Abstract: A system and method determines correlations within multi-tier communications based on repeated iterations/episodes of executions of a target application. Content-based correlations are determined by encoding the content using a finite alphabet, then searching for similar sequences among the multiple traces. By encoding the content to a finite alphabet, common pattern matching techniques may be used, including, for example, DNA alignment algorithms. To facilitate alignment of the traces, structural and/or semantic breakpoints are defined, and the encoding in each trace is synchronized to these breakpoints. To facilitate efficient processing, a hierarchy of causality among tier-pairs is identified, and messages at lower levels are ranked and temporally filtered, based on activity intervals at higher levels of the hierarchy.

Abstract: Multiple parent-dependencies are identified for messages that are received on a network that includes nodes that are configured to avoid the conventional strictly-sequential communications techniques and protocols, in order to accelerate network performance. If a network is known, or assumed, to include intermediate/proxy nodes that are configured to provide acceleration, access control, and other services, the system that analyzes traffic on the network is configured to assume that these nodes may/will provide such features, and thereby introduce multiple dependencies among the messages communicated across the network. For each message transmitted from a forwarding node, messages received at the forwarding node are assessed to distinguish messages from the destination node and messages from an other node, and a dependency is defined for each.

Abstract: A network capture element is embodied on a virtual machine, and a utility function is embodied on the actual device, preferably within the virtual machine manager. Both the utility function and the traffic capture element are configured to monitor communication events. To minimize the overhead imposed, the utility function is configured to merely store the time that the event occurred on the actual machine, corresponding to an identifier of the event. The network capture element, on the other hand, performs the time consuming tasks of filtering the communications, selectively storing some or all of the data content of the communications, characterizing the data content, and so on. Instead of storing the virtual time that the communication event occurred at the virtual machine, the network capture element uses the identifier of the communication event to retrieve the actual time that the communication event occurred on the actual machine.

Abstract: Individual network activities are correlated to interactions with a target web page to facilitate an analysis of the performance of the web page. This correlation is preferably performed using a combination of heuristics and rules developed to filter network activities into those activities that are likely to have been caused by the particular transaction, and those that are unlikely to be associated with that transaction. The activities that are identified as being associated with the transaction are subsequently organized to identify a time-flow of these activities within the transaction, from which performance statistics can be determined and presented to a user. Because the individual activities within the transaction are identified and time-ordered, an analysis of the effects of each activity on the overall performance of the web page can be performed to identify potential problem areas, or to diagnose reported problems.

Abstract: Data representing application deployment attributes, network topology, and network performance attributes based on a reduced set of element attributes is utilized to simulate application deployment. The data may be received from a user directly, a program that models a network topology or application behavior, and a wizard that implies the data based on an interview process. The simulation may be based on application deployment attributes including application traffic pattern, application message sizes, network topology, and network performance attributes. The element attributes may be determined from a lookup table of element operating characteristics that may contain element maximum and minimum boundary operating values utilized to interpolate other operating conditions.

Abstract: Time-varying latency is estimated based on the round-trip time between the time of sending a message and the time of receiving an acknowledgement of receipt of the message. The round-trip time relative to a transmitter is modeled as a combination of known, or determinable, delays, plus an unknown latency, plus a processing/acknowledgement delay at the receiver. The estimated time-varying latency is further refined to give more weight to estimates based on fewer unknowns or a lesser magnitude of unknowns, and to impose physical constraints, such as assuring that the estimate does not imply an unrealizable event. TCP-specific constraints and assumptions are also applied to further refine the latency estimates.

Abstract: Application messages are segregated into message paths, and the delays of the transmitted packets associated with each message path are independently analyzed to distinguish propagation, bandwidth, congestion, and protocol delays. To further distinguish the congestion delays, all of the paths of the application messages are assessed to identify delays induced by the application, including self-congestion delay, corresponding to pre-congestion delays caused by attempting to send data from a source device faster than the bandwidth of the channel allows, and cross-congestion delay, corresponding to post-congestion delays caused by varying delays beyond a bottleneck link in the channel. The remaining congestion delay is identified as network congestion delay, corresponding to delays caused by network devices other than the source device. After identifying each of the components of delay, the effect of each component on the overall delay is determined to identify where improvements can best be made.

