Patent Description:
In the current wireless networking world, client complaints are usually the trigger for setting up packet capture at a wireless access point. In such a case, a customer has already suffered to the point of finding it necessary or worth the effort to report a problem to the service provider.

The service provider may respond to the complaint by setting up special packet capture and debug modules which control an access point to capture all packets and subject them to one or more debug procedures in an attempt to identify a problem at the specific access point associated with the customer complaint. Such an approach may result in the detection of recurring problems but may not definitively explain what was the source of the original complaint. This is because such post complaint packet capture collects packets communicated after the initial problem and not packets corresponding to the time of the initial problem or immediately preceding the reported problem, which, if available, might have been useful in determining the cause of the customer's complaint so that corrective measures could be taken.

Thus, while configuring packet capture in response to a complaint from a specific user may be useful, the fact that the customer had to complain about a service problem before action can be taken can lead to a disgruntled customer. Furthermore configuring an access point to capture and report all packets for debugging can involve the capture and communication of a large amount of data even though much of the traffic may have nothing to do with the reported problem.

While it may be possible to detect the source of some problems by capturing and studying packets at a single access point, some problems may involve excessive handoffs between access points and/or different interfaces. From the perspective of one interface there may seem to be no communications problem and a user may be able to communicate successfully for a brief period of time. However because of repeated handoffs or for other reasons, which do not appear as communications failures to an individual access point, a communications session may be dropped or subjected to undesirable interruptions which are unsatisfactory to a user of a particular wireless terminal. While a particular device may encounter problems because of individual device settings, other devices may not encounter such problems, and such problems may not appear as communications failures or problems to the access points servicing the wireless terminal encountering the communications problem. This can be particularly the case with devices which support multiple communications modes of operation and handoffs may occur from an interface using one communications technology to an interface which uses another communications technology.

In view of the above discussion it should be appreciated that there is a need for methods and apparatus which would allow for detection of communications problems before the reporting of complaints by individual customers and the collection of information which would allow the source of the failures to be determined rather than simply the source of future failures. There is also a need for methods and apparatus that would allow for the detection and/or diagnosing of problems which may interfere with the quality of service provided to a customer but which may not appear to be a communications failure from the perspective of an individual communications interface or access point. <CIT> discusses a technique for combining operations of a wireless access point with a remote probe, an access point linking a wireless client to a wireless switch, and a remote probe that captures wireless packets, appends radio information, and forwards packets to a remote observer for analysis. In this document, the observer may provide a protocol-level debug. A system according to the technique can, for example, accomplish concurrent in-depth packet analysis of one or more interfaces on a wireless switch. The system can also, for example, augment embedded security functions by forwarding selected packets to a remote Intrusion Detection System (IDS). <CIT> discusses an apparatus capable of performing, without the apparatus being isolated from a network, automatic switching to a previous network interface if there is an error in setting set values for a different network interface to which the previous network interface has been switched. When set values for a first network interface, which can be used in the apparatus, have been changed and then processing to establish connection to a network using the first network interface as active network interface in the apparatus has failed, the active network interface is switched to a second network interface which can be used in the apparatus.

The invention is defined in the appended independent claims. Preferred embodiments of the invention are defined in the appended dependent claims.

The present application is directed to a method for capturing and providing information relating to communications according to claim <NUM>, to a communication system according to claim <NUM> and to a computer readable medium according to claim <NUM>.

User equipment (UE) devices, e.g., cell phones, laptops, etc. can connect through a wireless access point or a wired access point to the Internet or another network using one or a variety of network interfaces. For example, an UE device may connect to the Internet via a wireless interface such as a WiFi (<NUM>) interface, a Long Term Evolution (L TE) interface, a Bluetooth interface, or another wireless interface. In addition or alternatively the UE device may connect to the Internet via a wired interface such as an Ethernet interface. In fact, a UE device may support connectivity through multiple interfaces and may switch between interfaces. Thus a UE device may connect to the Internet and communicate with a device on the Internet, e.g., as part of a communications session or other communication, in a variety of ways.

Devices, particularly multi-mode devices, may have conflicting settings and/or configuration issues which interfere with achieving Internet connectivity particularly when attempting to connect to a new access point, e.g., wireless access point which is detected by the UE device as it moves through an area, e.g., a coverage area corresponding to the wireless access point.

In order to achieve Internet connectivity a UE device often has to first establish a radio connection with an access point, successfully complete one or more authentication, authorization and/or accounting operations, successfully interact with a Dynamic Host Configuration Protocol (DHCP) server and then successfully use a Domain Name System (DNS) server before being able to successfully establish contact and/or obtain information from a web server or other device on the Internet. A failure at any of the various steps required to achieve successful Internet access can interfere with a user's experience and ability to communicate or interact with devices on the Internet.

In accordance with various features of the invention, a network monitoring node sends configuration information, e.g., instructions in the form of monitoring commands, indicating one or more faults an access point is to monitor for and on which interface or interfaces the monitoring is to be performed.

The access point may buffer packets received on the interface on which it is configured to monitor, e.g., on a per device basis, for one or more faults that may prevent a UE device from successfully accessing the Internet or another network via the access point performing the monitoring. The packets may be packets used to communicate messages and/or information as part of a connection establishment processes or one or more of the operations used to establish Internet connectivity.

In response to detecting a fault corresponding to a device the access point may send a fault notification to a network monitoring node device along with the buffered packets which were received from or sent to the device prior to detection of the fault. Thus by buffering packets before a fault is reported or detected by a user or the access point, a network node may be made aware of faults which prevent or interfere with a device connecting to the Internet or another network before the user of the device reports a fault and/or otherwise attempts to receive assistance with regard to a problem.

Buffered packets corresponding to a device may be deleted upon successful achievement of network connectivity such as successful Internet access which may be indicated by a successful DNS lookup operation used to obtain an address used to connect to another device on the Internet. While an access point may be configured to buffer packets to facilitate fault analysis up until Internet access is achieved, the network monitoring node may configure the access point to buffer packets received or sent to a device up until a different point such as completion of an Authentication, Authorization and Accounting (AAA) operation, successful DHCP server access, or successful radio connection establishment.

The monitoring at an access point can be configured on different types of interfaces to monitor for the same or different faults. The faults may be of varying types which interfere with establish of network connectivity but may not, in some cases, interfere with communications, e.g., radio link communications, between the access point and wireless terminal, such as packet errors which can be corrected in many cases through the use of error correcting codes prior to storage of the packet in the packet buffer. The fault monitoring can be customized to take into consideration the type of interface which will be monitored. By allowing the same network device to configure access points of different types and/or different types of interfaces at an access point, a centralized level of fault detection across access points of different types and/or communications technologies can be achieved. Furthermore, since the monitoring can be performed from a remote location it can be performed by an entity other than the owner of the access point. This avoids the need for the access point owner to have an understanding of networking issues and/or the overall network topology which the network monitoring node may take into consideration when attempting to diagnose the reasons for various failures that are reported.

Packets which are buffered prior to successful Internet or network connectivity being achieved are normally deleted for individual devices upon achieving successful network connectivity, e.g., Internet access. However, in some embodiments the network node used for configuring monitoring and to which packets are forwarded in the event of a detected fault may also control monitoring of specific wireless terminals that are able to achieve Internet connectivity but may be providing a customer with problems staying connected and/or which tends to switch between access points excessively.

The network monitoring node can instruct multiple access points to monitor and forward packets corresponding to a specific identified UE device irrespective of detection of a fault condition. As the UE device moves throughout a network or networks the access points capture and forward packets communicated from or to the UE device and also report connectivity information, e.g., when and how long the UE device was connected to the access point reporting the information. By having access points of different types capture and forward packets corresponding to a UE device along with connectivity information, the network monitoring node is provided with connectivity information over a period of time from one or more different types of network connections and/or access points used by a UE device. From this information patterns of problems can be identified facilitating setting or other configuration issues which may result in excessive handoffs which do not preclude establishment of a connection to the Internet but which may degrade service by excessive handoffs or may result in excessive use of one interface, e.g., WiFi, over another interface e.g., LTE in an undesirable manner.

<FIG> is a drawing of an exemplary system <NUM> implemented in accordance with an exemplary embodiment. Exemplary system <NUM> includes a plurality of devices including a management entity <NUM>, a Dynamic Host Configuration Protocol (DHCP) server <NUM>, a Domain Name System (DNS) sever <NUM>, an Authentication, Authorization and Accounting (AAA) system including multiple AAA servers <NUM>,. , <NUM>, a Mobility Management Entity (MME) <NUM> which may be an LTE MME or another entity for maintaining User Equipment (UE) device information and managing device mobility and a network storage device <NUM> which are coupled together by network connections <NUM> and/or directly to the Internet <NUM> or other networks.

