Source: http://www.google.co.uk/patents/US20010027485
Timestamp: 2017-12-15 16:09:08
Document Index: 303951514

Matched Legal Cases: ['Application No.2000', 'Application No.11', 'art 18', 'art 19', 'art 18', 'art 19', 'art 18', 'art 19']

Patent US20010027485 - Method for collecting statistical traffic data - Google Patents
As shown in FIG. 2, when the SYN segment is detected, the amount of transmitted segment from the side which sent the detected SYN segment is obtained by counting the continuously detected DATA segments for collecting the traffic in a certain direction where it is impossible to directly capture the traffic....http://www.google.co.uk/patents/US20010027485?utm_source=gb-gplus-sharePatent US20010027485 - Method for collecting statistical traffic data
Publication number US20010027485 A1
Application number US 09/820,008
Also published as US7010592
Publication number 09820008, 820008, US 2001/0027485 A1, US 2001/027485 A1, US 20010027485 A1, US 20010027485A1, US 2001027485 A1, US 2001027485A1, US-A1-20010027485, US-A1-2001027485, US2001/0027485A1, US2001/027485A1, US20010027485 A1, US20010027485A1, US2001027485 A1, US2001027485A1
Inventors Tomohiko Ogishi, Akira Idoue, Toru Hasegawa, Toshihiko Kato
Original Assignee Tomohiko Ogishi, Akira Idoue, Toru Hasegawa, Toshihiko Kato
Patent Citations (24), Referenced by (37), Classifications (13), Legal Events (5)
US 20010027485 A1
As shown in FIG. 2, when the SYN segment is detected, the amount of transmitted segment from the side which sent the detected SYN segment is obtained by counting the continuously detected DATA segments for collecting the traffic in a certain direction where it is impossible to directly capture the traffic. Further, the amount [ini_sdt] of the transmitted bytes from the side which sent the detected SYN segment is obtained by calculating the equation [ini_sdt]=[SEQn+LENn]−[SEQ1]. Wherein, [SEQ1] is the sequence number of the first detected DATA segment, [SEQn] is the sequence number of the last detected DATA segment and [LENn] is the user data length of the last detected DATA segment.
calculating, as an FTP throughput at a side which sent the detected SYN segment, a ratio of a difference, between a sequence number of the first detected DATA segment and a sum of a sequence number of the last detected DATA segment and a user data length of the last detected DATA segment, to a time difference from the first detection of the DATA segment to the last detection of the DATA segment.
The entire disclosure of Japanese Patent Application No.2000-90661 filed on Mar. 29, 2000 including specification, claims, drawings and summary is incorporated herein by reference in its entirety.
The present invention relates to a technique for collecting or gathering statistical traffic data by capturing a TCP/IP traffic which flows on the Internet line. Specially, the present invention enables to collecting, by managing a TCP-level information in a certain direction, a traffic in another direction where it is impossible to directly capture the traffic.
A performance analysis, which measures such statistical traffic data as an amount of transferred data, becomes important according to a spread of the Internet. As described in Japanese Patent laid-open Application No.11-252111, the inventors considered that it was possible to recognise a situation of the Internet by measuring a TCP-level statistical information (for example, an amount of re-transferred data, a waiting time for establishing a connection etc.), then developed a traffic monitor which can collect the TCP-level statistical traffic information in addition to an IP-level information by monitoring a backbone line of the Internet. The traffic monitor was developed under such a condition that it was possible to monitor segments of both directions in a TCP communication on the same line.
A method derived from the preferred embodiment comprises steps of:
detecting a DATA segment, which belongs to the same connection as the detected SYN segment, from said traffic; and
obtaining at least one of an amount of transmitted segment from a side which sent the detected SYN segment, and an amount of transmitted bytes from said side; wherein said amount of transmitted segment being obtained by counting a total amount of said detected DATA segment, and said amount of transmitted bytes being obtained by calculating a difference between a sequence number of the first detected DATA segment, and a sum of a sequence number of the last detected DATA segment and a user data length of said last detected DATA segment.
detecting a DATA segment, which belongs to the same connection as the detected SYN+ACK segment, from said traffic; and
obtaining at least one of an amount of transmitted segment from a side which sent the detected SYN+ACK segment, and an amount of transmitted bytes at said side; wherein said amount of transmitted segment being obtained by counting a total amount of said detected DATA segment, and said amount of transmitted bytes being obtained by calculating a difference between a sequence number of the first detected DATA segment, and a sum of a sequence number of the last detected DATA segment and a user data length of said last detected DATA segment.
