Abstract: Disclosed are a method, system, and computer program product for determining a common factor contributing to network activity with reduced computational resource utilization. In some embodiments of the present invention, the method or the system determines one or more factors by examining one or more information transmitted across the network. The method or the system stores a number of information attributable to each of the factors and determines whether the number exceeds a threshold requirement. Where the number for a factor exceeds the threshold requirement, the method or the system then determines a summary statistic for the number of information. Thereafter, the method or the System updates the data structure corresponding to the factor being analyzed based upon the summary statistic. Once the data structure is updated based upon the summary statistic, the method or the system determine one or more common factors for the network activities.

Abstract: Disclosed are a method, system, and computer program product for identifying one or more common factors or causes which explain the one or more network threshold violations. In one embodiment, the method or the system identifies one or more network components within a network and then identifies which of the one or more network components is overloaded. The method or the system then identifies one or more simple factors for the identified network components where the one or more simple factors constitute one or more causes for overloaded network activity. The method or the system then determines a scaled composite weight for a simple factor to determine whether the scaled composite weight exceeds a second threshold. If certain simple factors are determined to exceed the second threshold, such simple factors are added to a list of common factors which are in turn stored in a tangible computer accessible medium.

Abstract: Disclosed are a method, system, and computer program product for identifying one or more common factors or causes which explain the one or more network threshold violations. In one embodiment, the method or the system identifies one or more network components within a network and then identifies which of the one or more network components is overloaded. The method or the system then identifies one or more simple factors for the identified network components where the one or more simple factors constitute one or more causes for overloaded network activity. The method or the system then determines a scaled composite weight for a simple factor to determine whether the scaled composite weight exceeds a second threshold. If certain simple factors are determined to exceed the second threshold, such simple factors are added to a list of common factors which are in turn stored in a tangible computer accessible medium.

Abstract: Disclosed are a method, system, and computer program product for determining a common factor contributing to network activity with reduced computational resource utilization. In some embodiments of the present invention, the method or the system determines one or more factors by examining one or more information transmitted across the network. The method or the system stores a number of information attributable to each of the factors and determines whether the number exceeds a threshold requirement. Where the number for a factor exceeds the threshold requirement, the method or the system then determines a summary statistic for the number of information. Thereafter, the method or the System updates the data structure corresponding to the factor being analyzed based upon the summary statistic. Once the data structure is updated based upon the summary statistic, the method or the system determine one or more common factors for the network activities.

Abstract: The network monitoring system includes a monitor device coupling to a network switch through a mirror port interface of the network switch. The network switch supports a number of regular port interfaces connected to different network components and the mirror port connected to the monitor device. The mirror port mirrors all network traffic of any selected regular port interfaces of the network switch. When the monitor device receives a data packet from the network switch, the monitor device extracts the network address information from such as the source and destination address from the data packet. The monitor device then examines internal lookup tables to determine whether there are corresponding physical port interface for the network address information. If the corresponding physical port interfaces for the network address information are not available in the lookup table, the monitor device interrogates the network switch for the corresponding physical port interface.

Abstract: A network monitoring system and method for analyzing network traffic is provided. This network monitoring system and method employ flow monitoring to analyze the traffic flow inside a switching device. All message packets entering the switching device are filtered and then sampled. After message packets are sampled, the switching device generates reporting packets containing network information related to the sampled packets. These reporting packets are then transmitted to a monitor server for analysis. Generally, the monitor server is coupled to a number of the switching devices so that the overall performance of the network can be gathered and presented to the users.

Abstract: A method of monitoring traffic flow within a network of nodes, and a recordable medium containing a computer program with instructions that, when executed, performs such method, is provided. The method comprises assigning sampling points to a node or unique pair of nodes. In one method, the sampling points contained within the assigned subset are determined to be the most likely to monitor data traffic, and preferably all data traffic, associated with the node or node pair. The sampling point subset may automatically be determined and assigned to the node or node pair, and such assignment can be based on historical traffic within the network. The method further comprises collecting diagnostic network traffic data from the sampling points, and obtaining sampled traffic flow counts for a flow associated with a node pair from the diagnostic traffic data collected from the sampling points assigned to the source and destination nodes of the node pair.

Abstract: A network monitoring system and method for analyzing network traffic is provided. This network monitoring system and method employ flow monitoring to analyze the traffic flow inside a switching device. All message packets entering the switching device are filtered and then sampled. After message packets are sampled, the switching device generates reporting packets containing network information related to the sampled packets. These reporting packets are then transmitted to a monitor server for analysis. Generally, the monitor server is coupled to a number of the switching devices so that the overall performance of the network can be gathered and presented to the users.

Abstract: A network monitoring system and method for analyzing network traffic is provided. This network monitoring system and method employ flow monitoring to analyze the traffic flow inside a switching device. All message packets entering the switching device are filtered and then sampled. After message packets are sampled, the switching device generates reporting packets containing network information related to the sampled packets. These reporting packets are then transmitted to a monitor server for analysis. Generally, the monitor server is coupled to a number of the switching devices so that the overall performance of the network can be gathered and presented to the users.