Abstract: Disclosed are a method, system, and computer program product for determining a common factor contributing to network activity with reduced computational resource utilization. In some embodiments of the present invention, the method or the system determines one or more factors by examining one or more information transmitted across the network. The method or the system stores a number of information attributable to each of the factors and determines whether the number exceeds a threshold requirement. Where the number for a factor exceeds the threshold requirement, the method or the system then determines a summary statistic for the number of information. Thereafter, the method or the System updates the data structure corresponding to the factor being analyzed based upon the summary statistic. Once the data structure is updated based upon the summary statistic, the method or the system determine one or more common factors for the network activities.

Abstract: A method and system for monitoring traffic flow includes assigning a subset of sampling points to a node or unique pair of nodes. The sampling points are determined to be the most likely to monitor data traffic, and preferably all data traffic, associated with the node or node pair. The sampling point subset may automatically be determined and assigned to the node or node pair, based, for example, on historical traffic within the network. The method further includes collecting diagnostic network traffic data from the sampling points, and obtaining sampled traffic flow counts for a flow associated with a node pair from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes of the node pair. The method further includes performing a function on the sampled traffic flow counts to obtain an estimated traffic flow count for the respective flow.

Abstract: Disclosed are a method, system, and computer program product for determining a common factor contributing to network activity with reduced computational resource utilization. In some embodiments of the present invention, the method or the system determines one or more factors by examining one or more information transmitted across the network. The method or the system stores a number of information attributable to each of the factors and determines whether the number exceeds a threshold requirement. Where the number for a factor exceeds the threshold requirement, the method or the system then determines a summary statistic for the number of information. Thereafter, the method or the System updates the data structure corresponding to the factor being analyzed based upon the summary statistic. Once the data structure is updated based upon the summary statistic, the method or the system determine one or more common factors for the network activities.

Abstract: A method of monitoring traffic flow within a network of nodes, and a recordable medium containing a computer program with instructions that, when executed, performs such method, is provided. The method comprises assigning sampling points to a node or unique pair of nodes. In one method, the sampling points contained within the assigned subset are determined to be the most likely to monitor data traffic, and preferably all data traffic, associated with the node or node pair. The sampling point subset may automatically be determined and assigned to the node or node pair, and such assignment can be based on historical traffic within the network. The method further comprises collecting diagnostic network traffic data from the sampling points, and obtaining sampled traffic flow counts for a flow associated with a node pair from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes of the node pair.

Abstract: A system that monitors neighbor information frames (NIFs) sent by each station within a Fiber Distributed Data Interface (FDDI) network to determine the logical map of the network. After monitoring the NIFs for a period of time sufficient for all stations to have sent a NIF, the invention builds and displays a data structure containing the logical connections. If the system finds a missing connection within the network, it builds a gap structure within the data structure to display the missing connection. The system also sends a request to all stations on the network for station management information. After receiving this information from each station, the system builds and displays a data structure containing the physical connections between each of the stations within the network.

Abstract: A network analysis method for use in relation to a network having a plurality of entities, each with associated traffic, involves an analysis task comprising the steps of monitoring the network to collect data on entity traffic for a period of network operation, analyzing this data in respect of an entity operational characteristic by which the entities may be ordered into a ranking, forming an end set of at least one entity at one end of said ranking, and storing the identity of the or each entity making up that end set.

Abstract: A protocol analyzer is provided for monitoring a selected communication connection being conducted in accordance with a predetermined protocol by the exchange of protocol data units between two entities over a data network. The analyzer includes a monitoring device for identifying protocol data units, a protocol-follower conditioned in dependence on said predetermined protocol and operative to follow the progress of the connection as it receives relevant protocol data units from the monitoring device, and an alarm indicating when the sequence of protocol data units diverges from the protocol. The protocol data units are passed through a FIFO store as they are used by the protocol-follower, so that on a protocol violation occurring, the sequence of protocol data units leading up to the violation can be extracted from the FIFO store and displayed.