detecting an ACK segment and a DATA segment, each of which belongs to the same connection as the detected SYN segment, from said traffic; and
detecting an ACK segment and a DATA segment, each of which belongs to the same connection as the detected SYN+ACK segment, from said traffic; and
detecting a DATA segment, which belongs to the same connection as the detected SYN segment, from said traffic;
detecting a DATA segment, which belongs to the same connection as the detected SYN+ACK segment, from said traffic;
detecting an ACK segment, which belongs to the same connection as the detected SYN segment, from said traffic;
detecting an ACK segment, which belongs to the same connection as the detected SYN+ACK segment, from said traffic;
detecting continuous plural DATA segments and continuous plural ACK segments in succession to the DATA segments, all of which belong to the same connection as the detected SYN segment, from said traffic; and
In the method, it is possible to efficiently avoid an extraordinary amount by calculating the HTTP throughput only when the continuous ACK segments than a predetermined quantity such as 10 are detected.
detecting continuous plural ACK segments and continuous plural DATA segments in succession to the ACK segments, all of which belong to the same connection as the detected SYN+ACK segment, from said traffic; and
detecting continuous plural ACK segments, which belong to the same connection as the detected SYN+ACK segment, from said traffic; and
In the method, it is possible to efficiently avoid an extraordinary amount by calculating the FTP throughput only when the continuous ACK segments than a predetermined quantity such as 10 are detected.
detecting continuous plural DATA segments, which belong to the same connection as the detected SYN segment, from said traffic; and
In the method, it is possible to efficiently avoid an extraordinary amount by calculating the FTP throughput only when the continuous DATA segments than a predetermined quantity such as 10 are detected.
[0067]FIG. 1 shows a sample of the apparatus which can collects the statistical traffics in both directions.
[0068]FIG. 2 shows a sample of the sequence chart for collecting the amount of the transmitted data at the side which sends the SYN segment.
[0069]FIG. 3 shows a sample of the sequence chart for collecting the amount of the transmitted data at the side which sends the SYN+ACK segment.
[0070]FIG. 4 shows a sample of the sequence chart for collecting the amount of the received data at the side which sends the SYN segment.
[0071]FIG. 5 shows a sample of the sequence chart for collecting the amount of the received data at the side which sends the SYN+ACK segment.
[0072]FIG. 6(a) shows a sample of the sequence chart for collecting the amount of the received data.
[0073]FIG. 6(b) shows a sample of the duplicated bytes.
[0074]FIG. 7 shows a sample of the sequence chart for collecting the amount of the missing segment.
[0075]FIG. 8(a) shows a sample of the sequence chart for collecting the HTTP response time and the HTTP throughput.
[0076]FIG. 8(b) shows a sample of the sequence chart for collecting the HTTP response time and the HTTP throughput.
[0077]FIG. 9(a) shows a sample of the sequence chart for collecting the FTP throughput.
[0078]FIG. 9(b) shows a sample of the sequence chart for collecting the FTP throughput.
[0080]FIG. 1 shows a configuration of an apparatus, which attains the present invention, for collecting statistical traffic information in both directions. The apparatus 1 shown in FIG. 1 comprises a module 2 for capturing segments, an analysis module 3, a storing module 4, a memory 5 for storing a status transition table and a memory 6 for storing a traffic information or data. The apparatus 1 collects, as a traffic information, a TCP-level information and an application-level information (for example; an HTTP-level information, an FTP-level information) as shown in below list.
In the network shown in FIG. 1, it is assumed that a traffic from the terminal(A) 7 to the terminal(B) 8 flows, as shown by a solid line 16 a, via the router 11, the router 12, the Internet 10 and the router 14 successively. It is also assumed that a traffic from the terminal(B) 8 to the terminal(A) 7 flows, as shown by a solid line 16 b, via the router 14, the Internet 10, the router 13 and the router 13 successively. In this case, the module 2 can only capture the traffic in one direction shown by the solid line 16 a. In other words, the module 2 can not capture the traffic in other direction shown by the solid line 16 b.
Further, it is assumed that a traffic from the terminal (C) 7 to the terminal(A) 7 flows, as shown by a dotted line 17 a, via the router 14, the Internet 10, the router 12 and the router 11 successively. It is also assumed that a traffic from the terminal(A) 7 to the terminal(C) 9 flows, as shown by a solid line 17 b, via the router 11, the router 13, the Internet 10 and the router 14 successively. In this case, the module 2 can only capture the traffic in one direction shown by the dotted line 17 a. In other words, the module 2 can not capture the traffic in other direction shown by the solid line 17 b.
