WO2001001726A2 - Method and apparatus for session reconstruction - Google Patents
Method and apparatus for session reconstruction Download PDFInfo
- Publication number
- WO2001001726A2 WO2001001726A2 PCT/US2000/017583 US0017583W WO0101726A2 WO 2001001726 A2 WO2001001726 A2 WO 2001001726A2 US 0017583 W US0017583 W US 0017583W WO 0101726 A2 WO0101726 A2 WO 0101726A2
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- session
- analyzer
- packets
- application
- flow
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
- H04L41/5003—Managing SLA; Interaction between SLA and QoS
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
- H04L41/5032—Generating service level reports
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
- H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
- H04M15/41—Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
- H04M15/56—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP for VoIP communications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
- H04M15/58—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP based on statistics of usage or network monitoring
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
- H04M15/80—Rating or billing plans; Tariff determination aspects
- H04M15/8016—Rating or billing plans; Tariff determination aspects based on quality of service [QoS]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
- H04M15/81—Dynamic pricing, e.g. change of tariff during call
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M7/00—Arrangements for interconnection between switching centres
- H04M7/006—Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP), including next generation networks with a packet-switched transport layer
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q3/00—Selecting arrangements
- H04Q3/0016—Arrangements providing connection between exchanges
- H04Q3/0062—Provisions for network management
- H04Q3/0075—Fault management techniques
- H04Q3/0079—Fault management techniques involving restoration of networks, e.g. disaster recovery, self-healing networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
- H04L41/508—Network service management, e.g. ensuring proper service fulfilment according to agreements based on type of value added network service under agreement
- H04L41/5087—Network service management, e.g. ensuring proper service fulfilment according to agreements based on type of value added network service under agreement wherein the managed service relates to voice services
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
- H04L41/508—Network service management, e.g. ensuring proper service fulfilment according to agreements based on type of value added network service under agreement
- H04L41/509—Network service management, e.g. ensuring proper service fulfilment according to agreements based on type of value added network service under agreement wherein the managed service relates to media content delivery, e.g. audio, video or TV
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
- H04L41/508—Network service management, e.g. ensuring proper service fulfilment according to agreements based on type of value added network service under agreement
- H04L41/5096—Network service management, e.g. ensuring proper service fulfilment according to agreements based on type of value added network service under agreement wherein the managed service relates to distributed or central networked applications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M2215/00—Metering arrangements; Time controlling arrangements; Time indicating arrangements
- H04M2215/01—Details of billing arrangements
- H04M2215/0112—Dynamic pricing, e.g. change of tariff during call
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M2215/00—Metering arrangements; Time controlling arrangements; Time indicating arrangements
- H04M2215/01—Details of billing arrangements
- H04M2215/0164—Billing record, e.g. Call Data Record [CDR], Toll Ticket[TT], Automatic Message Accounting [AMA], Call Line Identifier [CLI], details, i.e. parameters, identifiers, structure
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M2215/00—Metering arrangements; Time controlling arrangements; Time indicating arrangements
- H04M2215/01—Details of billing arrangements
- H04M2215/0188—Network monitoring; statistics on usage on called/calling number
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M2215/00—Metering arrangements; Time controlling arrangements; Time indicating arrangements
- H04M2215/20—Technology dependant metering
- H04M2215/202—VoIP; Packet switched telephony
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M2215/00—Metering arrangements; Time controlling arrangements; Time indicating arrangements
- H04M2215/22—Bandwidth or usage-sensitve billing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M2215/00—Metering arrangements; Time controlling arrangements; Time indicating arrangements
- H04M2215/74—Rating aspects, e.g. rating parameters or tariff determination apects
- H04M2215/7414—QoS
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M3/00—Automatic or semi-automatic exchanges
- H04M3/22—Arrangements for supervision, monitoring or testing
- H04M3/2218—Call detail recording
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2213/00—Indexing scheme relating to selecting arrangements in general and for multiplex systems