Connected to the communications network <NUM>, e.g., Internet, are customer premises (customer premise <NUM><NUM>,. , customer premise Y <NUM>') and wireless base stations (wireless base station <NUM><NUM>,. , wireless base station M <NUM>'). The customer premises (customer premise <NUM><NUM>,. , customer premise Y <NUM>'), in some embodiments, each include a gateway device <NUM> that operates as an Internet access point. In the <FIG> example the gateway <NUM> device includes a network interface, e.g., cable, FIOS or DSL interface which provides a wired (where wire could include an optical fiber wire) connection to the Internet <NUM>. Included in the gateway <NUM> is an Ethernet switch and/or router <NUM> and a WiFi and/or Bluetooth wireless access point <NUM> which can communicate via the network interface <NUM> with the Internet. The Ethernet switch/router <NUM> operates as a wired access point through which devices, e.g., UE device H1 <NUM>,. , UE device HZ <NUM>, can connect via a wired Ethernet, e.g., wired Ethernet <NUM>, to the Internet while wireless access point <NUM> acts as a wireless access point. While the access points (<NUM>, <NUM>) shown as part of gateway device <NUM>, the customer premise <NUM> may include Ethernet switches/routers <NUM> or WiFi access points <NUM> which are connected directly to the Internet <NUM> by an interface. Thus the example of the access points <NUM>, <NUM> being part of a gateway <NUM> is exemplary and not in any way critical to the invention.

UE devices ( UE device H1 <NUM>,. , UE device HN <NUM>), located at customer premise <NUM>, upon successful attachment to one of the access points <NUM> or <NUM> or UE devices (UE device <NUM><NUM>, e.g., mobile node <NUM>,. , UE device N <NUM>', e.g., mobile node N) upon successful wireless connection to an access point <NUM>,. , <NUM>', can interact with the AAA system <NUM> to be authorized for Internet service, access the DHCP server <NUM> to obtain the address of the DNS server <NUM> and/or other information that can be used to access the Internet, and can use the DNS server <NUM> to resolve a URL to an IP address allowing for successful communication with a device to which the IP address corresponds. As should be appreciated failure to achieve successful attachment to an access point <NUM>, <NUM>, <NUM> or <NUM>' or an inability to obtain service or information from the AAA system <NUM>, DHCP server <NUM> or DNS sever <NUM> may interfere with successful use of the Internet by a UE device, e.g., UE <NUM>, <NUM>, <NUM> or <NUM>'.

The devices coupled to network <NUM> can communicate with other devices via the network or Internet <NUM>. The management entity <NUM> is a network node that can communicate with base stations <NUM>, <NUM>' and devices at customer premises <NUM>, <NUM>' including gateway device <NUM> and the access points <NUM> and <NUM> included therein via the Internet <NUM>. Thus the management entity <NUM>, which can be viewed as a backend entity since it is not located at the customer premises or base stations, can and in accordance with some embodiments does, send control and configuration information to a wide variety of access points of different types. According to the invention the management entity <NUM> is a network monitoring node. While shown as a single node in <FIG>, the management entity's functionality can be, and is, implemented in a distributed manner in some embodiments. It should be appreciated that the management entity <NUM> may be a different entity than one used for normal telephony call set up and may not be in the call set up or signaling path of VoIP calls or other Internet based communications sessions. Thus, the management entity <NUM>, in some embodiments, is not in a position to snoop or directly monitor session setup or control signaling which may be exchanged between communication end points, between the DHCP server <NUM> and a UE device, between the DNS server <NUM> and a UE device or the AAA system <NUM> and a UE or base station. However, the access points to which a UE device attaches are normally in the data and control paths of such communications.

Communication between devices coupled to access points, such as wireless base stations <NUM>, <NUM>' and/or gateway device <NUM> can occur once successful Internet access has been achieved. Such Internet access may fail for any of a number of reasons which are not directly observable to the management entity <NUM> responsible for collecting network fault information and packets which might be useful in detecting and/or determining the cause of faults interfering with communication, e.g., over a communications network such as the Internet <NUM>.

Thus, via communications network <NUM>, e.g., the Internet, the management entity <NUM> can send configuration instructions to the wireless access points, e.g., base stations <NUM>, <NUM>' which may use licensed and/or unlicensed spectrum and can also communicate with wired or wireless access points at various customer premises. In addition the management entity <NUM>, which as discussed below includes a processor, memory and a network interface, can receive fault notification messages reporting detected faults or failures as well as buffered packets associated with the detected failure. The packets may have been collected by an access point prior to detection of the failure, also sometimes referred to as a fault, and provided with the fault notification message to the management entity. The management entity <NUM> can configure access points of varying types and thus can receive failure messages from a device trying to connect via different networks and/or interfaces. This can be particularly useful in diagnosing network problems with multi-mode devices which can switch between using networks of different types, e.g., LTE, WiFi, Bluetooth, etc..

The management entity can run what may be referred to as backend cloud software that controls one or more of the access points <NUM>, <NUM>, <NUM>, <NUM>' to capture packets prior to, e.g., leading to, a failure, dynamically monitor for connectivity failures and to report detected failures along with the packets leading to the failure of a device to connect to the Internet or access point. The packet capture can be on one, some or all data interfaces of an access point under the direction of the management entity <NUM> which can instruct an access point to perform packet buffing and communications failure monitoring on one or more interfaces. Access point interfaces which can be configured by the management entity <NUM> include Ethernet interfaces, e.g. Ethernet Interface <NUM> included in Ethernet switch router <NUM>, and Radio interfaces, e.g., e.g., WiFi interface <NUM>, e.g., an <NUM> interface, Bluetooth interface <NUM>, and Bluetooth Low Energy (BLE) interface <NUM>, included in wireless access point126. Each interface (<NUM>, <NUM>, <NUM>, <NUM>) includes a receiver and a transmitter. As part of the packet capture process, the access point performing the monitoring and packet capture may create a packet capture file that includes metadata associated with the packet data corresponding to a device for which a failure is detected or for which the access point has been configured to capture and forward packets even in the absence of a detected failure. For example, for <NUM> packets metadata which is also captured and stored includes, in some embodiments, a radiotap header with <NUM> metadata such as signal strength, packet rate, receive status and transmit status.

The management entity <NUM> can control and configure the access points to capture multiple dimensions of information as part of the packet capture process in the access point.

For example, the management entity can configure one or more access points or specific access points to monitor and collect information and/or set various collection related settings. The management entity <NUM> can do one, more or all of the following:.

The management entity <NUM> can be configured to disseminate packet capture configuration, e.g. control, information used to control packet capture operations at one or more access points, and characteristics across devices, e.g., access points, on a Service Set Identifier (SSID) basis, site basis or other basis.

When an access point receive packet capture related configuration information, it configures its interfaces, depending on the configuration information, to perform one or more of the following capture and/or packet upload related operations:.

The management entity <NUM>, in some but not necessarily all embodiments, responds to a failure notification by taking one, more or all of the following actions for each failure event:.

The management entity <NUM> allows for varying amounts of packet buffering, fault detection and reporting depending on individual customer's needs and/or network requirements.

The management entity has levels of access point configuration control which enables customers who do not want to use packet capture and reporting for all failures by default and only want to turn failure detection and monitoring on dynamically on a per device or limited failure condition checking basis once the network detects or a user reports one or more failure conditions. For example, pre-fault packet capture may be automatically or manually enabled when a device, e.g., one of the AAA servers <NUM> or <NUM> or DHCP server <NUM>, in the communications network <NUM> detects that a particular client device <NUM>, <NUM>, <NUM>, or <NUM>' is failing Authentication or DHCP. In such a case there may be a high probability that if a particular client fails once, it is likely to fail again, and it would be useful to have packet buffering and reporting of a failure automatically enabled for the device in the future.

In some embodiments, upon detection for a failure for a particular client, the management entity <NUM> automatically enables packet capture during connection setup for the given client device in multiple, e.g., all, the access points <NUM>, <NUM>', <NUM>, <NUM> in the network regardless of the type of interface the access point supports. In some embodiments the management entity <NUM> monitors how much packet data it has received for a particular UE device and/or fault notifications and when the management entity <NUM> has enough failures logged and/or packet capture data to analyze and determine the cause of failure, the management entity communicates to the access points that the access points should stop packet capture for the client device which encountered the fault thereby dynamically stopping the packet capture corresponding to the device which encountered the fault.

In some embodiments when the management entity <NUM> detects that multiple clients are failing connectivity on a given SSID or access point (AP). If the anomaly is detected for a given SSID, in some embodiments the management entity <NUM> enables, e.g., configures the access points, to perform packet capture for new, e.g., all new, client devices, e.g., UEs, using the SSID for which a failure or anomaly was detected or, optionally for just the given device on which failure was detected. Upon collection of enough failure samples, the management entity <NUM> stops the packet capture and reporting relating to the SSID or device to which a detected failure corresponds.

The described methods and apparatus provide a scalable solution for dynamic packet captures in an automatic manner, e.g., without human intervention, and hence enable smart network automation. Furthermore, the cause of the fault and be identified and new access point or UE configuration information automatically disseminated to correct the configuration problem causing the fault and to avoid the recurrence of such faults in the future.

