Abstract: Automatically identifying a location of a network monitor within a network topology is described. A location of a network monitor within a network topology (which can, and often does, change structure, constituent devices, or both) is determined by monitoring transmissions passing through the network link to which the network monitor is connected. The network monitor uses locally unique device identifiers present in a network transmission to identify the devices or ports most commonly communicating with each other.

Abstract: An information system identifies redundant communication paths between a server and a storage device in a storage area network and classifies the state of the paths according to the distribution of workload amongst them. To make the classification, the information system pairs up active paths. For each pair of active paths, the information system identifies traffic data of the two paths. The information system compares the traffic data of the two paths. Based on the comparison, the information system determines whether workload is balanced or imbalanced between the two paths.

Abstract: For each monitored entity in a storage area network (SAN), metric data associated with the entity is collected. Based on the metric data of an entity, a determination is made as to whether the entity experienced abnormal events. For each entity for which one or more abnormal events are identified, the information system determines an aggregated event score based on the abnormal events identified for the entity. Representation of the entities are presented to a user, where the representations are ordered based on the aggregated event scores of the entities.

Abstract: A monitoring system maintains multiple counts. Each of these counts is associated with a range and indicates a number of network transactions that occurred in a storage area network (SAN) during a time period with values that are within the associated range. When the monitoring system identifies the occurrence of a network transaction between devices in the SAN, the monitoring system determines a time duration and/or a size of the network transaction. The monitoring system identifies a count associated with a time range that includes the determined time duration and increments the identified count. Additionally, the monitoring system identifies a count associated with a size range that includes the determined size and increments the identified count.

Abstract: Methods and systems are described for storing network device identities and application assignments as a function of time to facilitate analysis of network devices and applications even in a temporally dynamic network. Server assignments are stored as a function of time for various applications executed within a network. Performance data are indexed according to a server and/or port unique identifier and stored as a function of time. Using the time-based server assignments and time-based performance data, the system can be queried using at least one of an application and intermediate entity identifier to determine the performance of the application, the entity, or both at one or more points in time.

Abstract: A link in a storage area network (SAN) is identified that is being affected by one or more slow draining devices. Devices in the SAN are identified as candidates for potentially being a slow draining device affecting the link. For each identified candidate device, metric data is identified that describes, for example, traffic activity of the candidate device, such as data transmission rates of the candidate device. Additionally, metric data is identified for the link. For each candidate device, a correlation value is determined that indicates the likelihood that the candidate device is a slow draining device affecting the link. The correlation value of a candidate device is determined based on the correlation between the metric data of the device and the metric data of the link. One or more of the correlation values are presented to a user via a user interface.

Abstract: Automatically identifying a location of a network monitor within a network topology is described. A location of a network monitor within a network topology (which can, and often does, change structure, constituent devices, or both) is determined by monitoring transmissions passing through the network link to which the network monitor is connected. The network monitor uses locally unique device identifiers present in a network transmission to identify the devices or ports most commonly communicating with each other.

Abstract: An information system identifies redundant communication paths between a server and a storage device in a storage area network and classifies the state of the paths according to the distribution of workload amongst them. To make the classification, the information system pairs up active paths. For each pair of active paths, the information system identifies traffic data of the two paths. The information system compares the traffic data of the two paths. Based on the comparison, the information system determines whether workload is balanced or imbalanced between the two paths.

Abstract: A networking system may include one or more nodes communicating with each other. The nodes may communicate via one or more links, which a switch or other structure may provide. The networking system may include one or more pools of at least one network diagnostic module. A network diagnostic module may test one or more links and may be configured to rove among a plurality of links. The networking system may include an alarm module.

Abstract: A networking system may include one or more nodes communicating with each other. The nodes may communicate via one or more links, which a switch or other structure may provide. The networking system may include one or more pools of at least one network diagnostic module. A network diagnostic module may test one or more links and may be configured to rove among a plurality of links. The networking system may include an alarm module. The alarm module may configure one or more network diagnostic modules to test a link. Preferably, the alarm module may, at least partially in response to a first network diagnostic module detecting particular conditions on a link, configure one or more other network diagnostic modules to test a link. The alarm module may configure the one or more other network diagnostic modules according to priority.

Abstract: A system may comprise a network diagnostic device. The network diagnostic device may be configured to instantiate objects of data collection classes. The data collection classes may be configured to collect data from nodes of a network. The data collection classes may, for instance, inherit an interface object from an ancestor data collection class, and the interface object may be configured to use a protocol to collect data from nodes of a network. The network diagnostic device may be configured to automatically detect a node type associated with a node of a network. The network diagnostic device may also be configured to instantiate a node-specific data collection object associated with the detected node type. The node-specific data collection object may be configured to collect data from nodes of the detected node type at intervals less than or equal to fifteen seconds.

Abstract: A computing device is configured to display a user interface. The user interface is configured to create a filter configured to be applied to network diagnostic statistics prior to aggregation of the network diagnostic statistics. The filter includes at least one device data limitation and at least one performance data limitation.

Abstract: A network diagnostic system may include a network diagnostic device. The network diagnostic device may be configured to receive data indicating a light level of an optical signal and to perform at least one network diagnostic function at least partially in response to the receipt of the data. A network diagnostic method may include detecting a light level of an optical signal; and performing at least one network diagnostic function at least partially in response to the detection of the light level of the optical signal. Exemplary network diagnostic functions may include triggering an alarm; triggering a capture of at least a portion of one or more network messages; storing data indicating the light level of the optical signal on a computer readable medium (e.g., for use in subsequent reports); and/or any other suitable network diagnostic function.

Abstract: A network diagnostic module may use network configuration data in performing network diagnostic methods. The network diagnostic module may use network configuration data to generate baseline network activity data. The network diagnostic module may use network configuration data to identify network components and aggregate network activity data for the components. The network diagnostic module may use network configuration data to identify sets of network components and to access network activity data for the sets. The network diagnostic module may use network activity data to identify sets of network components and to access network configuration data for the sets.

Abstract: A network diagnostic system may include one or more network diagnostic components. The network diagnostic components may be configured to capture at least a portion of one or more network messages. The network diagnostic components may include a plurality of buffers, and the network diagnostic components may be configured to capture at least a portion of one or more network messages in the buffers. The network diagnostic components may be configured to execute the captures in response to capture trigger. A trigger module may be configured to provide the capture trigger in response to detecting one or more conditions. The trigger module may be configured to provide the capture trigger in response to detecting a statistic that is outside a particular range of values. The trigger module may be configured to provide the capture trigger in response to detecting a change in network configuration data associated with a networking system.

Abstract: A networking system may include one or more nodes communicating with each other. The nodes may communicate via one or more links, which a switch or other structure may provide. The networking system may include one or more pools of at least one network diagnostic module. A network diagnostic module may test one or more links and may be configured to rove among a plurality of links. The networking system may include an alarm module.

Abstract: A networking system may include one or more nodes communicating with each other. The nodes may communicate via one or more links, which a switch or other structure may provide. The networking system may include one or more pools of at least one network diagnostic module. A network diagnostic module may test one or more links and may be configured to rove among a plurality of links. The networking system may include an alarm module. The alarm module may configure one or more network diagnostic modules to test a link. Preferably, the alarm module may, at least partially in response to a first network diagnostic module detecting particular conditions on a link, configure one or more other network diagnostic modules to test a link. The alarm module may configure the one or more other network diagnostic modules according to priority.