Abstract: The techniques disclosed herein determine a location independent network delay via a network monitoring device. Such techniques particularly include determining various delays such as a zero window delay, an advertised window delay, and a congestion window delay (including slow start delays).

Abstract: A method for determining a location of a device in a wireless network includes transmitting a digital transmit signal from a digital transmitter including a first antenna. The first antenna is configured to transmit the digital transmit signal to two or more receivers. A first receiver including a second antenna and a second receiver including a third antenna receive the digital transmit signal from the digital transmitter. The digital transmit signal arrives at the receivers at two different time instances as a first digital signal and a second digital signal. A comparison of the digital signals is performed at the processor. A time difference of arrival of the digital signals is determined at the processor based on the performed comparison. The direction of travel of the digital transmit signal is estimated at the processor. A bearing to the digital transmitter is determined.

Abstract: A system and computer-implemented method to test end-to-end performance of a server, wherein the method includes transmitting from a processing device of a remote test system, to at least one monitor device, a proxy-based test for execution by the at least one monitor device to emulate end-user communication using a protocol via one or more networks with a web-based server coupled to the at least one monitor device. The method further includes receiving by the processing device, from the at least one monitor device, responses by the web-based server to the proxy-based test, and performing by the processing device automated web application testing to measure characteristics of communication between the at least one monitor device and the web-based server, the communication including user-emulated messages from the at least one monitor device executing the proxy-based test to the web-based server and corresponding responses from the web-based server.

Abstract: A method for processing time series measurement data is provided. Data including a plurality of network performance metrics is received over a plurality of time periods. The received data is written to a plurality of measure data structures. The measure data structures are stored to a two dimensional array having a first dimension and a second dimension. The first dimension represents time and the second dimension represents a plurality of network entities. Elements of the two-dimensional array are compressed into BLOBs. Each one of the BLOBS is associated with a time period and a measure type associated with the data stored within a corresponding BLOB. The BLOBS are stored in a first table and second table. The first table is indexed by a combination of a network entity and a time period. The second table is indexed by a combination of a network performance metric and a network entity.

Abstract: A system for evaluating available channels in a multi-channel WLAN telecommunication system is provided. The system includes a wireless Access Point (AP) configured to provide communication over a plurality of Very High Throughput (VHT) channels. The system further includes a plurality of mobile stations (STAs) operating in the plurality of VHT channels. The system further includes a network monitoring device. The network monitoring device is configured and operable to capture a plurality of VHT data frames exchanged between the wireless AP and the plurality of STAs. The network monitoring device is further configured and operable to decode at least a portion of each of the captured plurality of VHT data frames to identify utilized VHT channel and extract channel allocation information associated with the identified VHT channel and to generate a quality score for the identified VHT channel based on the extracted channel allocation information.

Abstract: A method for continuous data anomaly detection includes identifying a period of time covered by metrics data stored in a repository. The stored metrics data is categorized into a plurality of non-overlapping time segments. Statistical analysis of the stored metrics data is performed based on the identified period of time. A range of acceptable metric values is dynamically generated based on the performed statistical analysis.

Abstract: A method to configure a measuring device is provided. In other aspects, a server and a non-transitory computer readable storage medium are provided. The method includes receiving a configuration request that specifies configuration criteria for configuring a measuring device to perform a test, wherein the configuration criteria includes configuration instructions, analysis instructions, and visualization instructions, and configuring the measuring device to perform measurements and output measurement data in accordance with the configuration instructions. The method further includes receiving the measurement data output by the measuring device, storing the measurement data received, processing the measurement data stored based on the analysis instructions, and outputting visualization data corresponding to the processed measurement data to a display device based on the visualization instructions.

Abstract: A system and method is provided for deploying a network monitoring agent to monitor a network. The method includes receiving a deployment request to deploy a monitoring agent, the monitoring agent including first executable instructions to monitor the network, the request specifying a region external from the network in which to deploy the monitoring agent. The method further includes installing the monitoring agent for execution within a controlled runtime environment on a host machine, the host machine operating in the specified region and having a single operating system. The monitoring agent is executed within the controlled runtime environment to monitor the network from an external perspective of the network. In the controlled runtime environment, during execution of the monitoring agent, all areas of the operating system that are writable by the monitoring agent are isolated from areas of the operating system that are writable by any other software application using the operating system.

Abstract: A system and computer-implemented method is provided. The method includes receiving measurements obtained at a plurality of locations of a user site and associated with wireless communication quality of multiple channels at the respective locations, determining a channel-location score for each channel for each of the locations based on the measurements obtained for that location, and generating an overall channel score for each channel based on the channel-location scores determined for the channel at each of the locations.