The module 3 calculates such a statistical traffic information as an amount of the transferred data, based on the segment captured by the module 2.
A segment of which SYN bit only is “1” is called an SYN segment, and a segment of which SYN bit and ACK bit only are “1” is called an SYN+ACK segment.
A segment of which SYN bit only is “1” among the SYN bit, an FIN bit and the ACK bit, and which has a user data, is called a DATA segment. A segment of which SYN bit only is “1” among the SYN bit, an FIN bit and the ACK bit, but which has not the user data, is called a ACK segment.
ini — sdt=(SEQn+LENn)−SEQ1 equation (1)
rsp — sdt=(SEQn+LENn)−SEQ1 equation (2)
ini — rdt=ACKn−ACK1 equation (3)
ini — rdt=ACKn−ACK1 equation (4)
Next, referring to FIGS. 6(a) and 6(b), a re-transferred amount at the side which sent the SYN segment and a re-transferred amount at the side which sent the SYN+ACK segment will be explained. As the re-transferred amount, there are an amount of a re-transferred segment and an amount of a re-transferred bytes.
To collect the re-transmitted amount from the side which sent the SYN segment, from a traffic in a direction which can be monitored, the SYN segment is detected. Further, the DATA segment, which belongs to same connection as the detected SYN segment, is detected as shown in FIG. 6(a).
As indicated by following equation (5), the new amount [ini_ret_num] of re-transmitted segment is obtained by adding 1 to the last obtained amount of re-transmitted segment.
ini — ret — num=ini — ret — num+1 equation (5)
As indicated by following equation (5), the new amount [ini_ret] of re-transmitted bytes is obtained by adding bytes of a shaded part 18 or a shaded part 19 shown in FIG. 6(b), to the last obtained amount of re-transmitted bytes.
ini — ret=ini — ret+min(seq — nxt−SEQ,LEN) equation (6)
Namely, the amount [ini_ret] is obtained by adding a smaller one out of a first value [seq_nxt]−[SEQ] and a second value [LEN] to the last obtained amount of re-transmitted bytes. The first value [seq_nxt]−[SEQ] is a difference between the determined next sequence number [seq_nxt] and a sequence number [SEQ] of the newly detected DATA segment. The second value [LEN] is a user data length of the newly detected DATA segment.
In FIG. 6(a), when the second DATA segment (SEQ=1460, LEN=1460) was detected, the next sequence number [seq_nxt] is 2920. Then, the re-transmission is judged by detecting the third DATA segment (SEQ=0, LEN=1460). In this case, as [seq_nxt]−[SEQ]=2920 and [LEN]=1460, the shaded part 18 shown in FIG. 6(b) is 1460 bytes. 1460 bytes are detected as the amount of the re-transmitted bytes at the SYN segment sending side.
Further in FIG. 6(a), when the fourth DATA segment (SEQ=2920, LEN=1460) was detected, the next sequence number [seq_nxt] is 4380. Then, the re-transmission is judged by detecting the fifth DATA segment (SEQ=4000, LEN=1460). In this case, as [seq_nxt]−[SEQ]=380 and [LEN]=1460, the shaded part 19 shown in FIG. 6(b) is 380 bytes. 380 bytes are added to the last amount (1460 bytes), then the new amount of re-transmitted bytes becomes 1840 (=1460+380).
To collect the re-transmitted amount at the side which sent the SYN+ACK segment, from a traffic in a direction which can be monitored, the SYN+ACK segment is detected. Further, the DATA segment, which belongs to same connection as the detected SYN+ACK segment, is detected as shown in FIG. 6(a).
As indicated by following equation (7), the new amount [rsp_ret_num] of re-transmitted segment is obtained by adding 1 to the last obtained amount of re-transmitted segment.
rsp — ret — num=rsp — ret — num+1 equation (7)
As indicated by following equation (8), the new amount [rsp_ret] of re-transmitted bytes is obtained by adding bytes of a shaded part 18 or a shaded part 19 shown in FIG. 6(b), to the last obtained amount of re-transmitted bytes.
rsp — ret=rsp — ret+min(seq — nxt−SEQ,LEN) equation (8)
ACK=ack_nxt equation (9)
WIN=win equation (10)
ini — recv — drpo — num=ini — recv — drpo — num+1 equation (11)
For above-mentioned calculation, a duplicated ACK flag is introduced in this embodiment. A word “dupack” represents the duplicated ACK flag.