Abstract: An application records memory allocations and releases as they occur over time, and an analysis system presents characteristic memory utilization patterns to a user for review and analysis. A variety of sampling techniques are used to minimize the impact of this memory utilization monitoring on the performance of the application, and the analysis system is configured to estimate the overall memory utilization based on these samples. Because these samples of the memory allocations are taken continuously as the application is running, the analysis system can provide visualizations of the memory utilization patterns that allow a user to easily recognize anomalous behavior. The analysis system includes an interactive interface that allows the user to trace the cause of the presented memory utilization patterns, and provides statistics regarding memory allocation and release to guide the user in this analysis.

Abstract: A system/method searches a traffic stream for a sequence of “matching” packets that exhibit a high degree of correlation or similarity to a sequence of “reference” packets. The correlation between matching and reference packets is based on a degree of correspondence between individual packets, as well as the sequence-order of the corresponding packets. A variation of the Needleman-Wunsch algorithm is preferably used to select corresponding packets in the traffic stream that provide a sequence-order that best matches the sequence-order of the reference packets, based on a measure of the correspondence for each match, and a penalty associated with each non-match. The algorithm is further modified to reduce the required search-space for finding corresponding packets in the traffic stream.

Abstract: In a network that includes intermediary nodes, such as WAN accelerators, that transform messages between nodes, an end-to-end path of the messages is determined. The determined end-to-end path is used in subsequent analyses of message traces, to identify timing and other factors related to the performance of the network relative to the propagation of these messages, including the propagation of the transformed messages. A variety of techniques are presented for determining the path of the messages, depending upon the characteristics of the collected trace data. Upon determining the message path, the traces are synchronized in time and correlations between the connections along the path are determined, including causal relationships. In a preferred embodiment, a user identifies an application process between or among particular nodes of a network, and the system provides a variety of formats for viewing statistics related to the performance of the application on the network.

Abstract: Multiple parent-dependencies are identified for messages that are received on a network that includes nodes that are configured to avoid the conventional strictly-sequential communications techniques and protocols, in order to accelerate network performance. If a network is known, or assumed, to include intermediate/proxy nodes that are configured to provide acceleration, access control, and other services, the system that analyzes traffic on the network is configured to assume that these nodes may/will provide such features, and thereby introduce multiple dependencies among the messages communicated across the network. For each message transmitted from a forwarding node, messages received at the forwarding node are assessed to distinguish messages from the destination node and messages from an other node, and a dependency is defined for each.

Abstract: A system and method for determining a common time base among nodes in a network by iteratively propagating timing constraints among the nodes, and determining a time-shift to apply to the time base of each node that conforms to these constraints. “Trace” files record the time of transmission or reception of packets at each node, based on the time base at the node. A fundamental constraint in a common time-based system is that the time of reception of a packet at a destination node cannot be prior to the time of transmission of the packet from a source node. A further constraint in a common time-based system is that the time of reacting to an event cannot be prior to the time of the event.

Abstract: A multi-functional graphical user interface facilitates the analysis and assessment of application delays, including delays that occur on multiple paths. A trace file of an application's network events is processed to categorize the causes of delays incurred in the propagation and processing of these events. The system identifies the amount of delay (‘component delay’) that can be eliminated by eliminating each of the components of delay individually, as well as the amount of delay (‘parallel delay’) that can be eliminated by eliminating combinations of the delay components. A user interface displays the amount of reduction that can be achieved by eliminating each component delay individually and the amount of reduction that can be achieved by eliminating combinations of the individual component delays.

Abstract: A method for remapping a Media Access Control (MAC) address mapped to a virtual IP address. The method includes examining an activity data file to identify the virtual IP address mapped to the MAC address and remapping the identified MAC address to an IP address. The virtual IP address may be identified utilizing a criteria, such as by determining that the virtual IP address may have two or more mapped MAC addresses. Other criteria may also be suitably employed. A portion of the IP address may be automatically generated. A user may be queried to confirm the generated portion of the IP address. The portion of the IP address may be determined based on prior user entrance of an IP address. The portion of the IP address may be predetermined by a user assigning a naming convention.

Abstract: A simulation system and method that combines the advantages of both analytical modeling and discrete-event simulation is disclosed. In a preferred embodiment of this invention, traffic on the network is modeled as a combination of background-traffic and explicit-traffic. The background-traffic is primarily processed in an analytical form, except in the “time-vicinity” of an explicit-event. Explicit-events are processed using discrete-event simulation, and the modeled effects are dependent upon the background-traffic. At each occasion that the background-traffic may affect the explicit-traffic, the background-traffic is particularized into events that are modeled at the lower detail level of the explicit-traffic.