Abstract: Decrypting synthetic transactions with beacon packets is provided. A probe receives, from a client device, a start beacon packet that identifies a test of a service provided by one or more servers. The probe establishes, responsive to receipt of the start beacon packet, a log for the test. The probe stores, in the log established responsive to the start beacon packet, data packets transmitted between the client device and the one or more servers subsequent to the start beacon packet and encrypted with a key using a security protocol. The probe receives, from the client device, key information used to decrypt the data packets of the test encrypted with the key using the security protocol. The probe provides at least one of the data packets for evaluation or decryption using the key information to determine a performance of the service.

Abstract: Generating synthetic transactions with packets is provided. A synthetic transaction generator can store, in a packet capture trace file, packets corresponding to a test of a service provided through a network. The synthetic transaction generator can transmit the packet capture trace file to a data processing system to cause the data processing system to play or analyze the packet capture trace file to evaluate the performance of the service provided by the service provider.

Abstract: Decrypting synthetic transactions with beacon packets is provided. A probe receives, from a client device, a start beacon packet that identifies a test of a service provided by one or more servers. The probe establishes, responsive to receipt of the start beacon packet, a log for the test. The probe stores, in the log established responsive to the start beacon packet, data packets transmitted between the client device and the one or more servers subsequent to the start beacon packet and encrypted with a key using a security protocol. The probe receives, from the client device, key information used to decrypt the data packets of the test encrypted with the key using the security protocol. The probe provides at least one of the data packets for evaluation or decryption using the key information to determine a performance of the service.

Abstract: A method and apparatus is disclosed herein for dynamically scaling application performance analysis completeness based on available system resources. In one embodiment, the method comprises monitoring incoming network traffic and a rate at which the traffic is being analyzed and dynamically adjusting application performance analysis completeness, the analysis being performed on the observed network traffic.

Abstract: An apparatus for associating WAN optimization attributes with performance metrics of transactions between hosts on a network includes a network management device, a processor, and a display device. The network management device monitors data traffic between hosts communicating over the network and collects WAN optimization information relating to the data traffic. The data traffic includes individual flows between the hosts, and the individual flows include individual transactions involving exchanges of packets. The processor computes at least one performance metric for individual transactions between the hosts and determines what types, if any, of WAN optimization were applied to the individual transactions. The display device displays on an individual transaction basis the performance metric in combination with either the types of WAN optimization applied to the individual transaction or an indication that no WAN optimization was applied to the individual transaction.

Abstract: Network monitoring method and apparatus determines the zero window event data transfer delay, reporting the amount of data transfer delay caused thereby. Non-data-transfer-delaying zero window events can be separated from those causing actual delay, allowing reporting of actual delay events separate from non-delay causing events.

Abstract: Method and apparatus of transaction determination for non-tcp protocols employs a network analyzer to observe network traffic. Non-TCP protocol sequential traffic from a client to a server and sequential traffic following from a server to the client are considered to be one transaction for test and measurement analysis purposes.

Abstract: Network monitoring method and apparatus estimates the congestion window throughout the life of a TCP flow (socket connection), providing information useful for network performance analysis and troubleshooting.

Abstract: A method and apparatus is disclosed herein for dynamically scaling application performance analysis completeness based on available system resources. In one embodiment, the method comprises monitoring incoming network traffic and a rate at which the traffic is being analyzed and dynamically adjusting application performance analysis completeness, the analysis being performed on the observed network traffic.

Abstract: Data acquisition rates are dynamically adjusted in an APM system, by monitoring data acquisition hardware and reducing the data acquisition rate when a determination is made that the data rate is too high for processing by an APM.

Abstract: Network monitoring method and apparatus determines the amount of data outstanding throughout the life of a TCP flow (socket connection). Observing network traffic, calculation of the outstanding data is made, providing information useful for network performance analysis and troubleshooting.

Abstract: Network monitoring method and apparatus determines the zero window event data transfer delay, reporting the amount of data transfer delay caused thereby. Non-data-transfer-delaying zero window events can be separated from those causing actual delay, allowing reporting of actual delay events separate from non-delay causing events.

Abstract: Network monitoring method and apparatus estimates the congestion window throughout the life of a TCP flow (socket connection), providing information useful for network performance analysis and troubleshooting.

Abstract: An apparatus for determining and displaying a transaction reset metric of individual transactions between host devices operating over a network includes a network management device, a processor, and a display device. The network management device monitors flows between the hosts, where the individual flows include individual transactions involving exchanges of packets. The network management device identifies flow resets that terminate flows between hosts. The processor evaluates the flow resets by identifying each flow reset that occurred during an incomplete transaction as a transaction reset and computes a transaction reset count metric as the sum of transaction resets that occur. The processor also identifies individual transactions terminated by a transaction reset. The display device displays on an individual transaction basis whether or not individual transactions were terminated by a transaction reset and displays the transaction reset count metric for selected portions of the network under test.

Abstract: End-user response time in a network is determined by an analyzer which measures client data transfer time, server response time, server data transfer time and, if the protocol is a TCP protocol, further measuring server network round trip time. End-user response time may be approximated by the sum of these determined times.

Abstract: A network analyzer reads network packets and extracts characterizing attributes, grouping patents observed in a given amount of time on common attribute values. Grouped attributes are meta data, written to a database, while packets are written to files. Meta data is stored in the database including links to the physical packets related to the meta data, and a user interface enables query of the meta data and retrieval of related physical packets.

Abstract: A network analyzer reads network packets and extracts characterizing attributes, grouping patents observed in a given amount of time on common attribute values. Grouped attributes are meta data, written to a database, while packets are written to files.

Abstract: An apparatus for determining and displaying a transaction reset metric of individual transactions between host devices operating over a network includes a network management device, a processor, and a display device. The network management device monitors flows between the hosts, where the individual flows include individual transactions involving exchanges of packets. The network management device identifies flow resets that terminate flows between hosts. The processor evaluates the flow resets by identifying each flow reset that occurred during an incomplete transaction as a transaction reset and computes a transaction reset count metric as the sum of transaction resets that occur. The processor also identifies individual transactions terminated by a transaction reset. The display device displays on an individual transaction basis whether or not individual transactions were terminated by a transaction reset and displays the transaction reset count metric for selected portions of the network under test.

Abstract: An apparatus for associating WAN optimization attributes with performance metrics of transactions between hosts on a network includes a network management device, a processor, and a display device. The network management device monitors data traffic between hosts communicating over the network and collects WAN optimization information relating to the data traffic. The data traffic includes individual flows between the hosts, and the individual flows include individual transactions involving exchanges of packets. The processor computes at least one performance metric for individual transactions between the hosts and determines what types, if any, of WAN optimization were applied to the individual transactions. The display device displays on an individual transaction basis the performance metric in combination with either the types of WAN optimization applied to the individual transaction or an indication that no WAN optimization was applied to the individual transaction.

Abstract: Method and apparatus for continuous collection and correlation of application transactions across multiple tiers of an N-tier application employs an application monitoring appliance that observes application data and stores transactions and statistics. A reporting server aggregates and correlates monitored data from the application monitoring appliance and provides access via a web browser for viewing by a network engineer.