Then, only when a value of the dupack flag is equal to “0” as indicated by following equation (12), it is judged whether both of following equations (13) and (149 are completed. Herein, the equation (13) is equal to the equation (9) and the equation (14) is equal to the equation (10).
dupack=“0” equation (12)
ACK=ack_nxt equation (13)
WIN=win equation (14)
Further, only when both of the equations (13) and (14) are completed, as indicated by following equation (15), 1 is added to the last obtained amount [ini_recv_drop] of missing DATA segment. Still further, as shown by following equation (16), the value of the dupack flag is changed to “1”. Herein, the equation (13) is equal to the equation (11).
The value of the dupack flag is managed by the module 3, as follows. (1) An initial value of the dupack flag is set “0”. (dupack=“0”)
(2) Under the condition of dupack=“0”, the value of the dupack flag is changed from “0” to “1”, when a next ACK segment, which satisfies both of the equations (13) and (14), is detected. (dupack=“1”)
(3) Under the condition of dupack=“1”, the value of the dupack flag is returned from “1” to “0”, when a next ACK segment, of which any one of acknowledgment number and window size is different from that of the ACK segment by which the value of the dupack flag was changed from “0” to “1”, is detected. (dupack=“0”)
(4) Under the condition of dupack=“1”, the value of the dupack flag is not changed from “1”, when a next ACK segment, of which both of acknowledgment number and window size is equal to those of the ACK segment by which the value of the dupack flag was changed from “0” to “1”, is detected.
As mentioned above, when the SYN segment is detected and the ACK segment, which belongs to same connection as the detected SYN segment, is detected, it is judged whether the acknowledgment number [ACK] and window size [WIN] of the detected ACK segment are respectively equal to the determined next acknowledgment number [ack_nxt] and the determined present window size [win].
Referring a sequence chart shown in FIG. 7, in the first ACK segment, [ACK]=1460, [WIN]=8192. Then, initially, the next acknowledgment number [ack_nxt] is 1460, the present window size [win] is 8192 and the value of the dupack flag is the initial value “0”.
Because [ACK]=2920, [WIN]=8192 in the second ACK segment, [ACK] is not equal to [ack_nxt], then, [ack_nxt] is changed to 2920. The value of the dupack flag is not changed from “0”.
The second ACK segment and the third DATA segment have the same acknowledgment number [ACK=2920] and the same window size [WIN=8192], further these acknowledgment number [ACK=2920] and window size [WIN=8192] are respectively equal to the determined next acknowledgment number [ack_nxt=2920] and the determined present window size [win=8192]. Then, the amount of the missing DATA segment becomes 1 by adding 1 to the last amount (0) of the missing DATA segment and the value of the dupack flag is changed from “0” to “1”, when the third DATA segment is detected.
The second ACK segment and the fourth DATA segment have the same acknowledgment number [ACK=2920] and the same window size [WIN=8192], further these acknowledgment number [ACK=2920] and window size [WIN=8192] are respectively equal to the determined next acknowledgment number [ack_nxt=2920] and the determined present window size [win=8192]. However, because the value of the dupack flag is “1” when the fourth DATA segment is detected, the amount of the missing DATA segment is not increased and the value of the dupack flag is not changed from “1”.
Therefore, because [ACK] is not equal to [ack_nxt] when the fifth DATA segment is detected, the next acknowledgment number [ack_nxt] changed to 4380 and the value of the dupack flag is returned to “0”.
The fifth ACK segment and the sixth DATA segment have the same acknowledgment number [ACK=4380] and the same window size [WIN=8192], further these acknowledgment number [ACK=4380] and window size [WIN=8192] are respectively equal to the determined next acknowledgment number [ack_nxt=4380] and the determined present window size [win=8192]. Then, the amount of the missing DATA segment becomes 2 by adding 1 to the last amount (1) of the missing DATA segment and the value of the dupack flag is changed from “0” to “1”, when the sixth DATA segment is detected.
(1) The fifth ACK segment has an acknowledgment number [ACK=5840] and an window size [WIN=8192], then the acknowledgment number [ACK=5840] is different from the acknowledgment number [ACK=4380] of the sixth DATA segment. Further, when the sixth DATA segment is detected, the determined next acknowledgment number [ack_nxt] is 4380 and the determined present window size [win] is 8192. Therefore, because [ACK] is not equal to [ack_nxt] when the seventh DATA segment is detected, the next acknowledgment number [ack_nxt] changed to 5840 and the value of the dupack flag is returned to “0”.
