Patent application number | Description | Published |
20090262650 | METHOD AND APPARATUS FOR PROVIDING STATISTICAL EVENT CORRELATION IN A NETWORK - A method and apparatus for providing event correlation in a network are disclosed. For example, the method extracts a plurality of events of interest from a database, and creates one or more event time series from the plurality of events of interest, wherein each of the one or more event time series comprises a set of events of a same type and of a same location that occur within a given time period. The method forms one or more composite events from the one or more event time series, and performs one or more pair-wise correlations for at least one of: the event time-series, or the one or more composite events. The method then identifies one or more pair-wise correlations that are statistically significant. | 10-22-2009 |
20100157809 | SYSTEM AND METHOD FOR SPATIALLY CONSISTENT SAMPLING OF FLOW RECORDS AT CONSTRAINED, CONTENT-DEPENDENT RATES - Disclosed herein are systems, computer-implemented methods, and computer-readable media for sampling network traffic. The method includes receiving a desired quantity of flow record to sample, receiving a plurality of network flow record each summarizing a network flow of packets, calculating a hash for each flow record of based on one or more invariant part of a respective flow, generating a quasi-random number from the calculated hash for each respective flow record, generating a priority from the calculated hash for each respective flow record, and sampling exactly the desired quantity of flow records, selecting flow records having a highest priority first. In one aspect, the method further partitions the plurality of flow records into groups based on flow origin and destination, generates an individual priority for each partitioned group, and separately samples exactly the desired quantity of flow records from each partitioned group, selecting flows having a highest individual priority first. | 06-24-2010 |
20100161791 | SYSTEM AND METHOD FOR SAMPLING NETWORK TRAFFIC - Disclosed herein are systems, computer-implemented methods, and computer-readable media for sampling network traffic. The method includes receiving a plurality of flow records, calculating a hash for each flow record based on one or more invariant part of a respective flow, generating a quasi-random number from the calculated hash for each respective flow record, and sampling flow records having a quasi-random number below a probability P. Invariant parts of flow records include destination IP address, source IP address, TCP/UDP port numbers, TCP flags, and network protocol. A plurality of routers can uniformly calculate hashes for flow records. Each router in a plurality of routers can generate a same quasi-random number for each respective flow record and uses different values for probability P. The probability P can depend on a flow size. The method can divide the quasi-random number by a maximum possible hash value. | 06-24-2010 |
20110013525 | Indirect measurement methodology to infer routing changes using statistics of flow arrival processes - Statistical methods are used to observe packet flow arrival processes and to infer routing changes from those observations. Packet flow arrivals are monitored using NetFlow or another packet flow monitoring arrangement. Packet flow arrivals are quantified by counting arrivals per unit time, or by measuring an inter-arrival time between flows. When a change in packet flow arrivals is determined to be statistically significant, a change in network routing protocol is reported. | 01-20-2011 |
20130132608 | System And Method For Determination Of Routing Information In A Network - A system and method to use network flow records to generate information about changes in network routing and to understand the impact of these changes on network traffic. The inferences made can be determinative, if sufficient information is available. If sufficient information is not available to make determinative inferences, inferences may be made that narrow the range of possible changes that may have occurred to network traffic and the underlying network. | 05-23-2013 |
Patent application number | Description | Published |
20100008233 | METHODS AND APPARATUS TO DEPLOY AND MONITOR NETWORK LAYER FUNCTIONALITIES - Example methods and apparatus to deploy and monitor network layer functionalities are disclosed. A disclosed example method includes receiving an Internet Protocol (IP) packet at an input of a server, the IP packet being received from a communicatively coupled router, identifying the IP packet as a production IP packet or a non-production IP packets, when the IP packet is the non-production IP packet, manipulating data within the IP packet to monitor network layer functionality, forwarding the manipulated non-production IP packet to the router, and when the IP packet is the production IP packet, forwarding the production IP packet to the router without manipulating data within the IP packet. | 01-14-2010 |
20100008240 | METHODS AND APPARATUS TO MONITOR NETWORK LAYER FUNCTIONALITIES - Example methods and apparatus to monitor network layer functionalities are disclosed. A disclosed example method includes receiving a first probe packet at an input of a first server, the first probe packet being received from a router, the first probe packet being generated and transmitted from a second server that is one-hop away from the first server in a network, determining if the first server is a final destination of the first probe packet, and if the first server is not the final destination of the first probe packet, generating a second probe packet and transmitting the second probe packet to the router for transmission toward the final destination. | 01-14-2010 |
20100008363 | METHODS AND APPARATUS TO DISTRIBUTE NETWORK IP TRAFFIC - Example methods and apparatus to distribute network IP traffic are disclosed. A disclosed example method includes receiving a first IP control packet at an input of a first server, the first IP control packet being received from a first router, selecting a second router within a router array associated with the first router to send the first IP control packet, the first server selecting the second router by matching a destination IP address of the first IP control packet to a first IP address subspace associated with the second router, transmitting the first IP control packet to the second router, and updating a forwarding table in the first router by associating the destination IP address of the first IP control packet with a first control path from the first router to the second router. | 01-14-2010 |
20110286342 | METHODS AND APPARATUS TO ROUTE PACKETS IN A NETWORK - Methods and apparatus to route packets in a network are disclosed. A disclosed example method includes receiving a packet in a packet aggregator, accessing a forwarding table to determine a router within a router array to which the packet is to be forwarded, transmitting the packet to the determined router via a first interface of the packet aggregator, identifying a second interface within the router to which the packet is to be forwarded, forwarding the packet from the router via the second interface to a virtual interface within the packet aggregator, and statically forwarding the packet from the packet aggregator to a destination based on the virtual interface that received the packet. | 11-24-2011 |
20110286457 | METHODS AND APPARATUS TO ROUTE CONTROL PACKETS BASED ON ADDRESS PARTITIONING - Methods and apparatus to route control packets based on address partitioning. A disclosed example method includes receiving a packet in a server, determining the packet is a control packet, forwarding the packet to a processor, identifying via the processor an address prefix of the packet, accessing a forwarding table and determining via the processor at least one of a router or an outgoing interface that corresponds to the identified address prefix, transmitting the packet from the processor to the server via the outgoing interface, and statically forwarding the packet from the server to the router based on an interface that received the packet from the processor. | 11-24-2011 |