<FIG> is a drawing of an exemplary network monitoring node <NUM> in accordance with an exemplary embodiment. In some embodiments, network node <NUM> of <FIG> is management entity <NUM> of system <NUM> of <FIG>. Network management node <NUM> includes a communications interface <NUM>, e.g., an Ethernet interface <NUM>, a processor <NUM>, an output device <NUM>, e.g., display, printer, etc., an input device <NUM>, e.g., keyboard, keypad, touch screen, mouse, etc., a memory <NUM> and an assembly of modules <NUM>, e.g., assembly of hardware module, e.g., assembly of circuits, coupled together via a bus <NUM> over which the various elements may interchange data and information. Communications interface <NUM> couples the network monitoring node <NUM> to a network and/or the Internet. Communications interface <NUM> includes a receiver <NUM> via which the network monitoring device can receive data and information, e.g., including failure notifications and forwarded captured packets from access points, and a transmitter <NUM>, via which the network monitoring device <NUM> can send data and information, e.g., including configuration information, monitoring commands, notification commands and packet capture instructions to access points.

Memory <NUM> includes routines <NUM> and data/information <NUM>. Routines <NUM> includes assembly of modules <NUM>, e.g., an assembly of software modules. Data/information <NUM> includes generated monitoring commands <NUM>, generated notification commands <NUM>, generated packet capture instructions <NUM>, received failure notifications <NUM>, received forwarded captured packets <NUM>, and evaluation results <NUM>.

<FIG> is a drawing of an exemplary access point <NUM>, e.g., base station, in accordance with an exemplary embodiment. In some embodiments, base stations (base station <NUM><NUM>,. , <NUM>') of <FIG> are the same as access point <NUM> of <FIG>. In some embodiments, gateway device <NUM> of <FIG> is the same as access point <NUM> of <FIG>.

Access point <NUM> includes wired interfaces <NUM>, wireless interfaces <NUM>, a processor <NUM>, e.g., a CPU, a memory <NUM>, and an assembly of modules <NUM>, e.g., assembly of hardware module, e.g., assembly of circuits, coupled together via a bus <NUM> over which the various elements may interchange data and information. Wired interfaces <NUM> includes a 1st wired interface <NUM> including receiver <NUM> and transmitter <NUM> and a second wired interface <NUM> including receiver <NUM> and transmitter <NUM>. 1st wired interface couples the access point <NUM> to a network and/or the Internet. 2nd wired interface <NUM>, e.g., an Ethernet interface, couples the access point <NUM> to an Ethernet network. In one embodiment 1st wired interface <NUM> is network interface <NUM> of device <NUM> of <FIG>, and 2nd wired interface <NUM> is Ethernet interface <NUM> of device <NUM> of <FIG> Wireless interfaces <NUM> includes a BLE interface <NUM>, a WiFi interface <NUM>, e.g. <NUM> interface, a Bluetooth interface <NUM>, and a cellular interface <NUM>. BLE interface <NUM> includes receiver <NUM> coupled to receive antenna <NUM>, via which the access point may receive wireless signals from communications devices, e.g., wireless terminals, and transmitter <NUM> coupled to transmit antenna <NUM> via which the access point may transmit wireless signals to communications devices, e.g., wireless terminals. WiFi interface <NUM> includes receiver <NUM> coupled to receive antenna <NUM>, via which the access point may receive wireless signals from communications devices, e.g., wireless terminals, and transmitter <NUM> coupled to transmit antenna <NUM> via which the access point may transmit wireless signals to communications devices, e.g., wireless terminals. Bluetooth interface <NUM> includes receiver <NUM> coupled to receive antenna <NUM>, via which the access point may receive wireless signals from communications devices, e.g., wireless terminals, and transmitter <NUM> coupled to transmit antenna <NUM> via which the access point may transmit wireless signals to communications devices, e.g., wireless terminals. Cellular interface <NUM> includes receiver <NUM> coupled to receive antenna <NUM>, via which the access point may receive wireless signals from communications devices, e.g., wireless terminals, and transmitter <NUM> coupled to transmit antenna <NUM> via which the access point may transmit wireless signals to communications devices, e.g., wireless terminals. In some embodiments, the same antenna is used for one or more different wireless interfaces. In one embodiment, (BLE interface <NUM>, WiFi interface <NUM>, Bluetooth interface <NUM>) of access point <NUM> are the same as (BLE interface <NUM>, WiFi interface <NUM>, Bluetooth interface <NUM>), respectively, of gateway device <NUM> of <FIG>.

Memory <NUM> includes routines <NUM> and data/information <NUM>. Routines <NUM> includes assembly of modules <NUM>, e.g., an assembly of software modules, and Application Programming Interface (API) <NUM>. Data/information <NUM> includes configuration information <NUM>, packet capture files <NUM> and generated failure event notifications <NUM>.

<FIG>, comprising the combination of <FIG>, <FIG>, <FIG>, <FIG>, <FIG> and <FIG>, is a flowchart <NUM> of an exemplary method of capturing and providing information relating to communications, e.g., wireless communications, in accordance with an exemplary embodiment. Operation of the exemplary starts in step <NUM> and proceeds to step <NUM>. In step <NUM> a network monitoring mode is operated to communicate monitoring command information to one or more access points. For example, in one exemplary embodiment, the method of step <NUM> of <FIG> is performed by management entity <NUM> of system <NUM> of <FIG>, which is a network monitoring node implemented in accordance with network monitoring node <NUM> of <FIG>. In some embodiments, the access points are wireless access points. For example, the access points are access points <NUM>, <NUM>, <NUM>, <NUM>' of system <NUM> of <FIG> implemented in accordance with access point <NUM> of <FIG>. Step <NUM> includes steps <NUM> and <NUM>.

In step <NUM> the network monitoring node is operated to communicate at least a first monitoring command to configure a first access point to monitor to detect communications failures corresponding to communications devices using the first access point. In some embodiments, the first access point is a wireless access point, and the communications devices are wireless devices. For example, the first access point is one of access point <NUM>, access point <NUM>, and access point <NUM>', and the communications devices include one or more or all of UE H1 <NUM>,. , UE HA <NUM>, UE <NUM><NUM>,. , UE N <NUM>' of system <NUM> of <FIG>. In some embodiments, the first monitoring command is a command instructing the first access point to monitor to detect a specified communications failure corresponding to any communications device using the first access point. In some embodiments, the first monitoring command is a command instructing the first access point to monitor to detect a specified communications failure corresponding to a specific communications device which may use the first access point. In some embodiments, the first monitoring command is a command instructing the first access point to monitor for packets corresponding to a specific portion of a communications operation, e.g., post Internet connection, and a specific communications device. This approach allows for packet capture and reporting for specific communications devices, e.g., wireless terminals, and specific portions of a communications session even when errors have not been detected to facilitate detection of problems which when considered at the time were by themselves not clearly indicative of a problem or error but which when viewed over time may be indicative of an error with a particular portion of a communications session, e.g., a device may repeatedly drop connections on an interface and connect to another interface shortly after successful connection establishment because of errors or problems with the interface/communications like associated with the interface such as a time out setting being shorter than appropriate.

In step <NUM> the network monitoring node is operated to communicate at least a first monitoring command to configure an Nth access point to monitor to detect communications failures corresponding to communications devices using the Nth access point. Operation proceeds from step <NUM> to step <NUM>.

In step <NUM> access points are operated to receive monitoring command information. Step <NUM> includes step <NUM> and step <NUM>. In step <NUM> the first access point is operated to receive configuration information from the network monitoring node, said configuration information indicating communications failures said first access point is to monitor to detect, e.g., on a per access point interface basis. The first access point includes multiple different interfaces and the information from the network monitoring mode indicating communications failures that said first access point is to monitor for is provided on a per access point interface basis. For example the multiple different interfaces include two different wireless interfaces. Exemplary different wireless interfaces include a cellular wireless interface, a WiFi wireless interface, e.g., an <NUM> interface, a Bluetooth wireless interface, and a BLE wireless interface. The information indicating communications failures said first access point is to monitor may include one or more of: association failures, authentication failures, authorization failures, and DNS lookup failures. Step <NUM> includes one or more or all of steps <NUM>, <NUM>, <NUM> and <NUM>. In step <NUM> the first access point receives information indicating that the first access point is to monitor for association failures. In step <NUM> the first access point receives information indicating that the first access point is to monitor for authorization failures. In step <NUM> the first access point receives information indicating that the first access point is to monitor for dynamic host configuration protocol (DHCP) failures. In step <NUM> the first access point receives information indicating that the first access point is to monitor for domain name system (DNS) lookup failures. In step <NUM> the Nth access point is operated to receive configuration information from the network monitoring node, said configuration information indicating communications failures said Nth point is to monitor to detect, e.g., on a per access point interface basis. Operation proceeds from step <NUM> to step <NUM>.

In step <NUM> the network monitoring node is operated to communicate failure notification command information to one or more access points. Step <NUM> includes steps <NUM> and <NUM>. In step <NUM> the network monitoring node is operated to communicate at least a first notification command to configure the first access point to notify the network monitoring node of a detected failure. In step <NUM> the network monitoring node is operated to communicate at least a first notification command to configure the Nth access point to notify the network monitoring node of a detected failure. Operation proceeds from step <NUM> to step <NUM>.

In step <NUM>, the access point(s) are operated to receive failure notification command information. Step <NUM> includes steps <NUM> and <NUM>. In step <NUM> the first access node is operated to receive from the network monitoring node one or more notification commands including said first notification command, e.g., the notification command(s) sent in step <NUM>. In step <NUM> the Nth node is operated to receive from the network monitoring node one or more notification commands including said first notification command, e.g., the notification command(s) sent in step <NUM>. Operation proceeds from step <NUM>, via connecting node A <NUM> to step <NUM>.

