Abstract: A method for controlling large flows in a network includes asynchronously calculating a traffic rate associated with a network flow by a controller device based on a randomly sampled packet, comparing the calculated traffic rate with a threshold value, and generating a notification of a large flow when the rate exceeds the threshold value. The method further includes creating a filter in response to the notification, assigning an action to the filter, and installing the filter and the action in a network device. In addition, the method includes removes the installed filter and action from the network device after a time interval has elapsed.

Abstract: A network traffic controller includes components adapted to receive traffic from a multitude of switches and to compare the traffic data to one or more threshold values. The threshold values may represent usage quotas. If the traffic generated by a host is detected as exceeding such usage quota, a traffic control signal is sent to the switch connecting the host to the network. The control signal may instruct the switch to mark the associated host's traffic as low priority, or rate limit the interface so as to limit the amount of traffic that is allowed onto the network, or block the traffic altogether.

Abstract: A method for calculating rates based on random sampling includes updating at least one state variable when sampled information is received. The method further includes calculating a rate value based on the state variable and the elapsed time since the state variable was previously updated.

Abstract: A method of optimizing network traffic includes, in part, measuring amounts of traffic exchange between each of a multitude of hosts disposed in the network, identifying a network domain to which each of the multitude of hosts is connected, calculating a net increase or decrease in inter-domain traffic associated with moving each of the multitude of hosts among the network domains in order to generate a list, and ranking the list of moves by net saving in the inter-domain traffic. The highest ranked move may be automatically applied so as to change the network domain to which the host associated with the highest ranked move is connected. The hosts may be virtual machines. Optionally, a change in the inter-domain traffic as a result of moving a first host in accordance with the list occurs only if one or more conditions are met.

Abstract: A method for controlling large flows in a network includes asynchronously calculating a traffic rate associated with a network flow by a controller device based on a randomly sampled packet, comparing the calculated traffic rate with a threshold value, and generating a notification of a large flow when the rate exceeds the threshold value. The method further includes creating a filter in response to the notification, assigning an action to the filter, and installing the filter and the action in a network device. In addition, the method includes removes the installed filter and action from the network device after a time interval has elapsed.

Abstract: A method for calculating rates based on random sampling includes updating at least one state variable when sampled information is received. The method further includes calculating a rate value based on the state variable and the elapsed time since the state variable was previously updated.

Abstract: To generate performance statistics of a host, a physical or virtual component of the host is associated with network interface information corresponding to one or more physical or virtual network interface devices disposed in the host. The performance statistics of the physical or virtual component together with the associated network interface information are periodically transmitted. The network interface information may be a MAC address or an SNMP ifIndex associated with the physical or virtual network interface devices. The SNMP ifIndex may be used to retrieve a corresponding MAC address. The transmitted network interface information is used to analyze the performance statistics of the associated physical or virtual component. The performance statistic may represent a CPU usage, a memory usage, a disk usage, an I/O usage, power consumption, or temperature of the physical or virtual component.

Abstract: To monitor networked application transactions, the application transactions are sampled and data related thereto are collected. The collected data is associated with a global network identifier corresponding to one or more physical or virtual network interface devices. One or more subsets of the collected data are transmitted in packets. The global network identifier may be a layer 4 socket, one or more MAC address associated with one or more physical or virtual interface devices, or one or more SNMP ifIndex associated with one or more physical or virtual interface devices. Data related to network components are optionally collected and combined with the data related to network components that share the global network identifier associated with the application transaction. The combined data is analyzed to determine one or more network resources associated with the application or at least one statistical characteristic of the networked application.

Abstract: A method of optimizing network traffic includes, in part, measuring amounts of traffic exchange between each of a multitude of hosts disposed in the network, identifying a network domain to which each of the multitude of hosts is connected, calculating a net increase or decrease in inter-domain traffic associated with moving each of the multitude of hosts among the network domains in order to generate a list, and ranking the list of moves by net saving in the inter-domain traffic. The highest ranked move may be automatically applied so as to change the network domain to which the host associated with the highest ranked move is connected. The hosts may be virtual machines. Optionally, a change in the inter-domain traffic as a result of moving a first host in accordance with the list occurs only if one or more conditions are met.

Abstract: A method and system for monitoring traffic flow includes assigning a subset of sampling points to a node or unique pair of nodes. The sampling points are determined to be the most likely to monitor data traffic, and preferably all data traffic, associated with the node or node pair. The sampling point subset may automatically be determined and assigned to the node or node pair, based, for example, on historical traffic within the network. The method further includes collecting diagnostic network traffic data from the sampling points, and obtaining sampled traffic flow counts for a flow associated with a node pair from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes of the node pair. The method further includes performing a function on the sampled traffic flow counts to obtain an estimated traffic flow count for the respective flow.

Abstract: To generate performance statistics of a host, a physical or virtual component of the host is associated with network interface information corresponding to one or more physical or virtual network interface devices disposed in the host. The performance statistics of the physical or virtual component together with the associated network interface information are periodically transmitted. The network interface information may be a MAC address or an SNMP ifIndex associated with the physical or virtual network interface devices. The SNMP ifIndex may be used to retrieve a corresponding MAC address. The transmitted network interface information is used to analyze the performance statistics of the associated physical or virtual component. The performance statistic may represent a CPU usage, a memory usage, a disk usage, an I/O usage, power consumption, or temperature of the physical or virtual component.