Abstract: A first capture system that captures network communication events related to an application, and a second capture system that captures internal processing events related to the application. A visualization system analyzes the data captured by each of the capture systems, synchronizes and correlates the data, and presents an integrated display of these communication and processing events. In a preferred embodiment, the communicated messages include an identifier of the application, and the processing components also associate an identifier of the application to each recorded processing event. To facilitate the integrated display of the events, the visualization system synchronizes the recorded communication and processing events to a common time base.

Abstract: To evaluate a network's performance in processing communications related to a target transaction, a set of “reference” communications corresponding to the target transaction are compared to a larger set of communications in the network in a “production” environment, to identify the occurrence of the target transaction in the production environment. Preferably, the reference communications are recorded in a laboratory environment that models the production environment, or recorded from the production environment during a period of minimal other activities. A variety of filters are used to eliminate communications in the production environment that are apparently unrelated to the target transaction, including filters based on the time-order of communications among the nodes, the size of the packets being communicated, and the content of the communications.

Abstract: A network analysis system provides for a user-definable display of information related to messages communicated on the network. The network analysis system includes one or more display formats that provide a display of message exchanges between nodes of a network, and a display augmenter that provides additional information on the display based on a user-defined visualization. The user defined visualization includes augmenting the display based on user-defined coloring characteristics and/or augmenting the display with user-defined labels. To further facilitate user control of the augmentation of the display, the system accepts user-defined programs for discriminating among messages, for controlling the labeling of messages, and for controlling the coloring of messages and labels. Commonly used user-defined characteristics and labels are stored in a library, for use via a selection from among the library entries.

Abstract: In a network that includes intermediary nodes, such as WAN accelerators, that transform messages between nodes, an end-to-end path of the messages is determined. The determined end-to-end path is used in subsequent analyses of message traces, to identify timing and other factors related to the performance of the network relative to the propagation of these messages, including the propagation of the transformed messages. A variety of techniques are presented for determining the path of the messages, depending upon the characteristics of the collected trace data. Upon determining the message path, the traces are synchronized in time and correlations between the connections along the path are determined, including causal relationships. In a preferred embodiment, a user identifies an application process between or among particular nodes of a network, and the system provides a variety of formats for viewing statistics related to the performance of the application on the network.

Abstract: A network capture element is embodied on a virtual machine, and a utility function is embodied on the actual device, preferably within the virtual machine manager. Both the utility function and the traffic capture element are configured to monitor communication events. To minimize the overhead imposed, the utility function is configured to merely store the time that the event occurred on the actual machine, corresponding to an identifier of the event. The network capture element, on the other hand, performs the time consuming tasks of filtering the communications, selectively storing some or all of the data content of the communications, characterizing the data content, and so on. Instead of storing the virtual time that the communication event occurred at the virtual machine, the network capture element uses the identifier of the communication event to retrieve the actual time that the communication event occurred on the actual machine.

Abstract: The performance of a monitored system is profiled based on sampling a portion of its operations. In one embodiment, the monitored system allocates memory for objects created as instances of classes and automatically performs regular garbage collection to reclaim memory. A variety of sampling techniques are used to minimize the impact on the performance of the monitored system. Characteristic memory utilization patterns can then be estimated for classes based on the samples. The patterns may be presented to a user for review and analysis. Characteristics of the monitored system's performance may be presented in an interactive interface that allows the user to trace the cause of the presented memory utilization patterns, and provides statistics regarding memory allocation and release to guide the user in this analysis.

Abstract: Individual network activities are correlated to interactions with a target web page to facilitate an analysis of the performance of the web page. This correlation is preferably performed using a combination of heuristics and rules developed to filter network activities into those activities that are likely to have been caused by the particular transaction, and those that are unlikely to be associated with that transaction. The activities that are identified as being associated with the transaction are subsequently organized to identify a time-flow of these activities within the transaction, from which performance statistics can be determined and presented to a user. Because the individual activities within the transaction are identified and time-ordered, an analysis of the effects of each activity on the overall performance of the web page can be performed to identify potential problem areas, or to diagnose reported problems.

Abstract: A user interface to a network simulator facilitates the use of application layer parameters and application layer logic. The user interface is configured to allow the user to define the input in a graphic form, or a text/programming form, or a combination of both. The user interface provides common graphic forms for both inputting the data to the simulator as well as for displaying the resultant data from the simulator. In response, the simulator and user interface may provide updated information to reflect the impact of changes made to application layer parameters and logic.

Abstract: A system and method for managing captured network traffic data is provided. The invention comprises a plurality of capture agents, each being configured to capture the network traffic associated with one or more applications. Each application is associated with one or more capture agents according to an application profile that is stored and maintained in a capture server. When analysis of an application's network traffic is required, the capture server contacts the corresponding capture agents according to the application profile. The capture server then effects the identification and archiving of the network traffic that corresponds to a user-defined capture condition. A database at the capture server maintains a record that associates the corresponding network traffic with the user-defined capture condition such that the corresponding network traffic can later be retrieved and analyzed using an analysis engine.

Abstract: The embodiments provide for analyzing activity of devices in a network. Activity from a device may result from multiple devices translated to a common address, such as a public internet protocol (IP) address. In some embodiments, the activity from a network or device is analyzed to identify if multiple devices communicate via translated addresses from the common address. The devices may be identified based on various criteria, such as a unique identifier, protocol header information, or a media access control (or “MAC”) address. Other criteria may also be employed. Each device that is mapped to common address is then remapped so that each device has its own address. The activity data is then modified so that each device is correlated with its unique address. Alternatively, a new activity data file may be generated so that the activity of each device is indicated.