In step <NUM> the network monitoring node is operated to communicate pack capture instruction information to one or more access points. Step <NUM> includes steps <NUM>, <NUM>, <NUM> and <NUM>. In step <NUM> the network monitoring node is operated to communicate packet capture instruction to the first access point to configure said first access point to capture and buffer packets corresponding to communications devices using said first access point. In step <NUM> the network monitoring node is operated to communicate packet capture instruction to the Nth access point to configure said Nth access point to capture and buffer packets corresponding to communications devices using said Nth access point. In step <NUM> the network monitoring node is operated to communicate packet capture instruction for a second communications device to multiple access points. In some embodiments, said packet capture instructions include instructions to capture packets corresponding to the second communications device on any interface on which said second communications device communicates with an access point. In some such embodiments, said packet capture instructions include instructions to forward captured packets corresponding to the second communications device even in the absence of detection of a communications failure corresponding to the second communications device. In some embodiments, said packet capture instructions include instructions to capture and forward packets corresponding to an indicated portion of a communications activity by the second communications device. In some embodiments, said packet capture instructions include instructions to forward captured packets corresponding to the second communications device which are captured after the second communications device has achieved successful Internet connectivity. In some such embodiments, said packet capture instructions include instructions to forward captured packets corresponding to the second communications device which are captured after the second communications device has achieved successful Internet connectivity but not before that point. In some embodiments, the packet capture instructions include instructions to capture packets corresponding to the second communications device on a specified set of interfaces on which said second communications device may communicates with an access point, said specified set being less than the full set of interfaces which may be used by the second communications device to communicate with an access point. In some embodiments, the packet capture instructions include an instruction identifying a set of interfaces, e.g., a set of interfaces which is a subset of the full set of available interfaces that may be used by the second communications device, and identifying one or more selected portions of communication activity for which packets are to be captured and forwarded to the network monitoring mode irrespective of failure status. In some such embodiments, said one or more selected portions of communications activity are less than a full set of possible portions of communications activity.

In step <NUM> the network monitoring node is operated to communicate packet capture instruction for an Xth communications device to multiple access points. Operation proceeds from step <NUM> to step <NUM>.

In step <NUM> one or more access points are operated to receive packet capture instruction information. Step <NUM> includes steps <NUM> and <NUM>. In step <NUM> the first access point is operated, according to the invention, to receive packet capture instruction information. In step <NUM> the Nth access point is operated to receive packet capture instruction information. Step <NUM> includes one or more or all of steps <NUM>, <NUM>, <NUM>, <NUM>, <NUM> and <NUM>.

In step <NUM> the first access point is operated to receive, from the network monitoring node, information indicating a number of broadcast and multicast packets corresponding to a communications device to capture during an attempt by the communications device to achieve network connectivity. In step <NUM> the first access point is operated to receive from the network monitoring node information indicating a total number of packets and an indicator of the length of packets to be captured and buffered for each communications device using the first access point. In step <NUM> the first access point is operated to receive, from the network monitoring node, a command used to enable of disable packet capture at the first access point. In step <NUM> the first access point is operated to receive an instruction to capture packets for an identified communications device on multiple different interfaces. In step <NUM> the first access point is operated to receive, from the network monitoring node, a packet capture instruction for said second communications device, said instruction being directed to multiple access points including the first access point. In step <NUM> the first access point is operate to receive, from the network monitoring node, packet capture instruction for said Xth communications device, said instruction being directed to multiple access points including the first access point.

Operation proceeds from step <NUM>, via connecting node B <NUM>, to steps <NUM> and <NUM>.

In step <NUM> the first access point is configured to forward, according to the invention, captured packets. corresponding to one or more identified communication devices, to the network monitoring node irrespective of whether or not a communications failure corresponding to an identified communications device is detected. For example, in step <NUM> the first access point configures itself to forward captured packets corresponding to identified devices, which are identified in the instruction received in step <NUM>, irrespective of whether or not a communications failure corresponding to the identified device was detected. Operation proceeds from step <NUM> to step <NUM>.

In step <NUM> the first access point is configured to forward, according to the invention, captured packets. corresponding to communications devices for which communications failures are detected, without forwarding captured packets, corresponding to communications devices for which communications failures are not detected and which are not identified communications devices for which packets are to be forwarded irrespective of failure status. Operation proceeds from step <NUM>, via connecting node C <NUM> to step <NUM>.

In step <NUM> the first access point is operated to capture packets corresponding to communications devices using said first access point. Operation proceeds from step <NUM> to step <NUM>. In step <NUM> the first access point stores the captured packets in a buffer, e.g., a buffer in memory in the first access point. Operation proceeds from step <NUM> to the input of step <NUM>, and to steps <NUM> and <NUM>.

In step <NUM> the first access point is operated to monitor to detect communications failures corresponding to said communications devices using said first access point. Operation proceeds from step <NUM> to step <NUM>. In step <NUM> the first access point determines if a communications failure has been detected and controls operation as a function of the determination. If a failure has been detected, then operation proceeds from step <NUM> to step <NUM>. In step <NUM>, in response to detecting a communications failure corresponding to a communications device using said first access point, e.g., a first communication device, the first access point generates at the first access point an event failure notification indicating the type of detected failure. Operation proceeds from step <NUM> to step <NUM>. In step <NUM> the first access point sends from the first access point to the network monitoring node the generated event failure notification. Operation proceeds from step <NUM> to step <NUM>. In step <NUM> the first access point forwards captured packets, corresponding to the communications device to which the detected failure corresponds, e.g., the first communications device, to said network monitoring node. Operation proceeds from step <NUM>, via connecting node E <NUM> to step <NUM>.

Returning to step <NUM>, if a failure has not been detected, then operation proceeds from step <NUM> to step <NUM>. In step <NUM> the first access point checks and determines if a packet buffering stop criteria for potential failure has been reached for a communications device, e.g., has Internet access been achieved for the communications device. If the determination of step <NUM> is that the packet buffering stop criteria has been reached, then operation proceeds from step <NUM> to step <NUM>. In step <NUM> the first access point deletes stored packets corresponding to the communications device which were stored prior to the packet buffering stop criteria being reached. In some embodiments, step <NUM> includes step <NUM> in which the first access point, upon successful completion of a DNS lookup by a communications device, deletes stored packets corresponding to the communications device which were stored prior to the DNS lookup.

Returning to step <NUM>, in step <NUM> the first access point is operated to monitor to detect packets corresponding to identified communications device(s) for which packets are to be forwarded irrespective of failure detection. Operation proceeds from step <NUM> to step <NUM>. In step <NUM>, if a packet corresponding to an identified device for which the first access point is to forward packets irrespective of failure criteria, is detected, then operation proceeds from step <NUM> to step <NUM> in which the first access point is operated to forward captured packets corresponding to the identified communications device to the network monitoring node irrespective of whether or not a communication failure corresponding to the identified communications device is detected. Operation proceeds from step <NUM>, via connecting node E <NUM> to step <NUM>.

In some embodiments, the identified communications device, e.g., a wireless terminal, is a multi-mode communications device, and a communications failure on a first interface, e.g., a first wireless interface, causes the identified communications device, to switch to a second interface, e.g., a second wireless interface. In some such embodiments, the first and second interfaces are different type of wireless interfaces. In some such embodiments, the first interface is one of: a WiFi interface, a Bluetooth interface, a BLE interface and a cellular interface, and the second interface is a different one of: a WiFi interface, a Bluetooth interface, a BLE interface and a cellular interface.

Returning to step <NUM>, in step <NUM> the Nth access point is configured to forward captured packets, corresponding to one or more identified communication devices, to the network monitoring node irrespective of whether or not a communications failure corresponding to an identified communications device is detected. Operation proceeds from step <NUM> to step <NUM>.

In step <NUM> the Nth access point is configured to forward captured packets, corresponding to communications devices for which communications failures are detected, without forwarding captured packets, corresponding to communications devices for which communications failures are not detected and which are not identified communications devices for which packets are to be forwarded irrespective of failure status. Operation proceeds from step <NUM>, via connecting node D <NUM> to step <NUM>.

In step <NUM> the Nth access point is operated to capture packets corresponding to communications devices using said Nth access point. Operation proceeds from step <NUM> to step <NUM>. In step <NUM> the Nth access point stores the captured packets in a buffer, e.g., a buffer in memory in the Nth access point. Operation proceeds from step <NUM> to the input of step <NUM>, and to steps <NUM> and <NUM>.

In step <NUM> the Nth access point is operated to monitor to detect communications failures corresponding to said communications devices using said Nth access point. Operation proceeds from step <NUM> to step <NUM>. In step <NUM> the Nth access point determines if a communications failure has been detected and controls operation as a function of the determination. If a failure has been detected, then operation proceeds from step <NUM> to step <NUM>. In step <NUM>, in response to detecting a communication failure corresponding to a communications device using said Nth access point, the Nth access point generates at the Nth access point an event failure notification indicating the type of detected failure. Operation proceeds from step <NUM> to step <NUM>. In step <NUM> the Nth access point sends from the Nth access point to the network monitoring node the generated event failure notification. Operation proceeds from step <NUM> to step <NUM>. In step <NUM> the Nth access point forwards captured packets, corresponding to the communications device to which the detected failure corresponds to said network monitoring node. Operation proceeds from step <NUM>, via connecting node E <NUM> to step <NUM>.