- H04Q2213/13034—A/D conversion, code compression/expansion
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2213/00—Indexing scheme relating to selecting arrangements in general and for multiplex systems
- H04Q2213/1305—Software aspects
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2213/00—Indexing scheme relating to selecting arrangements in general and for multiplex systems
- H04Q2213/13093—Personal computer, PC
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2213/00—Indexing scheme relating to selecting arrangements in general and for multiplex systems
- H04Q2213/1313—Metering, billing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2213/00—Indexing scheme relating to selecting arrangements in general and for multiplex systems
- H04Q2213/13166—Fault prevention
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2213/00—Indexing scheme relating to selecting arrangements in general and for multiplex systems
- H04Q2213/13175—Graphical user interface [GUI], WWW interface, visual indication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2213/00—Indexing scheme relating to selecting arrangements in general and for multiplex systems
- H04Q2213/13196—Connection circuit/link/trunk/junction, bridge, router, gateway
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2213/00—Indexing scheme relating to selecting arrangements in general and for multiplex systems
- H04Q2213/13204—Protocols
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2213/00—Indexing scheme relating to selecting arrangements in general and for multiplex systems
- H04Q2213/13209—ISDN
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2213/00—Indexing scheme relating to selecting arrangements in general and for multiplex systems
- H04Q2213/1325—Priority service
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2213/00—Indexing scheme relating to selecting arrangements in general and for multiplex systems
- H04Q2213/13337—Picturephone, videotelephony
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2213/00—Indexing scheme relating to selecting arrangements in general and for multiplex systems
- H04Q2213/13349—Network management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2213/00—Indexing scheme relating to selecting arrangements in general and for multiplex systems
- H04Q2213/13389—LAN, internet
Definitions
- IP Internet protocol
- RMON2 The provision of a committed quality of service network is distinct from the monitoring the network and billing for usage of the network.
- Existing network monitoring processes such as RMON2, and RMON, specified by RFC 2074 and RFC 2021 are designed to report statistics based on information available in the packet headers, e.g. source and destination address. With RMON2, this can be broken down on a per port basis. The granularity of the reports depends on the sampling of the RMON trace.
- the returned statistics are basic measures of number of bytes and number of packets.
- service detail records can be generated based on application specific events instead of generic flows, so usage billing can be performed based on factors such as a price per minute per leg, etc, with application specific events generated each time a leg is added or dropped. Further, because the periodicity of the output can be controlled on a per application basis, output for voice over IP calls can be generated more often than for other applications. Additionally, embodiments of the invention can reconstruct sessions that are flowing across multiple network devices.
- Fig. 1 illustrates a system including one embodiment of the invention.
- Fig. 2 illustrates the handling of packets that are not part of a recognized flow.
- Fig. 3 illustrates the handling of packets that are part of a recognized flow.
- Fig. 4 illustrates the relationship between information about a flow and information about a session.
- Fig. 5 illustrates information generated by some embodiments of the invention for from session information.
- Fig. 6 illustrates a situation in which distributed session reconstruction may be desirable.
- Fig. 7 illustrates a system including one embodiment of the invention configured to support distributed session reconstruction.
- TCP UDP ports can be used for multiple purposes; therefore, unless the application data itself is examined, it may not be possible to provide accurate application based reporting.
- port 80 is typically used for hypertext transfer protocol (HTTP) access.
- HTTP hypertext transfer protocol
- switching a protocol like RealAudio(TM) which sometimes exhibits poor behavior due to network congestion, to a port used by a well-known service such as DNS can provide huge speed improvements for an end user.
- the OSI model or Open Systems Interconnection Reference Model, is a seven-layer model comprising the following layers: physical (1); data link (2); network (3); transport (4); session (5); presentation (6); and application (7).
- sessions can hierarchically be comprised of other sessions.
- the process of accessing a single web page may be comprised of multiple HTTP sessions.
- a "WWW session” might be considered to comprise all web activity by a user in a definite time bound, e.g. times out after X minutes without further activity.
