Patent ID: 7660892

Claim:
A packet-based network analysis system for analyzing packet flow among devices in a ZigBee wireless network, comprising: a wireless network analysis processing device configured to: receive a plurality of correlated packet records, the correlated packet records representative of the order in which corresponding packets were transmitted in the network and including media access control (MAC) layer data, application support (APS) layer data, and network layer data for each corresponding packet; process the MAC layer data and network layer data to generate network topology data representative of the network topology, generate packet flow data representative of the flow of packets between devices at the MAC layer and across the network at the network layer, and generate measurement data relating to the packet flow data; and process the APS layer data to generate endpoint data and binding data, the endpoint data identifying source endpoints and destination endpoints identified by the correlated packet records and associating each respective source endpoint and destination endpoint with a corresponding device in the network and a corresponding application layer functionality, and the binding data defining a logical link between a source endpoint, cluster identifier, and a destination endpoint; wherein: the packet flow data comprises packet flow records, and the wireless network analysis processing device is further configured to: create a new packet flow record and add packet flow data corresponding to a first hop of a packet in the network if the source MAC address matches the source network address in a corresponding correlated packet record; add packet flow data corresponding to a last hop of a packet in the network to a packet flow record if the destination MAC address matches the destination network address in a corresponding correlated packet record; and add packet flow data corresponding to an intermediate hop of a packet in the network to a packet flow record if the destination MAC address does not match the destination network address and the source MAC address does not match the source network address in a corresponding correlated packet record.