Returning to step <NUM>, if a failure has not been detected, then operation proceeds from step <NUM> to step <NUM>. In step <NUM> the Nth access point checks and determines if a packet buffering stop criteria for potential failure has been reached for a communications device, e.g., has Internet access been achieved for the communications device. If the determination of step <NUM> is that the packet buffering stop criteria has been reached, then operation proceeds from step <NUM> to step <NUM>. In step <NUM> the Nth access point deletes stored packets corresponding to the communications device which were stored prior to the packet buffering stop criteria being reached. In some embodiments, step <NUM> includes step <NUM> in which the Nth access point, upon successful completion of a DNS lookup by a communications device, deletes stored packets corresponding to the communications device which were stored prior to the DNS lookup.

Returning to step <NUM>, in step <NUM> the Nth access point is operated to monitor to detect packets corresponding to identified communications device(s) for which packets are to be forwarded irrespective of failure detection. Operation proceeds from step <NUM> to step <NUM>. In step <NUM>, if a packet corresponding to an identified device for which the Nth access point is to forward packets irrespective of failure criteria, is detected, then operation proceeds from step <NUM> to step <NUM> in which the Nth access point is operated to forward the captured packets corresponding to the identified communications device to the network monitoring node irrespective of whether or not a communication failure corresponding to the identified device has been detected. Operation proceeds from step <NUM>, via connecting node E <NUM> to step <NUM>.

In step <NUM> the network monitoring node is operated to receive failure notifications, captured packets corresponding to the detected failures and/or captured packets corresponding to identified communications devices. Operation proceeds from step <NUM> to step <NUM>.

In step <NUM> the network monitoring node is operated to analyze the received failure notifications, captured packets corresponding to detected failures and/or captured packets corresponding to identified communications devices. Step <NUM> includes one or more of all of steps <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>. In step <NUM> the network monitoring node detects, e.g., dynamically detects, that a DHCP server is misconfigured. In step <NUM> the network monitoring node detects, e.g. dynamically detects, that a large number, e.g., a number over a predetermined threshold, of authentication failures are driven by timeouts during hand shakes, e.g., as a result of poor cover, failure, and/or retries, e.g., via analysis of dynamically captured packets. In step <NUM> the network monitoring node detects, e.g., dynamically detects, that authentication failures or DHCP failures are related to WLAN / SSID configuration, e.g., a bad WLAN or a bad server IP. In step <NUM> the network monitoring node detects, e.g., dynamically detects, that failures are correlated to a single device while other devices are working properly. In step <NUM> the network monitoring node detects, e.g., dynamically detects, that failures are correlated to a single WLAN while other WLANs are working properly. In step <NUM> the network monitoring node detects anomalies based on analysis of stored packet capture over a long time period, e.g., hours or days. Operation proceeds from step <NUM> to step <NUM>. In step <NUM> the network monitoring node is operated to take corrective action in response to the analysis of step <NUM>. Step <NUM> includes one or more or all of steps <NUM>, <NUM>, <NUM>, <NUM>, <NUM> and <NUM>. In step <NUM> the network monitoring node sends a command and/or notifications to reconfigure the DHCP server, in response to the detection in step <NUM> of a misconfigured DHCP server. In step <NUM> the network monitoring node sends control message(s) to improve air link channel quality in response to the detection in step <NUM> that a large number of authentication failures are driven by timeouts during handshakes. For example, the network monitoring node uses radio management software to modify or control modification of TX power and/or channel to improve air link quality. In step <NUM> the network monitoring node sends an anomaly detection notification, e.g., including information identifying the suspect bad WLAN IP or suspect bad server IP, to the network administrator in response to detection in step <NUM> that authentication failures or DHCP failures are related to WLAN and/or SSID configuration. In step <NUM> the network monitoring node sends a command to reboot the detected device to which failures are correlated, in response to detect in step <NUM> that failures are correlated to a single device. In step <NUM> the network monitoring node sends a command to reboot an access point, corresponding to the WAN, to which failures are correlated, in response to the detection in step <NUM> that failures are correlated to a single WLAN. In some embodiments in step <NUM> the network monitoring node sends a command to reboot multiple access point, e.g., the set of multiple access points corresponding to the WAN, to which failures are correlated, in response to the detection in step <NUM> that failures are correlated to a single WLAN. In step <NUM> the network monitoring node sends a notification to the network administrator of the detected anomaly based on the long term packet capture analysis, in response to a detected anomaly in step <NUM>.

<FIG>, comprising the combination of <FIG> and <FIG>, is a drawing of an exemplary assembly of modules <NUM>, comprising Part A <NUM> and Part B <NUM>, in accordance with an exemplary embodiment. In some embodiments, assembly of modules <NUM> is included in a network monitoring node, e.g., network monitoring node <NUM> of <FIG> or management entity <NUM> of <FIG>, implemented in accordance with an exemplary embodiment.

The modules in the assembly of modules <NUM> can, and in some embodiments are, implemented fully in hardware within a processor, e.g., processor <NUM>, e.g., as individual circuits. The modules in the assembly of modules <NUM> can, and in some embodiments are, implemented fully in hardware within an assembly of modules external to the processor, e.g., as individual circuits corresponding to the different modules, e.g., assembly of modules <NUM>. In other embodiments some of the modules are implemented, e.g., as circuits, within the processor with other modules being implemented, e.g., as circuits within and assembly of modules, external to and coupled to the processor. As should be appreciated the level of integration of modules in the processor and/or with some modules being external to the processor may be one of design choice.

Alternatively, rather than being implemented as circuits, all or some of the modules may be implemented in software and stored in the memory of a device, with the modules controlling operation of device to implement the functions corresponding to the modules when the modules are executed by a processor. In some such embodiments, the assembly of modules <NUM> is included in a memory, e. g, assembly of modules <NUM> in memory <NUM>. In some such embodiments, the assembly of modules is included as part of the routines in memory. In still other embodiments, various modules in assembly of modules <NUM> are implemented as a combination of hardware and software, e.g., with another circuit external to the processor providing input to a processor which then under software control operates to perform a portion of a module's function. While shown in various embodiments as a single processor, e.g., computer, it should be appreciated that the processor may be implemented as one or more processors, e.g., computers.

When implemented in software the modules include code, which when executed by the processor, configure the processor to implement the function corresponding to the module. In embodiments where the assembly of modules <NUM> is stored in memory, the memory is a computer program product comprising a computer readable medium comprising code, e.g., individual code for each module, for causing at least one computer, e.g., a processor, to implement the functions to which the modules correspond.

Completely hardware based or completely software based modules may be used. However, it should be appreciated that any combination of software and hardware, e.g., circuit implemented modules may be used to implement the functions. As should be appreciated, the modules illustrated in <FIG> control and/or configure the device or elements therein such as a processor, to perform the functions of corresponding steps illustrated in a method, e.g., steps of the method of flowchart <NUM> of <FIG>.

Assembly of modules <NUM> includes a monitoring command generation module <NUM>, a monitoring command communication module <NUM>, a failure notification command generation module <NUM>, a failure notification command communication module <NUM>, a first packet capture instruction generation module <NUM>, a first packet capture instruction communication module <NUM>, a second packet capture instruction generation module <NUM>, a second packet capture instruction communication module <NUM>, a failure notification message receive module <NUM>, a captured packet receive module <NUM>, an analysis module <NUM>, and a corrective action module <NUM>.

Monitoring command generation module <NUM> is configured to generate monitoring commands to configured access points to monitor to detect communications failures corresponding to communications devices using the access points. Monitoring command generation module <NUM> is configured to generate at least a first monitoring command to configure a first access point to monitor to detect communications failures corresponding to communications devices using said first access point. In some embodiments, a generated monitoring command commands an access point to monitor for one or more or all of: association failures, authorization failures, DHCP failures, and DNS lookup failures. Monitoring command generation module <NUM> is configured to generate at least a first monitoring command to configure an Nth access point to monitor to detect communications failures corresponding to communications devices using said Nth access point.

Monitoring command communication module <NUM> is configured to communicate a generated monitoring command to an access point. For example, monitoring command communication module <NUM> is configured to communicate at least a first monitoring command to configure a first access point to monitor to detect communications failures corresponding to communications devices using the first access point.

In some embodiments, the first monitoring command is a command instructing the access point to monitor to detect a specified communications failure corresponding to any communication device using the access point. In some embodiments, the first monitoring command is a command instructing the access point to monitor to detect a specified communications failure corresponding to a specified communication device using the access point. In some embodiments, the first monitoring command is a command instructing the access point to monitor for packets corresponding to a specific portion of a communications operation.

