measuring Available Bandwidth in Mobile Telecommunications NetworksCN100442702CJan 5, 2005Dec 10, 2008华为技术有限公司Method and apparatus for realizing modem signal fault analysisEP1429492A2Nov 18, 2003Jun 16, 2004AlcatelDecentralized SLS montoring for throughput in a differentiated service environmentEP1549092A1 *Dec 22, 2003Jun 29, 2005Nortel Networks LimitedWireless data traffic statisticsEP1598987A1 *Feb 27, 2003Nov 23, 2005Fujitsu LimitedUse state ascertaining method and deviceEP1677554A1 *Oct 20, 2004Jul 5, 2006Anritsu CorporationMobile communication terminal test system capable of visually recognizing communication condition and response signalEP1677554A4 *Oct 20, 2004Apr 25, 2012Anritsu CorpMobile communication terminal test system capable of visually recognizing communication condition and response signalEP2127191A1 *Mar 26, 2007Dec 2, 2009Intel Corporation (a Delaware Corporation)Method and apparatus of testing data communication performance of a network systemEP2538620A1 *Feb 7, 2011Dec 26, 2012Nec CorporationQuality deterioration point analysis system, quality deterioration point analysis device, quality deterioration point analysis method and programWO2004056043A1 *Dec 10, 2003Jul 1, 2004Xyratex Technology LimitedNetwork tap moduleWO2005018153A1 *Jul 28, 2004Feb 24, 2005Rohde & Schwarz Gmbh & Co. KgMessage analysis device and method for analysisWO2005039222A1Oct 20, 2004Apr 28, 2005Anritsu CorporationMobile communication terminal test system capable of visually recognizing communication condition and response signalWO2005071890A1 *Jan 27, 2004Aug 4, 2005Actix LimitedMonitoring system for a mobile communication network for traffic analysis using a hierarchial approachWO2005094309A2 *Mar 25, 2005Oct 13, 2005Cognio, Inc.User interface and time-shifted presentation of data in a system that monitors a frequency bandWO2005094309A3 *Mar 25, 2005Dec 4, 2008Cognio IncUser interface and time-shifted presentation of data in a system that monitors a frequency bandWO2005114910A1 *May 20, 2005Dec 1, 2005Xyratex Technology LimitedA method of processing data, a network analyser card, a host and an intrusion detection systemWO2005125098A1 *Jun 15, 2005Dec 29, 2005AlcatelImproved networks statistics processing deviceWO2008116345A1Mar 26, 2007Oct 2, 2008Intel CoporationMethod and apparatus of testing data communication performance of a network systemWO2015046697A1 *Apr 18, 2014Apr 2, 2015Öt¯Ö»¸ÒªðÖbÐ ÖndÖ¸©ÔmmÖo©ÖºyÖo©Apparatus for detecting abnormal increase of control packets, method therefor, and recording medium* Cited by examinerClassifications U.S. Classification370/241, 370/474International ClassificationH04L12/56, H04L29/14, H04M11/00, H04L12/24, H04L12/26Cooperative ClassificationY04S40/168, H04L41/5061, H04L41/22, H04L43/0888, H04L43/106, H04L43/062, H04L43/028, H04L43/026, H04L43/0852, H04L43/0864, H04L43/045, H04L41/5029, H04L43/0829, H04L41/5035, H04L43/0858, H04L41/5003European ClassificationH04L41/50A, H04L43/08E1, H04L41/22, H04L43/08FLegal EventsDateCodeEventDescriptionNov 29, 2002ASAssignmentOwner name: NIKSUN, INC., NEW JERSEYFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:PRUTHI, PARAG;HEYBEY, ANDREW;KURIEN, THEKKTHALACKAL VARUGIS;REEL/FRAME:013534/0410;SIGNING DATES FROM 20010705 TO 20010724Jul 25, 2012FPAYFee paymentYear of fee payment: 4Jul 25, 2016FPAYFee paymentYear of fee payment: 8RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services