- a WWW session could be comprised of page sessions for each retrieved page.
- the page sessions in turn could be comprised of one or more HTTP sessions, e.g. one or more flows for retrieving an object using the HTTP protocol.
- a provider might provide guarantees about average latency to customers. For example, the provider might promise that the average latency would not exceed Z ms. If the entire voice over IP call is treated as a single session, the latency can be measured and the appropriate compensation can be given if the latency guarantee was not met. Further, because application specific events can be monitored, addition and removal of call legs can be tracked and appropriate service detail records generated. Also, different application protocols may have different usage billing requirements. For example, voice over IP calls for a prepaid calling card must be checked every minute to ensure that a user does not exceed the minutes available to them.
- Figure 1 illustrates a system including one embodiment of the invention. This could be used in conjunction with a corporate Intranet to provide policy based session management and monitoring. A provider of voice could use this over IP telephony to meter and monitor usage and provide a committed quality of service.
- Figure 1 includes the packet sources lOOa-e, a filter 102, an analyzer 104, a data collector 106, a policy 114.
- the analyzer 104 includes a flow manager 108, an application recognizer 110, and a session streamer 112.
- the packet sources lOOa-e are coupled in communication with the filter 102.
- the filter 102 is coupled in communication with the analyzer 104.
- the analyzer 104 is coupled in communication with the data collector 106.
- the filter 102, the analyzer 104, and the data collector 106 are capable of accessing the policy 114.
- the filter 102 and the analyzer 104 are hosted on separate computers.
- the filter 102 might have two Ethernet interfaces, one for receiving packets from the packet sources lOOa-e and the other for sending matching packets to the analyzer 104.
- Packets are analyzed by the analyzer 104 to be assigned to flows and then to sessions.
- the analyzer 104 can gather statistics about flows and sessions for use by the data collector 106.
- Each of the components of the analyzer 104 can be performed on a single computer and/or multiple computers to support distributed processing.
- the policy 114 controls how the system operates. For example, the policy might specify the ability of certain users or groups to perform certain tasks. The policy might control how much bandwidth certain users or groups get. The policy might control how users or groups are billed for usage. The policy may also control how different application events are treated, e.g. for voice over IP request minute by minute service detail records, etc. Other options include controlling when sessions, flows and/or packets are dropped, the contents of output from the data collector 106, what application specific headers and statistics are being collected, and/or other options. For example, for HTTP, the time from click to first reply and time from click till last TCP thread finished might be recorded as well as the base uniform resource indicator (URI).
- the policy can include a series of pcap language style expressions together with output selectors as shown by the example in Table 1.
- the application tests 206 include tests for CuSeeMe, http, ftp, RealAudio(TM), post office protocol version 3 (POP3), SMTP, NetMeeting(TM), Quicktime(TM), H.323 calls, telnet, and/or other applications.
- the application tests for a particular application protocol describe how to identify a particular application protocol from the data content of packets.
- the unrecognized flow 202A will be assigned to a new session, session 210D.
- the session streamer 112 is used to alert the flow manager 108 to new flows that are part of an existing session in some embodiments of the invention. Therefore, unrecognized flows will be assigned to new sessions while new flows for an existing session will be treated as recognized flows.
- Some flows may not be recognized as belonging to any application. For example, if a new protocol is developed for streaming media, then none of the application tests 206 may be able to recognize the flow. In that case, some embodiments of the invention treat the unrecognized flow as a self-contained session after more than two kilobytes (KB) have been sent or if a predetermined amount of time passes without additional packets. Because the application tests 206 are modular, additional tests can be added, modified, and/or removed easily. The tests can, if appropriately designed, detect specific application protocols, e.g. RealAudio(TM) type Y encoding, etc.