Failure notification command generation module <NUM> is configured to generate notification commands to configure access points to notify the network monitoring mode of a detected failure. For example, failure notification command generation module <NUM> is configured to generate at least a first notification command to configure a first access point to notify the network monitoring node of a detected failure. Failure notification command communication module <NUM> is configured to communicate generated notification commands to configure access points to notify the network monitoring mode of detected failures. For example, failure notification command communication module <NUM> is configured to communicate at least a first notification command to configure the first access point to notify the network monitoring mode of a detected failure.

First packet capture instruction generation module <NUM> is configured to generate packet capture instructions for an access point to configure the access point to capture and buffer packets corresponding to communications devices using the access point. For example, first packet capture instruction generation module <NUM> is configured to generate instructions for a first access point to configure said first access point to capture and buffer packets corresponding to communications devices using said first access point.

First packet capture instruction communication module <NUM> is configured to communicate generated packet captured instructions to an access point. For example, first packet capture instruction communication module <NUM> is configured to communicate generated packet capture instruction to the first access point to configured the first access point to capture and buffer packets corresponding to communications devices using said first access point. In some embodiments, different access points may, and sometimes are sent different packet capture instructions. In various embodiments, the same access point may be, and sometimes, is send different packet capture instructions at different times, e.g., packet capture instructions are changed dynamically in response to changing events or conditions observed by the network monitoring mode.

Second packet capture instruction generation module <NUM> is configured to generate packet capture instructions for a particular communications device, said generated packet capture instructions to be sent to multiple access points. For example, second packet capture instruction generation module <NUM> is configured to generate packet capture instructions for a second communications device, said generated packet capture instructions for the second communications device to be sent to a first set of access point, said first set of access points including multiple access points. In some embodiments the packet capture instructions include instructions to capture packets corresponding to the second communications devices on any interface on which the second communications device communicates with an access point. In some embodiments the packet capture instructions include instructions to forward captured packets corresponding to the second communications device even in the absence of detection of a communications failure corresponding to the second communications device. In some embodiments the packet capture instructions include instructions to capture and forward captured packets corresponding to an indicated portion of a communications activity by the second communications device. In some embodiments the packet capture instructions include instructions to forward captured packets corresponding to the second communications device which are captured after the second communications device has achieved successful Internet connectivity, but not before that point in some embodiments.

As another example, second packet capture instruction generation module <NUM> is configured to generate packet capture instruction for an Xth communications device, said generated packet capture instructions for the Xth communications device to be sent to a second set of access point, said second set of access points including multiple access points. The second set of access point may be the same or different from the first set of access points.

Second packet capture instruction communication module <NUM> is configured to communicate generated packet captured instructions for a particular communications device to multiple access points. For example, second packet capture instruction communication module <NUM> is configured to communicate generated packet capture instruction for a second communications device to a first set of access points, said first set of access points including multiple access points. As another example, second packet capture instruction communication module <NUM> is configured to communicate generated packet capture instruction for an Xth communications device to a second set of access points, said second set of access points including multiple access points.

Failure notification message receive module <NUM> is configured to receive an event failure notification message from an access point, e.g., a first access point, which has detected a failure corresponding to a communications device, e.g., a first communications device, using said access point, said event failure notification message including information indicating the type of detected failure.

Buffered packet receive module <NUM> is configured to receive forwarded captured packets, corresponding to the communications device, e.g., the first communications device to which a detected failure corresponds, e.g., the detected failure reported in a corresponding received failure notification message. The forwarded captured packets have been sent by an access point, which detected the failure. Buffered packet receive module <NUM> is further configured to receive forwarded captured packets corresponding to an identified communication device, e.g., a second communications device, the packets have been sent irrespective of whether or not a failure was detected corresponding to the identified communications device, e.g., in accordance with previous instructions from the network monitoring node identifying the communications device and requesting that packets from the device be sent if detected.

Analysis module <NUM>, e.g., captured packet evaluation module, processes received event failure notification messages and corresponding forwarded captured packets, as well as received forwarded captured packets corresponding to identified communications devices to: detect failures, identify a type or a classification of a detected failure, detect anomalies, detect potential failures, determine failure sources, e.g., a particular node, a particular link, a particular device, a particular interface on a particular device, a particular WLAN, a device misconfiguration, a bad configuration, poor air link channel quality, and failure frequency, make replacement decisions, and/or make redundancy management decisions. Analysis module <NUM> includes a DHCP server misconfiguration detection module <NUM>, a timeout driven authentication failure detection module <NUM>, a configuration problem detection module <NUM>, a device failure detection module <NUM>, a WLAN failure detection module <NUM>, and an anomaly detection module <NUM>. DHCP server misconfiguration detection module <NUM> is configured to detect, e.g., dynamically detect, that a DHCP server is misconfigured. Timeout driven authentication failure detection module <NUM> is configured to detect, e.g., dynamically detect, that a large number, e.g., a number over a predetermined threshold, of authentication failures are driven by timeouts during hand shakes, e.g., as a result of poor coverage, failure and retries. Configuration problem detection module <NUM> is configured to detect, e.g., dynamically detect, that authentication failures or DHCP failures are related to WLAN and/or SSID configuration, e.g., a bad WLAN or bad server IP. Device failure detection module <NUM> is configured to detect, e.g., dynamically detect, that failures are correlated to a single device while other devices are working properly. WLAN failure detection module <NUM> is configured to detect, e.g., dynamically detect, that failures are correlated to a single WLAN while other WLANs are working properly. Anomaly detection module <NUM> is configured to detect anomalies based of analysis of stored packet capture over a long time period, e.g., hours or days. In some embodiments, anomaly detection module <NUM> detects subtle and/or intermittent failures based on long term analysis of captured packets and, in some embodiments, detected statistical changes, e.g., degradation, trending, etc., of one or more performance metrics corresponding to a device, node, network, or interface.

Corrective action module <NUM> is configured to take corrective actions in response to the determination of the analysis module <NUM>, e.g., generate and send a notification, command and/or control message to implement a corrective action and improve performance in the communications network. Corrective action module <NUM> includes a DHCP reconfiguration module <NUM>, an air link channel quality control module <NUM>, a network administrator notification module <NUM>, a device reboot module <NUM>, a WLAN reboot module <NUM>, an a detected anomaly notification module <NUM>. DHCP reconfiguration module <NUM> is configured to generate and send a command and/or notification to reconfigure an identified DHCP server in response to a detection, e.g., by module <NUM>, that a particular DHCP server is miss-configured. Air link channel quality control module <NUM> is configured to generate and send control messages to improve air link channel quality in response to a detection, e.g., by module <NUM>, that a large number, e.g., over a predetermined threshold, of authentication failures are driven by timeouts during handshakes, e.g., as a result of poor coverage, failure and/or retries. In some embodiments, air link quality control module <NUM> uses radio management software to modify transmission power, e.g., of an access point and/or of a user equipment device, and/or modify an air link channel to improve air link quality. Network administrator notification module <NUM> is configured to generate and send an anomaly detection notification to a network administrator in response to detection, e.g., by module <NUM>, that authentication failures or DHCP failures are related to a WLAN and/or SSID configuration, e.g., there is a suspected bad WLAN or a suspected bad server IP. Device reboot module <NUM> is configured to generate and send a command to reboot a device to which failures are correlated in response to a detection, e.g., by module <NUM>, that failures are correlated to a single device while other devices are working properly. WLAN reboot module <NUM> is configured to generate and send a command to reboot an access point of a set of access points, corresponding to a WLAN to which failures are correlated, in response to detection, e.g., by module <NUM>, that failures are correlated to a single WLAN while other WLANs are working properly. Detected anomaly notification module <NUM> is configured to generate and send a notification to a network administrator of a detected anomaly based on long term, e.g., hours or days, packet capture analysis, in response of a detected anomaly, e.g., by module <NUM>, based on analysis of stored packet capture over a long time period. In some embodiments, corrective action module <NUM> generates and sends a command to shut down and/or replace a particular suspect device, e.g., a suspected faulty access point. In some embodiments, corrective action module <NUM> generates and sends a command to switch to a back up unit, e.g., a node may include a primary access point and a secondary, e.g., back-up access point. In some embodiments, corrective action module <NUM> generates and sends a command to control an access point to cease operation on a particular one of a plurality of alternative interfaces, e.g. shut down a WiFi interface, in the access point. In some embodiments, corrective action module <NUM> generates and sends a command instructing replacement of a portion of n node, e.g. replace a portion of an access point corresponding to a particular interface which is suspect, e.g., replace a Bluetooth circuit card in an access point including WiFi, Bluetooth and BLE interfaces.

<FIG>, comprising the combination of <FIG> and <FIG>, is a drawing <NUM>, comprising the combination of Part A <NUM> and Part B <NUM>, of an exemplary assembly of modules <NUM> in accordance with an exemplary embodiment. In some embodiments, assembly of modules <NUM> is included in an access point, e.g., a wireless access point, e.g., access point <NUM> of <FIG>, base station <NUM><NUM> of <FIG> or base station M <NUM>' of <FIG> or access point <NUM> of <FIG>, implemented in accordance with an exemplary embodiment.

