Patent Description:
This invention relates generally to computer networks. More particularly, this invention relates to evaluating computer network traffic activity using hardware interval counters and an associated computer running software to generate network traffic activity data.

Commercial devices that evaluate computer network traffic are known. It is common for such devices to perform data compression and data analyses in hardware in real-time. This arrangement adds significant cost to the system. These devices commonly have many ports and therefore each port requires special hardware.

Accordingly, there is a need for a more cost effective way to evaluate computer network traffic.

Document <CIT> discloses a router and a monitoring system implemented within the router for performing a statistical method on packets crossing said router.

A system, as defined according to the appended independent claim <NUM>, has a packet switch for routing network traffic. The packet switch includes a system counter to increment a counter time in predetermined time segments, time stamping logic to associate a received packet with the counter time, and an interval discriminator to assign a received packet to a selected interval counter of a set of interval counters based upon the counter time. A computer is connected to the packet switch. The computer has a memory with instructions executed by a processor to associate the counter time with a time of day, and collect values from the set of interval counters to generate network traffic activity data.

The invention is more fully appreciated in connection with the following detailed description taken in conjunction with the accompanying drawings, in which:.

<FIG> illustrates a system <NUM> for network monitoring and network analysis, in accordance with an embodiment of the invention. The system <NUM> includes network monitoring devices 102A-102N on the ingress side of a monitored device <NUM> and network monitoring devices 106A-106N on the egress side of the monitored device <NUM>. The network traffic that is monitored and analyzed by the network monitoring devices <NUM> may enter the network monitoring devices <NUM> through interfaces 104A-104N (or interfaces 108A-108N for network monitoring devices 106A-106N). After monitoring and analysis by the network monitoring devices, the network traffic may exit the devices through the interfaces if the interfaces are bidirectional, or through other interfaces (not shown) if the interfaces are unidirectional. Each of the devices may have a large number of high-capacity interfaces, such as <NUM><NUM>-Gigabit network interfaces.

<CIT> (the '<NUM> patent), which is owned by the current applicant, discloses a network monitoring device that may be configured in accordance with embodiments of the invention. The contents of the '<NUM> patent are incorporated herein by reference.

The network monitoring devices 102A-102N, 106A-106N use hardware counters to collect information on network traffic. The data from the counters is periodically transferred to computer <NUM> for evaluation under software control to generate network traffic activity data.

Thus, the disclosed invention decouples the hardware based real-time data collection performed by the network monitoring devices 102A-102N, 106A-106N from the compression, analysis, and presentation performed on computer <NUM>. This results in a significant cost savings because specialized hardware is not required at each port. Instead, a collection of counters, commonly available on a packet switch, are used for real-time data capture. The captured data is subsequently analyzed by software running on computer <NUM>. This cost advantage can be realized across any programmable pipeline hardware that supports the disclosed hardware real-time constructs.

<FIG> illustrates a computer <NUM> that may be used in accordance with an embodiment of the invention. The computer <NUM> may include a processor <NUM> connected to input/output devices <NUM> via a bus <NUM>. A network interface circuit <NUM> is also connected to the bus <NUM> to provide connectivity to the network hosting the devices of <FIG>. A memory <NUM> is also connected to the bus <NUM>. The memory <NUM> stores instructions executed by the processor <NUM>. In one embodiment, the memory <NUM> stores an interval discriminator module <NUM>.

The interval discriminator module <NUM> associates counter values with an actual time of day. Counters available in a network monitoring device typically do not have enough bits to express a date and time. Therefore, the interval discriminator module <NUM> is used to associate counter time snippets to an actual time of day.

The, interval discriminator module <NUM> also has instructions executed by processor <NUM> to derive an interval discriminator configuration. As discussed below, the interval discriminator configuration is a set of rules that result in the assignment of a packet with a given counter value to a selected interval counter of a set of interval counters.

Memory <NUM> also stores an interval metric module <NUM>. The interval metric module <NUM> includes instructions executed by processor <NUM> to collect values from the set of interval counters to generate network traffic activity data. In one embodiment, the network traffic data includes a maximum data rate in milliseconds, a minimum data rate in milliseconds, a data rate standard deviation, a time measurement of data rate over a pre-set threshold and a time measurement of data rate below a pre-set threshold. The network traffic activity data may also include individual flow data.

<FIG> illustrates software based processing performed by the interval discriminator module <NUM> and the interval metrics module <NUM> of computer <NUM>. The remaining components in the figure are hardware components in the network monitoring devices 102A-102N, 106A-106N. A System Counter <NUM> is a hardware counter that increments automatically as time passes. This counter is synchronized to an external time source.

Timestamping Logic <NUM> associates the current value of the System Counter <NUM> with the instant of arrival of an ingress packet. The Interval Discriminator <NUM> considers the timestamp that was associated with the incoming packet and decides which measurement interval the packet should be assigned.

<FIG> also illustrates Interval Counter Tables 306_1 through 306_N. These tables count the number of packets sent to a designated interval counter. These tables could be arranged separately or combined into a large single table that also has an index to allow a specific interval's accounting to the accessed.