- TM RealAudio
- Figure 3 illustrates the handling of packets that are part of a recognized flow once a session is underway (For example, ongoing packets in a voice over IP call). Additionally, the session streamer 112 can provide information to the flow manager 108 to allow new flows for an existing session to be recognized without the application recognizer 110 being used. Figure 3 shows how recognized flows are handled according to some embodiments of the invention. Filtered packets 300 flow into the flow manager 108. Because the packet belongs to a recognized flow, e.g. the recognized flow 3202A, it is associated with the respective content, e.g. the content 304A.
- the session streamer 112 uses the application streamers 306 to detect application specific events, e.g. add leg, etc., and assign the content to respective sessions.
- the application streamers 306 are similar to the application tests 206. However, the application streamers 306 contain tests for matching additional packets from the same application session.
- the session streamer 112 in conjunction with the application streamers 306 may also be able to detect the request for additional channels or ports and provide that information to the flow manager 108.
- new flows for an existing session will not be treated as unrecognized flows, but rather will be recognized and handled by the session streamer 112.
- the application streamers 306 might include NetMeeting(TM) specific streamers for detecting add leg and drop leg events and providing the addressing information to the flow manager 108.
- the policy 114 can assign significance and actions relative to certain application events identified by the application streamers 306.
- the session streamer 112 assigns the packets from the flows to the respective sessions based on the results of the application streamers 306.
- the recognized flow 302 A and the content 304 A is matched with the session 210B.
- Figure 4 illustrates the relationship between information about a flow and information about a session.
- Figure 4 includes three flows 400A-C with respective packet time-stamps 402A-C.
- Each flow 400A-C is associated with a corresponding session 210A-D.
- the flows 400 A-B are both associated with session 210D while flow 400C is associated with session 210 A.
- the packet time-stamps 402A-C are used to generate the statistics 404A-D corresponding to each of the sessions.
- an H.323 call is may be comprised of at three or more flows. For example, for a call from John to Jane, there might be two flows for audio and a third flow for control. Per flow monitoring alone could suggest that one flow for the call, e.g. John to Jane, is meeting the committed quality of service. But, nothing would connect that information with the fact that the other flow, Jane to John, is not.
- a service detail record can include a billing identifier, e.g. user name, calling card number, phone number, and/or some other identifier.
- the service detail record also can include the usage within the interval covered by the service detail record.
- a service detail record for a voice over IP call might include the phone number and the usage, e.g. "650/555-1212, 5 legs, 3007 sec ttl", etc.
- Figure 5 illustrates information generated by some embodiments of the invention for from session information.
- the generated statistics e.g. the statistics 404A-D
- the policy 114 can be used to define the output of the data collector 116.
- Outputs include usage reports 500 that describe application usage in application specific terms, e.g. 700 minutes of voice over IP calls, maximum of 10 simultaneous calls, etc.
- Service detail records 502 are another output of the data collector 106. These could be output at application specific intervals, six seconds for voice over IP, every hour for web usage, etc.
- the service detail records 502 can be used for billing purposes and also to limit access if the paid for usage is exceeded. For example if a user purchases twenty minutes of voice over IP calls, when she/he reaches that limit, systems monitoring the service detail records
- Another output can include quality of service reports 504. These may specify, on an application level, the performance for the session, as appropriate, this can be presented in application specific terms. For example, if a voice over
- IP call should have no more than a Z ms latency to avoid echo
- the report might specify how many calls exceeded that latency and by how much.
- Another output might include router commands 506 to control a router, e.g. to limit further usage or re-prioritize usage of bandwidth relative to performance and committed quality of service. For example, if RealAudio(TM) sessions consume too much bandwidth relative to the priority set in the policy 114, the router commands 506 could block the routing of RealAudio(TM), or reduce its priority further to allow higher priority sessions to proceed at the committed quality of service.
- Figure 6 illustrates a situation in which distributed session reconstruction may be desirable.
- a client computer 600 and a host computer 602 are coupled in communication over a packet switched network including two routers, the router 604 and the router 606. Two examples will be considered, one involving the file transfer protocol and the other involving asymmetric routing.