The modules in the assembly of modules <NUM> can, and in some embodiments are, implemented fully in hardware within a processor, e.g., processor <NUM>, e.g., as individual circuits. The modules in the assembly of modules <NUM> can, and in some embodiments are, implemented fully in hardware within an assembly of modules, e.g., assembly of modules <NUM>, external to the processor, e.g., as individual circuits corresponding to the different modules. In other embodiments some of the modules are implemented, e.g., as circuits, within the processor with other modules being implemented, e.g., as circuits within and assembly of modules, external to and coupled to the processor. As should be appreciated the level of integration of modules in the processor and/or with some modules being external to the processor may be one of design choice.

Alternatively, rather than being implemented as circuits, all or some of the modules may be implemented in software and stored in the memory of a device, with the modules controlling operation of device to implement the functions corresponding to the modules when the modules are executed by a processor. In some such embodiments, the assembly of modules <NUM> is included in a memory, e.g., assembly of modules <NUM> in memory <NUM>. In some such embodiments, the assembly of modules is included as part of the routines in memory. In still other embodiments, various modules in assembly of modules <NUM> are implemented as a combination of hardware and software, e.g., with another circuit external to the processor providing input to a processor which then under software control operates to perform a portion of a module's function. While shown in various embodiments as a single processor, e.g., computer, it should be appreciated that the processor may be implemented as one or more processors, e.g., computers.

Assembly of modules <NUM> includes a monitoring command receive module <NUM>, a failure notification command receive module <NUM>, a first packet capture instruction receive module <NUM>, a second packet capture instruction receive module <NUM>, an identified communications device based packet forwarding configuration module <NUM>, a detected failure based packet forwarding configuration module <NUM>, a packet capture module <NUM>, a captured packet buffering module <NUM>, a communications failure monitoring module <NUM>, an identified device packet detection module <NUM>, an identified device packet forwarding module <NUM>, an event failure notification generation module <NUM>, an event failure notification communication module <NUM>, a detected failure packet forwarding module <NUM>, and a packet buffering stop determination module <NUM>.

Monitoring command receive module <NUM> is configured to operate the access point to receive configuration information from a network monitoring node indicating communications failures that the access point is to monitor to detect, e.g., on a per access point interface basis. Monitoring command receive module <NUM> includes an association failure monitoring command receive module <NUM> configured to receive information indicating that the first access point is to monitor for association failures, an authorization failure monitoring command receive module <NUM> configured to receive information indicating that the access point is to monitor for authorization failures, a DHCP failure monitoring command receive module <NUM> configured to received information indicating that the access point is to monitor for authorization failures, and a DSN lookup failure monitoring command receive module <NUM> configured to receive information indicating that the access point is to monitor for DNS lookup failures.

Failure notification command receive module <NUM> is configured to operate the access point to receive from a network monitoring node one or more notification commands including a least a first notification command, said first notification command being a command to configured the access point to notify the network monitoring node of a detected failure.

First packet capture instruction receive module <NUM> is configured to operate the access point to receive capture instruction information from the network monitoring node. First packet capture instruction receive module <NUM> includes a network connectivity attempt packet capture instruction receive module <NUM>, a packet number capture instruction receive module <NUM>, an enable/disable packet capture command receive module <NUM>, and an identified communications device packet capture instruction receive module <NUM>. Network connectivity attempt packet capture instruction receive module <NUM> is configured to operate the first access point to receive, from the network monitoring node, information indicating a number of broadcast and multicast packets correspond to a communications device to capture during an attempt by the communications device to achieve network connectivity. Packet number capture instruction receive module <NUM> is configured to operate the access point to receive, from the network monitoring device, information indicating a total number of packets and an indicator or the length of packets to be captured and buffered for each communications device using the access point. Enable/disable packet capture command receive module <NUM> is configured to operate the access point to receive, from the network monitoring node, a command used to enable or disable packet capture at the access point. Identified communications device packet capture instruction receive module <NUM> is configured to operate the access point to receive an instruction to capture packets for an identified communications device on multiple different interfaces.

Second packet capture instruction receive module <NUM> is configured to operate the access point to receive from the network monitoring node packet capture instruction for a particular communications device, e.g., a second communication device. In some such embodiment, said packet capture instruction for a particular communications device, which are received were directed to multiple access points. Second packet capture instruction receive module <NUM> includes a target device packet capture instruction receive module <NUM>. Target device packet capture instruction receive module <NUM> is configured to receive packet capture instruction corresponding to a particular communications device, e.g., a second communications device, being targeted by the network monitoring device, e.g., in response to suspected intermittent failure condition with the second communications device.

Identified communications device based packet forwarding configuration module <NUM> is configured to configured to the access point to forward captured packets corresponding to one or more identified communications devices, e.g., the second communications device, to the network monitoring node irrespective of whether or not a communications failure correspond to an identified communications device is detected. Detected failure based packet forwarding configuration module <NUM> is configured to configure the access point to forward captured packets corresponding to communications devices for which communications failures are detected without forwarding packets corresponding to communications devices for which communications failures are not detected and which are not identified communications device for which packets are to be forwarded to the network monitoring node irrespective of the failure status. Thus module <NUM> configures the access point to selectively forward captured packets based on failure detection, while module <NUM> configures the access point to selectively forward captured packed based on target device identification, e.g., with the network monitoring node having previously selected the target communications devices. In some embodiments, further condition are imposed by the network monitoring mode for the selective packet forwarding, e.g. during a particular phase of communications device operation which is of interest to the network monitoring node.

Packet capture module <NUM> is configured to operate the access point to capture packets corresponding to communications devices used the access point. Captured packet buffering module <NUM> is configured to store captured packets in a buffer, e.g., in memory in the access point.

Communications failure monitoring module <NUM> is configured to operate the access point to monitor to detect communications failures corresponding to communications devices using the access point. Communications failure monitoring module <NUM> includes an association failure detection module <NUM> configured to monitor for and detect association failures, an authorization failure detection module <NUM> configured to monitor for and detect authorization failures, a DHCP failure detection module <NUM> configured to monitor for and detect DHCP failures and a DNS lookup failure detection module <NUM> configured to monitor for and detect DNS lookup failures. In some embodiments, which ones of the modules <NUM>, <NUM>, <NUM> and <NUM> are used are a function of monitoring command information previously received from the network monitoring node, e.g., which is used to configure the access point.

Identified device packet detection module is configured to operate the access point to monitor to detect packets corresponding to one or more identified communications devices(s), e.g., a second communications device, for which packets are to be forwarded irrespective of failure detection. Identified device packet forwarding module <NUM> is configured to operate the access point to forward captured packets corresponding to an identified communications device to the network monitoring node irrespective of whether or not a failure corresponding to the identified communications device is detected.

Event failure notification generation module <NUM> is configured to generate at the access point, an event failure notification indicating the type of detected failure, said generating being in response to detecting a communications failure corresponding to a communications device, e.g., a first communications device, using said access point. In various embodiments, the format of the event failure notification is in accordance with information previously received in a notification command from the network monitoring node. In some embodiments, the type of failure is one of an: an association failure, an authorization failure, a DHCP failure and a DNS lookup failure. In some embodiments, the event notification information includes a failure log corresponding to the event, said failure log including information known to the access node which is useful to troubleshoot the failure. Event failure notification communication module <NUM> is configured to send from the first access point a generated event failure notification to the network monitoring node. Detected failure packet forwarding module <NUM> is configured to forward captured packets, corresponding to the device to which the detected communications failure corresponds, e.g., the first communications device, to the network monitoring mode. In some embodiments, detected failure packet forwarding module <NUM> forwards captured packets along with an event failure notification or included within an event failure notification.

Packet buffering stop determination module <NUM> determines if a packet buffering stop criteria for potential failure has been reached for a communications device, e.g., has Internet access been achieved, and controls operation as a function of the determination.

Stored packet deletion module <NUM> is configured to delete, in response to a packet buffering stop criteria being reached, stored captured packets corresponding to a communication device which were stored prior to the packet buffering stop criteria being reached. Stored packet deletion module <NUM> includes a successful DNS lookup based communication stored packet deletion module <NUM>. Successful DNS lookup based communication stored packet deletion module <NUM> is configured to delete, upon successful completion of a SNS lookup by a communications device, stored packets corresponding to the communications device which were stored prior to the SNS lookup.

Assembly of modules <NUM> further includes a corrective action message receive module <NUM>, a radio management module <NUM>, a backup control module, an interface deactivation module <NUM>, and a reboot module. Corrective action receive module <NUM> is configured to receive corrective action messages from a network monitoring node, e.g., corrective action messages notifying the access point of a detected problem, and/or commanding or controlling the access point to implement a corrective action, e.g., (i) shut down the access point for service, (ii) reboot the access point, (iii) shut down, e.g., deactivate, a particular interface, e.g., one of a plurality of alternative wireless interfaces supported by the access point, (iv) reboot a particular interface, (v) deny service to a particular user equipment device, (vi) switch to a backup unit, e.g., a redundant access point included in the device, backup interface, backup power supply, back-up receiver, back-up transmitter, or back-up antenna, (vii) perform commanded or suggested radio management operations to improve air link quality. Radio management module <NUM> is configured to implement radio management commands or instructions, e.g., changing a transmission power level of the access point or controlling a UE device using the access point to change its transmission power to improve air link channel quality, in response to received commands from a network monitoring node. Backup control module <NUM> is configured to switch to a backup device, e.g., a redundant circuit or interface, within the access point, in response to a command from the network monitoring node. Interface deactivation module <NUM> is configured to deactivate, e.g., shut down a particular wireless interface, e.g., shut down the BLE interface, within the access point, in response to a command from the network monitoring node. Reboot module <NUM> is configured to reboot the access point or reboot a portion of the access point, e.g., a particular identified wireless interface, in response to a received command from the network monitoring node.