(2) The eighth ACK segment has an acknowledgment number [ACK=5840] and an window size [WIN=16384], then the window size [WIN=16384] is different from the window size [WIN=8192] of the seventh DATA segment. Further, when the seventh DATA segment is detected, the determined next acknowledgment number [ack_nxt] is 5840 and the determined present window size [win] is 8192. Therefore, because [WIN] is not equal to [win] when the eighth DATA segment is detected, the present window size [win] changed to 16384 and the value of the dupack flag is “0”.
dupack=“0” equation (17)
ACK=ack_nxt equation (18)
WIN=win equation (19)
Under the condition of dupack=“0” as indicated by the equation (17), when both of the equations (18) and (19) are completed, as indicated following equation (20), the new amount [rsp_recv_drop_num] of missing DATA segment, at a side which sent the detected SYN segments, is obtained by adding 1 to the last obtained amount of missing DATA segment, further the value of the dupack flag is changed from “0” to “1” as indicated following equation (21).
rsp — recv — drpo — num=rsp — recv — drpo — num+1 equation (20)
dupck=“1” equation (21)
Next, referring to FIGS. 8(a) and 8(b), an HTTP response time and an HTTP throughput will be explained.
Referring to a sequence chart shown in FIG. 8(a), the HTTP response time and the HTTP throughput at a side which sent the SYN segment will be explained. To collect the HTTP response time and the HTTP throughput, from a traffic in a direction which can be monitored, the SYN segment is detected, further continuous plural DATA segments (HTTP request) and continuous plural ACK segments (HTTP response) in succession to the HTTP request (DATA segments), all of which belong to the same connection as the detected SYN segment, are detected.
Therefore as shown in FIG. 8(a), when the SYN segment is detected in the monitored direction, the HTTP response time [ini_http_rsp_time], at the side which sent the detected SYN segment, is obtained by calculating a time difference from the last detection of the DATA segment to the first detection of the ACK segment,
As shown in FIG. 8(a), when the SYN segment is detected in the monitored direction, an amount [http_rsp_byt] of the total bytes of the HTTP response is obtained by calculating a difference between an acknowledgment number of the first detected ACK segment and an acknowledgment number of the last detected ACK segment. Further, a time difference [http_rsp_dtime], from the first segment to the last segment of the HTTP response, is obtained by calculating a time difference from the first detection of the ACK segment to the last detection of the ACK segment.
ini — http — tpt=http — rsp — byt/http — rsp — dtime equation (22)
Referring to a sequence chart shown in FIG. 8(b), the HTTP response time and the HTTP throughput at a side which sent the SYN+ACK segment will be explained. To collect the HTTP response time and the HTTP throughput, from a traffic in a direction which can be monitored, the SYN+ACK segment is detected, further continuous plural ACK segments (HTTP request) and continuous plural DATA segments (HTTP response) in succession to the HTTP request (ACK segments), all of which belong to the same connection as the detected SYN+ACK segment, are detected.
Therefore as shown in FIG. 8(b), when the SYN+ACK segment is detected in the monitored direction, the HTTP response time [rsp_http_rsp_time], at the side which sent the detected SYN+ACK segment, is obtained by calculating a time difference from the last detection of the ACK segment to the first detection of the DATA segment,
The HTTP throughput [rsp_http_tpt], at the side which sent the SYN+ACK segment, is obtained by calculating a ratio of an amount of total bytes of the HTTP response to a time difference between a first segment and a last segment of the HTTP response. It is desirable in a precise to obtain an HTTP throughput during the HTTP response, because the total bytes of the DATA segments of the HTTP response is usually greater than that of the HTTP request.
As shown in FIG. 8(b), when the SYN+ACK segment is detected in the monitored direction, an amount [http_rsp_byt] of the total bytes of the HTTP response is obtained by calculating a difference between a sequence number of the first detected DATA segment, and a sum of a sequence number of the last detected DATA segment and a user data length of the last detected DATA segment. Further, a time difference [http_rsp_dtime], from the first segment to the last segment of the HTTP response, is obtained by calculating a time difference from the first detection of the DATA segment to the last detection of the DATA segment.
rsp — http — tpt=http — rsp — byt/http — rsp — dtime equation (23)
Next, referring to FIGS. 9(a) and 9(b), an FTP throughput will be explained.