- the packets flowing through the router 606 are sent to a session reconstruction system of the type described above as the packet source 100a, but that packets flowing through the router 604 are provided to a different session reconstruction system.
- the session reconstruction system monitoring the packets from the router 606 will be able to detect the FTP session and the control flow 608.
- the other session reconstruction system, monitoring the packets from the router 604 may be able to detect the transfer flow 610, but may not be able to identify the protocol or the appropriate application session.
- the flow 608 and the flow 610 represent two halves of a single communication. This occurs when the traffic from the client computer 600 to the host computer 602 traverse a different set of network devices than packets sent in the other direction, e.g. asymmetric routing. Again, as in the example above, if the two routers are supplying their traffic data to different session reconstruction systems, it may not be possible to monitor even a single flow from one session reconstruction system.
- each session reconstruction system is according to the manner described above.
- a packet source e.g. the packet source lOOf
- flows into a filter e.g. the filter 102a
- an analyzer e.g. the analyzer 104a
- results from the analyzers 104a-d can be passed to other analyzers (e.g. the analyzer 104d).
- This approach can be further nested with the analyzer 104d coupled to other analyzers higher in the hierarchy, not shown.
- data can be transferred directly from an analyzer (e.g.
- the session data can be sent to a higher level analyzer (e.g. the analyzer 104d) or directly to the data collector (e.g. the data collector 106a).
- a higher level analyzer e.g. the analyzer 104d
- the data collector e.g. the data collector 106a
- This approach reduces some of the computational complexity of the first approach, e.g. the need for the higher level analyzers to reprocess all packet data.
- hints are extracted by the lower level session analyzer and provided to higher level analyzers.
- the raw packet data is forwarded - together with time stamps - to higher level analyzers.
- the application streamer might detect the request to establish a file transfer over certain ports within the control flow 608. This information can be provided to the higher level organizer as a hint.
- the higher level analyzer could use the second hint to identify the forwarded packets as belonging to an FTP session and use the first hint to prime the application streamer to recognize the transfer flow packets when they are forwarded from another analyzer.
- This approach is the most complex, but also the most bandwidth efficient.
- hints are generated at lower level analyzers.
- incomplete data is aggregated into a summary whenever possible.
- the summary can include information from packet headers as well as attributes and metrics. Examples of data that would be included in summaries are: source address, destination address, source port, destination port, terms of service (TOS), protocol quality of service (QOS), number of packets, number of bytes, latency, etc.
- TOS terms of service
- QOS protocol quality of service
- hint methods can accept data in packet forwarding format, e.g. without hints.
- hint plus summary method can also accept hints together with forward packets, e.g. without summaries.
- the filter e.g. the filter 102
- the filter can be omitted.
- different streams can traverse different components.
- the analyzer 104c could be omitted in preference for allowing the packet source lOOh to be analyzed first by the analyzer 104d.
- the filter 102, the analyzer 104, the flow manager 108, the application recognizer 110, the session streamer 112, the data collector 106, the policy 114, the application tests 206 and the application streamers 306 are included in hardware, software, and/or a combination of hardware and software.
- the filter 102, the analyzer 104, the flow manager 108, the application recognizer 110, the session streamer 112, the data collector 106, the policy 114, the application tests 206 and the application streamers 306 are included as one or more computer usable media such as CD-ROMs, floppy disks, and/or other media.
- the electromagnetic wave form comprises information such as the flow manager 108, the application recognizer 110, the session streamer 112, the application tests 206, and/or the application streamers 306.
- the application streamers 306 might include a database of application streamer data accessed over a network by the session streamer 112.