Interval Discriminator Maintenance Process of interval discriminator module <NUM> understands the relationship between the Time Reference and the actual Time of Day. In this way, it can identify which ranges of timestamp belong to which measurement interval. This information is programmed into the Interval Discriminator prior to that instant in time, such that the proper Interval Counter Table will be selected for each packet as it arrives.

Interval Counter Table Maintenance Process of interval metric module <NUM> evacuates the counters and prepares the Interval Counter Table for reuse. It then processes the counters for compression, analysis and presentation.

<FIG> illustrates processing operations associated with the invention. The interval discriminator module <NUM> derives an interval discriminator configuration <NUM> and then transfers the interval discriminator configuration <NUM> to network monitoring device 102A. The System Counter <NUM> of the network monitoring device 102A runs <NUM>. The Time Stamping Logic <NUM> associates received packets with a counter time <NUM>. The Interval Discriminator <NUM> assigns received packets to a selected interval counter <NUM> (i.e., one of Interval Counters 306_1 through 306_N). It is then determined whether the Time Window defined by the Interval Discriminator Configuration is expired <NUM>. If not (<NUM> - No), control returns to block <NUM>. If so (<NUM> - Yes), the Interval Counter Values <NUM> are transferred to the Interval Metric Module <NUM> of computer <NUM>. The Interval Metric Module <NUM> derives network traffic activity data from the Interval Counter values <NUM>.

The invention is more fully appreciated with a specific example. Assume that the System Counter <NUM> is <NUM>-bits wide and has nanosecond resolution. Of course, other dimensions could be used. The user desires to detect traffic bursts using <NUM> millisecond measurement intervals. Assume that the System Counter is synchronized such that it has value <NUM> at the beginning of the first measurement interval. Of course, another starting point could be used. Assume that the Interval Counter Tables 306_1 through 306_N are all available for use, and thus begin incrementing the counters in the table associated with index <NUM> at the beginning of the first measurement interval. If <NUM> Interval Counter Tables are used, this allows for <NUM> second to elapse before the tables would be recycled.

To prepare the Interval Discriminator <NUM> for the upcoming second of measurements, <NUM> rules (corresponding to the <NUM> tables) must be configured by the Interval Discriminator Module <NUM>. Table <NUM> is an example of such rules.

The Interval Discriminator Module <NUM> passes the Table to the interval discriminator <NUM>. Now, when the packets arrive with an associated timestamp that falls within this first second of time, the real time domain of the system has an Interval Counter Table Index assigned. This assigned index is used to direct the measurements taken on this packet to be accounted for in that table associated with that index.

As the System Counter <NUM> increments past the range in a specific rule (call it rule N) in the Interval Discriminator <NUM>, the Interval Counter Table associated with that same rule is evacuated by the Interval Metrics Module <NUM>.

Sometime after, but before <NUM> milliseconds beyond rule N's range has elapsed, its range will be redefined to now bracket the next <NUM> millisecond interval, and so on. Always keeping ahead of the System Counter <NUM> and wrapping as required when rolls-over occurs.

The evacuated Interval Counter Table contents are accumulated in the Interval Metrics Module <NUM>. The Interval Metrics Module <NUM> quantifies traffic bursts in terms of when they occurred, how long they persisted, their magnitude, and other details describing the origin of the burst inducing communication.

In one embodiment, the network traffic data includes a maximum data rate per interval (e.g., per <NUM> milliseconds), a minimum data rate per interval, a data rate standard deviation per interval, a time measurement of data rate over a pre-set threshold per interval and a time measurement of data rate below a pre-set threshold per interval. The network traffic activity data may also include individual flow data.

An embodiment of the present invention relates to a computer storage product with a computer readable storage medium having computer code thereon for performing various computer-implemented operations. The media and computer code may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well known and available to those having skill in the computer software arts. Examples of computer-readable media include, but are not limited to: magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as CD-ROMs, DVDs and holographic devices; magneto-optical media; and hardware devices that are specially configured to store and execute program code, such as application-specific integrated circuits ("ASICs"), programmable logic devices ("PLDs") and ROM and RAM devices. Examples of computer code include machine code, such as produced by a compiler, and files containing higher-level code that are executed by a computer using an interpreter. For example, an embodiment of the invention may be implemented using JAVA®, C++, or other objectoriented programming language and development tools. Another embodiment of the invention may be implemented in hardwired circuitry in place of, or in combination with, machine-executable software instructions.

Claim 1:
A system, comprising:
a packet switch for routing network traffic, the packet switch including a system counter (<NUM>) to increment a counter time in predetermined time segments, time stamping logic (<NUM>) to associate each received packet with the counter time at an instant of arrival of each received packet, and an interval discriminator (<NUM>) with a set of rules to assign each received packet to a selected interval counter (<NUM>) of a set of interval counters (306_1-306_N) based upon the counter time associated with each received packet; and
a computer (<NUM>) connected to the packet switch, the computer including a memory with instructions executed by a processor to:
associate the counter time of each received packet with a time of day, and
collect the counter time of each received packet from the set of interval counters to generate network traffic activity data.