Referring to a sequence chart shown in FIG. 9(a), the FTP throughput at a side which sent the SYN+ACK segment will be explained. To collect the FTP throughput, from a traffic in a direction which can be monitored, the SYN+ACK segment is detected, further continuous plural ACK segments, which belong to the same connection as the detected SYN+ACK segment, are detected.
As shown in FIG. 9(a), when the SYN+ACK segment is detected in the monitored direction, an amount [ftp_byt] of the total bytes of the file is obtained by calculating a difference between an acknowledgment number of the first detected ACK segment and an acknowledgment number of the last detected ACK segment. Further, a time difference [ftp_dtime], from the first segment to the last segment in the file transmission, is obtained by calculating a time difference from the first detection of the ACK segment to the last detection of the ACK segment.
ini — ftp — tpt=ftp — byt/ftp — dtime equation (24)
Referring to a sequence chart shown in FIG. 9(b), the FTP throughput at a side which sent the SYN segment will be explained. To collect the FTP throughput, from a traffic in a direction which can be monitored, the SYN segment is detected, further continuous plural DATA segments, which belong to the same connection as the detected SYN segment, are detected.
As shown in FIG. 9(b), when the SYN segment is detected in the monitored direction, an amount [ftp_byt] of the total bytes of the file is obtained by calculating a difference between a sequence number of the first detected DATA segment, and a sum of a sequence number of the last detected DATA segment and a user data length of te last detected DATA segment. Further, a time difference [ftp_dtime], from the first segment to the last segment in the file transmission, is obtained by calculating a time difference from the first detection of the DATA segment to the last detection of the DATA segment.
rsp — ftp — tpt=ftp — byt/ftp — dtime equation (25)
As mentioned-above, it is possible to identify the collected statistical traffic data, based on detecting the SYN segment or the SYN+ACK segment. Namely, it is possible to identify whether a monitored communication is the communication from the server or the communication from the client, based on detecting the SYN segment or the SYN +ACK segment.
US6091710 * 7 Jul 1997 18 Jul 2000 Paradyne Corporation System and method for preventing data slow down over asymmetric data transmission links
US6178450 * 1 Jul 1998 23 Jan 2001 Kokusai Denshin Denwa Co., Ltd. Method and apparatus for monitoring a communication link based on TCP/IP protocol by emulating behavior of the TCP protocol
US6201791 * 29 Oct 1997 13 Mar 2001 International Business Machines Corp. Method and apparatus for measuring flow capacity of and determining the optimal window size of a communications network
US6560630 * 18 Mar 1999 6 May 2003 3Com Corporation Receive load balancing and fail over with multiple network interface cards
US6587435 * 5 Mar 1999 1 Jul 2003 Kdd Corporation Apparatus for high speed communication on asymmetric line
US6650636 * 20 Oct 1999 18 Nov 2003 Tachyon, Inc. Transmission and reception of TCP/IP data over a wireless communication channel
US6654923 * 9 Sep 1999 25 Nov 2003 Nortel Networks Limited ATM group protection switching method and apparatus
US6728885 * 8 Oct 1999 27 Apr 2004 Networks Associates Technology, Inc. System and method for network access control using adaptive proxies
US6925060 * 29 Jan 2001 2 Aug 2005 Mitsubishi Denki Kabushiki Kaisha Method and unit for controlling the flow of a TCP connection on a flow controlled network
US7801980 * 12 May 2004 21 Sep 2010 Sourcefire, Inc. Systems and methods for determining characteristics of a network
US7885190 * 12 May 2004 8 Feb 2011 Sourcefire, Inc. Systems and methods for determining characteristics of a network based on flow analysis
US20100049691 * 14 Aug 2009 25 Feb 2010 Fujitsu Limited Data storage apparatus
WO2010091610A1 * 28 Jan 2010 19 Aug 2010 Huawei Technologies Co., Ltd. Link detection method, apparatus and communications system thereof
International Classification H04L29/14, H04L12/24, H04M3/36
Cooperative Classification H04L67/02, H04L69/16, H04L41/142, H04L43/18
European Classification H04L43/18, H04L41/14A, H04L29/06J, H04L29/08N1
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:OGISHI, TOMOHIKO;IDOUE, AKIRA;HASEGAWA, TORU;AND OTHERS;REEL/FRAME:011671/0427