Abstract
Description
Claims
Priority Applications (7)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
IL14137800A IL141378A0 (en) | 1999-06-28 | 2000-06-26 | Method and apparatus for session reconstruction |
EP00944892A EP1142196A2 (en) | 1999-06-28 | 2000-06-26 | Method and apparatus for session reconstruction |
GB0107092A GB2357392A (en) | 1999-06-28 | 2000-06-26 | Method and apparatus for session reconstruction |
AU58919/00A AU5891900A (en) | 1999-06-28 | 2000-06-26 | Method and apparatus for session reconstruction |
CA002340184A CA2340184A1 (en) | 1999-06-28 | 2000-06-26 | Method and apparatus for session reconstruction |
IL141378A IL141378A (en) | 1999-06-28 | 2001-02-11 | Method and apparatus for session reconstruction |
HK02100903.4A HK1039425A1 (en) | 1999-06-28 | 2002-02-05 | Method and apparatus for session reconstruction |
Applications Claiming Priority (6)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US14135199P | 1999-06-28 | 1999-06-28 | |
US60/141,351 | 1999-06-28 | ||
US09/552,818 | 2000-04-20 | ||
US09/552,818 US6957255B1 (en) | 1999-06-28 | 2000-04-20 | Method and apparatus for session reconstruction and accounting involving VoIP calls |
US09/553,261 | 2000-04-20 | ||
US09/553,261 US6963912B1 (en) | 1999-06-28 | 2000-04-20 | Method and apparatus for session reconstruction |
Publications (2)
Publication Number | Publication Date |
---|---|
WO2001001726A2 true WO2001001726A2 (en) | 2001-01-04 |
WO2001001726A3 WO2001001726A3 (en) | 2001-07-19 |
Family
ID=27385639
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2000/017583 WO2001001726A2 (en) | 1999-06-28 | 2000-06-26 | Method and apparatus for session reconstruction |
Country Status (7)
Country | Link |
---|---|
EP (1) | EP1142196A2 (en) |
AU (1) | AU5891900A (en) |
CA (1) | CA2340184A1 (en) |
GB (1) | GB2357392A (en) |
HK (1) | HK1039425A1 (en) |
IL (2) | IL141378A0 (en) |
WO (1) | WO2001001726A2 (en) |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2002046983A1 (en) * | 2000-12-08 | 2002-06-13 | Sonera Oyj | A method for arranging accounting and a communication system |
US7296080B2 (en) | 2001-07-17 | 2007-11-13 | Mcafee, Inc. | Method of simulating network communications |
US7315894B2 (en) | 2001-07-17 | 2008-01-01 | Mcafee, Inc. | Network data retrieval and filter systems and methods |
US7496670B1 (en) | 1997-11-20 | 2009-02-24 | Amdocs (Israel) Ltd. | Digital asset monitoring system and method |
US7673242B1 (en) | 2001-07-17 | 2010-03-02 | Mcafee, Inc. | Sliding window packet management systems |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO1995010910A2 (en) * | 1993-10-12 | 1995-04-20 | Intel Corporation | Server/client architecture and method for multicasting on a computer network |
US5742772A (en) * | 1995-11-17 | 1998-04-21 | Lucent Technologies Inc. | Resource management system for a broadband multipoint bridge |
WO1999027556A2 (en) * | 1997-11-20 | 1999-06-03 | Xacct Technologies, Inc. | Network accounting and billing system and method |
-
2000
- 2000-06-26 GB GB0107092A patent/GB2357392A/en not_active Withdrawn
- 2000-06-26 WO PCT/US2000/017583 patent/WO2001001726A2/en not_active Application Discontinuation
- 2000-06-26 EP EP00944892A patent/EP1142196A2/en not_active Withdrawn
- 2000-06-26 CA CA002340184A patent/CA2340184A1/en not_active Abandoned
- 2000-06-26 AU AU58919/00A patent/AU5891900A/en not_active Abandoned
- 2000-06-26 IL IL14137800A patent/IL141378A0/en active IP Right Grant
-
2001
- 2001-02-11 IL IL141378A patent/IL141378A/en not_active IP Right Cessation
-
2002
- 2002-02-05 HK HK02100903.4A patent/HK1039425A1/en unknown
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO1995010910A2 (en) * | 1993-10-12 | 1995-04-20 | Intel Corporation | Server/client architecture and method for multicasting on a computer network |
US5742772A (en) * | 1995-11-17 | 1998-04-21 | Lucent Technologies Inc. | Resource management system for a broadband multipoint bridge |