Abstract: Performance metrics related to the processing and propagation of messages related to select applications are collected during a simulation of a network. Each message associated with an application is tagged, and each simulated packet that contains some or all of a tagged message is correspondingly tagged to facilitate the creation of transmit records and receive records. A post processor is configured to collate transmit and receive records of each tagged message to identify delays associated with each node that processes the message, and each link that propagates the message from node to node within the network. The processed timing information is provided to the user via an interactive user interface that allows the user to view the timing information from an application layer perspective.

Abstract: A method of identifying differences between activity data files includes determining a difference between the activity data files. Causal analysis may be performed to identify a cause of the difference. The difference and/or the cause of the difference may be rendered based on a rendering template. Tier pairs between the activity data files may be matched and a user may be queried to confirm the tier pair match. Statistical and/or protocol differences between each of the activity files may be presented. Transactions between each of the activity data files may be matched including comparing the content files in each of the activity data files that account for the transactions. Client side differences between each of the activity data files may be identified. A categorization may be assigned to each of the determined differences. Determined differences may be excluded from the rendering.

Abstract: A user interface of a device for displaying a representation of a network of objects wherein a plurality of selectable objects are rendered, and each of the plurality of selectable objects are rendered having a given positioning relative to each other of the plurality of selectable objects. One or more edges are rendered interconnecting the plurality of selectable objects within a first region of the user interface. A second region is rendered in response to one or more of the selectable objects of the first region being selected. Objects corresponding to the selected objects are depicted in the second region while maintaining the given relative positioning. A number of additional objects may be retrieved from a database that indicates objects that are adjoining the corresponding objects. The adjoining objects are positioned in the second region and are interconnected to the corresponding objects by one or more additional edges.

Abstract: A system and method determines correlations within multi-tier communications based on repeated iterations/episodes of executions of a target application. Content-based correlations are determined by encoding the content using a finite alphabet, then searching for similar sequences among the multiple traces. By encoding the content to a finite alphabet, common pattern matching techniques may be used, including, for example, DNA alignment algorithms. To facilitate alignment of the traces, structural and/or semantic breakpoints are defined, and the encoding in each trace is synchronized to these breakpoints. To facilitate efficient processing, a hierarchy of causality among tier-pairs is identified, and messages at lower levels are ranked and temporally filtered, based on activity intervals at higher levels of the hierarchy.

Abstract: The locations of nodes in a network are determined relative to the location of monitoring devices that collect trace information on the network. By appropriate sorting, filtering, and characterizing the trace information, nodes are identified as being local to or remote from each monitoring device that detects traffic to or from the node. If the trace information is insufficient to determine the relative location of a node, the node is identified as such. By identifying the nodes whose locations can be determined automatically by this analysis of the trace information, the number of nodes whose locations must be determined by more costly manual methods can be substantially reduced.

Abstract: A first capture system that captures network communication events related to an application, and a second capture system that captures internal processing events related to the application. A visualization system analyzes the data captured by each of the capture systems, synchronizes and correlates the data, and presents an integrated display of these communication and processing events. In a preferred embodiment, the communicated messages include an identifier of the application, and the processing components also associate an identifier of the application to each recorded processing event. To facilitate the integrated display of the events, the visualization system synchronizes the recorded communication and processing events to a common time base.

Abstract: A system and method determines correlations within multi-tier communications based on repeated iterations/episodes of executions of a target application. Content-based correlations are determined by encoding the content using a finite alphabet, then searching for similar sequences among the multiple traces. By encoding the content to a finite alphabet, common pattern matching techniques may be used, including, for example, DNA alignment algorithms. To facilitate alignment of the traces, structural and/or semantic breakpoints are defined, and the encoding in each trace is synchronized to these breakpoints. To facilitate efficient processing, a hierarchy of causality among tier-pairs is identified, and messages at lower levels are ranked and temporally filtered, based on activity intervals at higher levels of the hierarchy.

Abstract: The embodiments facilitate the analysis of application delays, including delays that occur on multiple paths. A trace file of an application's network events is processed to categorize the causes of delays incurred in the propagation and processing of these events. The system identifies the amount of delay that can be eliminated by eliminating each of the components of delay individually, as well as the amount of delay that can be eliminated by eliminating combinations of the delay components. A user interface displays the amount of reduction that can be achieved by eliminating various delays alone or in combination. The interface also allows the user to view the individual delay components contained in combinations of delay components. In this manner, the user is provided a view of each of the delay components that would need to be addressed, either individually or in combination, to improve the overall application delay.

Abstract: The performance of a monitored system is profiled based on sampling a portion of its operations. In one embodiment, the monitored system allocates memory for objects created as instances of classes and automatically performs regular garbage collection to reclaim memory. A variety of sampling techniques are used to minimize the impact on the performance of the monitored system. Characteristic memory utilization patterns can then be estimated for classes based on the samples. The patterns may be presented to a user for review and analysis. Characteristics of the monitored system's performance may be presented in an interactive interface that allows the user to trace the cause of the presented memory utilization patterns, and provides statistics regarding memory allocation and release to guide the user in this analysis.

Abstract: Individual network activities are correlated to interactions with a target web page to facilitate an analysis of the performance of the web page. This correlation is preferably performed using a combination of heuristics and rules developed to filter network activities into those activities that are likely to have been caused by the particular transaction, and those that are unlikely to be associated with that transaction. The activities that are identified as being associated with the transaction are subsequently organized to identify a time-flow of these activities within the transaction, from which performance statistics can be determined and presented to a user. Because the individual activities within the transaction are identified and time-ordered, an analysis of the effects of each activity on the overall performance of the web page can be performed to identify potential problem areas, or to diagnose reported problems.