<FIG> is a drawing of an exemplary communications device <NUM>, e.g., user equipment device such as a wireless terminal in accordance with an exemplary embodiment. Exemplary communications device <NUM> is, e.g., UE device <NUM><NUM>, UE N <NUM>, UE H1 <NUM>, or UE HZ <NUM> of system <NUM> of <FIG>. Communications device <NUM> includes a wired interface <NUM>, wireless interfaces <NUM>, a processor <NUM>, e.g., a CPU, a display <NUM>, an input device <NUM>, e.g., touchscreen, keypad, switches, etc., memory <NUM> and an assembly of modules <NUM>, e.g., assembly of hardware modules such as an assembly of circuits, coupled together via a bus <NUM> over which the various elements may interchange data and information. Memory <NUM> includes routines <NUM> including an assembly of modules <NUM>, e.g., an assembly of software modules, and data/information <NUM>. Wired interface <NUM>, e.g., an Ethernet interface, includes a receiver <NUM> and a transmitter <NUM>. Wireless interfaces <NUM> includes a cellular interface <NUM>, a WiFi interface <NUM>, e.g., an <NUM> interface, a Bluetooth interface <NUM>, and a BLE interface <NUM>. Cellular interface includes a cellular receiver <NUM> coupled to receive antenna <NUM> via which the communications device receives cellular signals. Cellular interface <NUM> includes a cellular transmitter <NUM> coupled to transmit antenna <NUM> via which the communications device <NUM> transmits cellular signals.

WIFI interface <NUM> includes a WIFI receiver <NUM>,e. , an <NUM> receiver, coupled to receive antenna <NUM> via which the communications device receives WIFI signals. WIFI interface <NUM> includes a WIFI transmitter <NUM> coupled to transmit antenna <NUM> via which the communications device <NUM> transmits WIFI signals.

Bluetooth interface <NUM> includes a Bluetooth receiver <NUM> coupled to receive antenna <NUM> via which the communications device receives Bluetooth signals. Bluetooth interface <NUM> includes a Bluetooth transmitter <NUM> coupled to transmit antenna <NUM> via which the communications device <NUM> transmits Bluetooth signals. BLE interface <NUM> includes a BLE receiver <NUM> coupled to receive antenna <NUM> via which the communications device receives BLE signals. BLE interface <NUM> includes a BLE transmitter <NUM> coupled to transmit antenna <NUM> via which the communications device <NUM> transmits BLE signals. In some embodiments, the same antenna is used for receiving and transmitting signals. In some embodiments, different antennas are used corresponding to at least some different wireless interfaces.

A system administrator can turn off the always on automatic packet capture and upload on detected failures functionality at one or more access points and then and then turn it on after an anomaly is detected or reported such as a certain protocol failure by one or more devices using the access point or access points.

Network management software, e.g., backend software, running on a management server performing analytics on one or more client events may detect that there is a cluster of DHCP failures on a particular subnet of the network. The server then enables the dynamic packet capture functionality on the access points for the given subnet where DHCP failures were detected and, collects and analyzes the packets. After packet collection and/or analysis the server signals the access points to turn off auto capture of packets.

In other cases a system administrator may have a set of configured dynamic packet capture options set, e.g., with packets to be captured and forwarded in the event of one or more detected failure conditions at an access point. In such an embodiment software on a management server in the network can detect that a group of client devices with a specific OS type are having application specific problems that are not covered by the standard capture configuration ( e.g. capture on auth fail, capture on DHCP fail etc. and can modify the packet capture and reporting conditions to facilitate collection of packets which are likely to be useful in further analysis to be preformed to identify the problem. The management server in such an embodiment can send a list of client mac addresses (MAC addresses of client devices to be monitored) across the devices, e.g., access points, in a site or network and instruct the Access points to capture packets, e.g., a specific number of packets, for a given application executed by a client device having one of the listed mac addresses and thereby dynamically identify and control the capture packet data for further analysis and root problem cause evaluation for devices having MAC addresses or other device identifiers in the distributed list.

Management software operating on a network server or other device can also identify that the given known problem is related to clients connecting on a specific SSID/WLAN and control packet capture and reporting for devices using the specific SSID ore WAN. The server can and sometimes does dynamically sends configuration control instructions and/or information to access points to turn on capture and reporting for the given SSID and/or WLAN.

The techniques described above may be implemented using software, hardware and/or a combination of software and hardware. Network apparatus are e.g., management entities, e.g., the network monitoring node, routers, gateways, access points, DHCP servers, DNS servers, AAA servers, user equipment devices, e.g., mobile nodes such as mobile wireless terminals, base stations, communications networks, communications systems. The invention is directed to a method for capturing and providing information relating to communications according to claim <NUM>, to a communication system according to claim <NUM> and to a computer readable medium according to claim <NUM>. Preferred embodiments are defined by dependent claims <NUM>-<NUM> and <NUM>-<NUM>. Computer readable media may be e.g. ROM, RAM, CDs, hard discs, etc., which include machine readable instructions for controlling a machine to implement one or more steps of a method.

It is understood that the specific order or hierarchy of steps in the processes disclosed is an example of exemplary approaches. Based upon design preferences, it is understood that the specific order or hierarchy of steps in the processes may be rearranged while remaining within the scope of the present disclosure.

Devices and nodes described herein are implemented using one or more modules to perform the steps corresponding to one or more methods, for example, signal generation, transmitting, processing, analyzing, and/or receiving steps. Thus, various features are implemented using modules. Such modules may be implemented using software, hardware or a combination of software and hardware. In some embodiments each module is implemented as an individual circuit with the device or system including a separate circuit for implementing the function corresponding to each described module. Many of the above described methods or method steps can be implemented using machine executable instructions, such as software, included in a machine readable medium such as a memory device, e.g., RAM, floppy disk, etc. to control a machine, e.g., general purpose computer with or without additional hardware, to implement all or portions of the above described methods, e.g., in one or more nodes. Accordingly, among other things, various embodiments are directed to a machine-readable medium e.g., a non-transitory computer readable medium, including machine executable instructions for causing a machine, e.g., processor and associated hardware, to perform one or more of the steps of the above-described method(s).

The processor or processors, e.g., CPUs, of one or more devices, e.g., communications devices such as network management nodes, wireless terminals (UEs), and/or access nodes, are configured to perform the steps of the methods described as being performed by the devices. The configuration of the processor may be achieved by using one or more modules, e.g., software modules, to control processor configuration and/or by including hardware in the processor, e.g., hardware modules, to perform the recited steps and/or control processor configuration. Accordingly in some cases a communications device, e.g., user equipment, comprises a processor which includes a module corresponding to each of the steps of the various described example methods performed by the device in which the processor is included. And in some cases a communications device includes a module corresponding to each of the steps of the various described example methods performed by the device in which the processor is included. The modules may be implemented purely in hardware, e.g., as circuits, or may be implemented using software and/or hardware or a combination of software and hardware.

A computer program product is described comprising a computer-readable medium comprising code for causing a computer, or multiple computers, to implement various functions, steps, acts and/or operations, e.g. one or more steps described above. The exemplary computer program can include different code for each step to be performed. Thus, the computer program product may, and sometimes does, include code for each individual step of a method, e.g., a method of operating a communications device, e.g., a network management node, an access point, a base station, a wireless terminal or node. The code may be in the form of machine, e.g., computer, executable instructions stored on a computer-readable medium such as a RAM (Random Access Memory), ROM (Read Only Memory) or other type of storage device. In addition to being directed to a computer program product, some embodiments are directed to a processor configured to implement one or more of the various functions, steps, acts and/or operations of one or more methods described above. The processor may be for use in, e.g., a communications device or other device described in the present application.

While described in the context of a communications system including cellular, WiFi, Bluetooth and BLE, at least some of the methods and apparatus are applicable to a wide range of communications systems including many non-OFDM and/or non-cellular systems.

Claim 1:
A method of capturing and providing information relating to communications, the method comprising:
receiving (<NUM>), by a first access point (<NUM>) having multiple different interfaces, an instruction to capture packets for an identified communications device on the multiple different interfaces;
in accordance with the received instruction, forwarding (<NUM>), by the first access point, captured packets corresponding to the identified communications device to a network monitoring node (<NUM>) irrespective of whether or not a communications failure corresponding to the identified communications device is detected; and
configuring (<NUM>) the first access point to forward captured packets corresponding to communications devices for which communications failures are detected without forwarding captured packets corresponding to communications devices for which communications failures are not detected and which are not identified communications devices for which packets are to be forwarded irrespective of failure status,
wherein the identified communications device is a multimode communications device and wherein a communications failure when using a first interface of the first access point causes said identified communications device to switch communication with the first access point to a second interface of the first access point.