Abstract: A method for visual representation of end user response time (EURT) in a multi-tiered network application is provided. Search criteria for searching a repository of client statistics records is received. The search criteria specifies identification information pertaining to a user of a multi-tiered network application experiencing application performance problems and a time period associated with the application performance problems. The identification information identifies an IP address of user's computing device. A plurality of client statistics records matching the search criteria is retrieved from the repository. The retrieved plurality of client statistics records is sorted based on measurements of performance parameters. A graph representing relevant topology hierarchy of the multi-tiered network application is presented to a user based on the sorted client statistics records. The graph visually identifies connections between nodes of the multi-tiered application.

Abstract: A method for visual representation of EURT is provided. Measurements of performance parameters are collected. Each of the performance parameters corresponds to at least one performance problem domain. The performance parameters include at least a first, second and third parameters. A correlation between at least two of performance parameters is determined. A first graph having a first region representing the first parameter and having a second region representing the second parameter is presented to a user. The first and second regions extend in substantially opposing directions. A second graph representing the third parameter based on the determined correlation between data elements falling within each of the respective performance problem domains is simultaneously presented to the user. The first, second and third parameters are components of the EURT.

Abstract: A system for testing a Voice over IP (VoIP) network is provided. The system includes a monitoring probe connected to the VoIP network. The monitoring probe is configured to answer an incoming call and monitor the VoIP network, in response to receiving the incoming call. The monitoring probe is also configured to terminate the incoming call after a pre-defined period of time. The monitoring probe is further configured to send a quality report indicative of VoIP network performance. The system further includes a mobile device for placing the call to the monitoring probe.

Abstract: A system and computer-implemented method to test end-to-end performance of a server, wherein the method includes transmitting from a processing device of a remote test system, to at least one monitor device, a proxy-based test for execution by the at least one monitor device to emulate end-user communication using a protocol via one or more networks with a web-based server coupled to the at least one monitor device. The method further includes receiving by the processing device, from the at least one monitor device, responses by the web-based server to the proxy-based test, and performing by the processing device automated web application testing to measure characteristics of communication between the at least one monitor device and the web-based server, the communication including user-emulated messages from the at least one monitor device executing the proxy-based test to the web-based server and corresponding responses from the web-based server.

Abstract: A method of monitoring a network is provided that includes receiving a stream of samples having respective network delay values; defining at least one first group of samples having a size defined by a window size; determining respective first network delay characteristics for the first groups based on the network delay values corresponding to the respective samples included in the corresponding group; applying a first test to the first network delay characteristic determined for the respective first groups; adjusting the window size based on a result of the first test associated with the respective first groups; using the adjusted window size, define respective second groups of samples having samples of the stream of samples subsequent to the samples included in the at least one first group; determining a second network delay characteristic for the respective second groups; applying a second test to the second network delay characteristics; and determining whether to generate an alert notification based on a

Abstract: A system and computer-implemented method is provided. The method includes receiving measurements obtained at a plurality of locations of a user site and associated with wireless communication quality of multiple channels at the respective locations, determining a channel-location score for each channel for each of the locations based on the measurements obtained for that location, and generating an overall channel score for each channel based on the channel-location scores determined for the channel at each of the locations.

Abstract: A method and apparatus is disclosed herein for dynamically scaling application performance analysis completeness based on available system resources. In one embodiment, the method comprises monitoring incoming network traffic and a rate at which the traffic is being analyzed and dynamically adjusting application performance analysis completeness, the analysis being performed on the observed network traffic.

Abstract: The techniques disclosed herein determine a location independent network delay via a network monitoring device. Such techniques particularly include determining various delays such as a zero window delay, an advertised window delay, and a congestion window delay (including slow start delays).

Abstract: A distributed network traffic flow monitoring system is provided. The system includes a plurality of network packet flow collector devices for receiving netflow packets associated with a traffic flow activity data at a network connection. The traffic flow activity data includes one or more transmissions between particular source and destination IP addresses. The system further includes a network packet flow coordinator device connected to the plurality of network packet flow collector devices and configured to aggregate probabilistic information related to the traffic flow activity data from the one or more of network packet flow collector devices and to estimate cardinality of the traffic flow activity data based on the aggregated probabilistic information.

Abstract: A storage system includes network monitoring device having NIC coupled to network and configured to capture raw data packets. The system further includes 4 data repositories. A first repository stores captured packets. A second repository stores captured packets' metadata. A third repository stores captured packets' and metadata's timestamp indexed data. A fourth repository stores captured packets' data flow. The storage system further includes a storage engine coupled to the repositories. The storage engine receives packet search criteria specifying at least a first time range. Data flow information associated with the search criteria is retrieved from the fourth repository. The retrieved data flow information is associated with a second, narrower, time range. Metadata information associated with the second time range is retrieved from the second repository using corresponding timestamp indexed data.