WO1999027556A2 (en) * | 1997-11-20 | 1999-06-03 | Xacct Technologies, Inc. | Network accounting and billing system and method |
Non-Patent Citations (1)
Title |
---|
See also references of EP1142196A2 * |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7496670B1 (en) | 1997-11-20 | 2009-02-24 | Amdocs (Israel) Ltd. | Digital asset monitoring system and method |
WO2002046983A1 (en) * | 2000-12-08 | 2002-06-13 | Sonera Oyj | A method for arranging accounting and a communication system |
US7296080B2 (en) | 2001-07-17 | 2007-11-13 | Mcafee, Inc. | Method of simulating network communications |
US7315894B2 (en) | 2001-07-17 | 2008-01-01 | Mcafee, Inc. | Network data retrieval and filter systems and methods |
US7673242B1 (en) | 2001-07-17 | 2010-03-02 | Mcafee, Inc. | Sliding window packet management systems |
Also Published As
Publication number | Publication date |
---|---|
EP1142196A2 (en) | 2001-10-10 |
AU5891900A (en) | 2001-01-31 |
HK1039425A1 (en) | 2002-04-19 |
GB0107092D0 (en) | 2001-05-09 |
GB2357392A (en) | 2001-06-20 |
WO2001001726A3 (en) | 2001-07-19 |
IL141378A0 (en) | 2002-03-10 |
CA2340184A1 (en) | 2001-01-04 |
IL141378A (en) | 2006-07-05 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US6957255B1 (en) | Method and apparatus for session reconstruction and accounting involving VoIP calls | |
US7539749B2 (en) | Method and apparatus for session reconstruction | |
US6625650B2 (en) | System for multi-layer broadband provisioning in computer networks | |
US11870696B2 (en) | Method and system for triggering augmented data collection on a network device based on traffic patterns | |
US6963912B1 (en) | Method and apparatus for session reconstruction | |
WO2001001726A2 (en) | Method and apparatus for session reconstruction | |
US7739159B1 (en) | Aggregation of user usage data for accounting systems in dynamically configured networks | |
CN105282050A (en) | Method and device for aggregating data flows | |
Al-Shaer et al. | MRMON: remote multicast monitoring | |
Joshi et al. | Integrated quality of service and network management. | |
Grossglauser et al. | Passive tra c measurement for ip operations | |
Tang | MRMON: Remote Multicast Monitoring | |
Párhonyi et al. | Domain based metering |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AK | Designated states |
Kind code of ref document: A2 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CR CU CZ DE DK DM DZ EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT TZ UA UG US US US UZ VN YU ZA ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A2 Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG |
|
ENP | Entry into the national phase |
Ref document number: 2340184 Country of ref document: CA Ref country code: CA Ref document number: 2340184 Kind code of ref document: A Format of ref document f/p: F |
|
WWE | Wipo information: entry into national phase |
Ref document number: 141378 Country of ref document: IL |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
ENP | Entry into the national phase |
Ref country code: GB Ref document number: 200107092 Kind code of ref document: A Format of ref document f/p: F |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2000944892 Country of ref document: EP |
|
AK | Designated states |
Kind code of ref document: A3 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CR CU CZ DE DK DM DZ EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT TZ UA UG US US US UZ VN YU ZA ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A3 Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG |
|
WWP | Wipo information: published in national office |
Ref document number: 2000944892 Country of ref document: EP |
|
REG | Reference to national code |
Ref country code: DE Ref legal event code: 8642 |
|
NENP | Non-entry into the national phase |
Ref country code: JP |
|
WWW | Wipo information: withdrawn in national office |
Ref document number: 2000944892 Country of ref document: EP |