Abstract: A system for configuring one or more flows of captured data packets through a hybrid communication network is provided. The system includes first and second segments of the hybrid communication network. The first segment includes a stacked topology of communicatively coupled plurality of network captured traffic distribution devices. The second segment includes one or more OpenFlow switches configured for an OpenFlow protocol. The system also includes a management server communicatively coupled to the first and second segments of the hybrid communication network. The management server includes logic adapted to configure one or more data flows of captured data packets with respect to forwarding the captured data packets between the first and second segments of the hybrid communication network.

Abstract: A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.

Abstract: A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.

Abstract: A system and method for correcting clock discrepancy in simultaneous network traffic data captures in a multi-tiered, multi-session environment. The invention uses intrinsic constraints imposed by the nature of the traffic onto the possible temporal sequence of the packets, The invention uses the intrinsic restraints of the network architecture and the protocols used at each segment along with the time stamps in the various segments to determine both an offset and scale correction to the clock readings (timestamps) in the traces in order to obtain a correct temporal sequence of packets when using multiple capture agents/engines/network monitors.

Abstract: Actions of servers and other network devices within a network are monitored to detect whether the servers and network devices are performing tasks, using protocols, and communicating through ports that are consistent with legitimate (or “permissible”) purposes. That is, rather than attempting to belatedly identify malware signatures and screen all traffic into and out of a network for these signatures, embodiments of the present invention scrutinize devices (such as servers and other network infrastructure elements) for malware behavior that is inconsistent with an identified set of actions known to be consistent with legitimate tasks performed by the network device.

Abstract: Systems and methods are described for determining a set of three quality metrics for audio and/or video signals transmitted through a packet network. The set of three metrics provide more insight into which factors are affecting the quality of the received signal as perceived by the end-user. These three quality metrics measure reductions in quality due to lossy media transmission, packet loss concealment from packet loss and/or packet/frame jitter, and long periods of silence and/or frozen video. Because each metric quantifies a different aspect of transmitted quality, a deficiency in the transmitted signal can be identified by reference to the set.

Abstract: A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.

Abstract: Connection activity between a device and service provider's network is monitored. Connection parameters calculated based on the connection activity are stored. An activity map is generated to capture and display the connection parameters which indicate activity or repeated patterns of activity over time. The activity utilizes a time grid to display a plurality of parameter regarding device status and activity. The x-axis of the time grid divides a time period into portions of time at a first time length. The y-axis of the time grid divides the portions of time at the first time length into smaller lengths of time at a second time length. Multiple layers of indicators are used in the time grid to indicate the status of several parameters during the same time period.

Abstract: A probe receives a first packet over a network on a port. A sequence number and synchronization source identifier (SSRC) associated with the first packet are identified. The probe receives a subsequent packet and a sequence number and SSRC associated with the subsequent packet are determined. The probe determines whether the SSRC associated with first packet and the SSRC associated with the subsequent packet match. Additionally, the probe determines whether the sequence number associated with the subsequent packet is within an acceptable range of values related to the sequence number associated with the first packet. Additionally, the probe calculates the time interval between reception of the packets. The probe classifies traffic on the port as RTP or non-RTP traffic based on analysis of the SSRCs, sequence numbers and time intervals.

Abstract: Methods are described that are used to identify quality problems in a wireless communication network as experienced by a user-session of a mobile computing device, and quantify the quality of network transmission associated with the user-session. The quality of transmission during a user-session can then be used to characterize the network quality as experienced by an end user. One benefit of applying the described methods is that the actual quality of network transmissions experienced in a user-session is quantified rather than being inferred from the performance of a radio access network (“RAN”) transceiver. The described methods are used in some examples to determine network quality issues related to user-session characteristics, such as location and mobile computing device type.

Abstract: A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.

Abstract: A specific user is tracked based on the cell site or service area that the user's device connects to. RANAP, GMM, and SM sessions are associated based on P-TMSI, IMSI, or IMEI. The sessions are maintained based on packets transmitted over the IuPS interface between one or more radio network controllers and a serving GPRS support node. Tracking information associated with information includes usage information such as responsiveness errors, device usage and location. Tracking of a user down to the cell site or service area level assists a mobile service provider in troubleshooting connection issues by providing more complete information and enabling recreation of a user's situation.

Abstract: A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.

Abstract: A network monitor that segments data packets at variable locations of data packets and stores a subset of the segments for troubleshooting or analysis. The network monitor selects data packets to be stored based on a set of user-defined classifier rules and discards other data packets. Each data packets selected for storage are analyzed up to an application protocol layer to determine start locations and/or end locations of data fields in the data packet. A set of user-defined slice rules are applied to each analyzed data packets to segment the data packets at the determined locations of the data fields. A subset of the data packet segments is stored in the network monitor. By storing relevant portions of data packets and discarding other portions of the data packets, the amount of data of data to be stored in the network monitor can be significantly reduced.

Abstract: Systems and methods are described for determining a set of three quality metrics for audio and/or video signals transmitted through a packet network. The set of three metrics provide more insight into which factors are affecting the quality of the received signal as perceived by the end-user. These three quality metrics measure reductions in quality due to lossy media transmission, packet loss concealment from packet loss and/or packet/frame jitter, and long periods of silence and/or frozen video. Because each metric quantifies a different aspect of transmitted quality, a deficiency in the transmitted signal can be identified by reference to the set.

Abstract: Network performance data is collected, recorded, and normalized. In one embodiment, a set of first performance data collected by an agent in response to network transactions initiated by the agent and a second set of performance data resulting from passively monitoring traffic on the network are received. The first and second sets of performance data are normalized to create a set of constantly formatted network performance data capable of convenient analysis.

Abstract: A system, method and computer program product are provided for network and network application monitoring. Accordingly, one or more media modules are each coupled to an associated network segment. In the case of network application monitoring, each media module is coupled to a network segment on which a network application is running. Each media module monitors and collects data relating to traffic on the associated network segment corresponding to the network application, wherein each media module is tailored for network analysis. An application server module is coupled to the at least one media module and receives the data and analyzes the data for helping to improve the performance of the network and/or network application.

Abstract: Disclosed methods and systems create channels from a stream of data records relating to electronic data processing system performance. Each data record includes the attribute value for each of a plurality of attributes related to the electronic data processing system. A channel is created for each unique value of a selected attribute or each unique combination of values for a plurality of selected values. Each channel is analyzed to determine if it meets at least one criterion. The unique value or combination of values of a channel meeting the at least one criterion is reported. The foregoing steps may be repeated using the results of previous steps. At least once, a channel is created for each unique combination of attribute values for a plurality of selected attributes.

Abstract: A system and related methods are disclosed for detecting the occurrence of an intrusion attack. A network device, such a probe, monitors traffic on a first network and converts the traffic to a format that is suitable for transmission on a second network. The converted traffic is forwarded to an intrusion detection system for further processing. Prior to transmission, the converted data may be filtered to remove data that is not useful in detecting an intrusion attack.

Abstract: A system and method operates to analyze a data stream, for example, a stream of download times for accessing information through a computer network. The system and method are capable of identifying abnormalities in the data stream compared to previous data in the data stream. More particularly, the system and method is capable of dynamically analyzing a data stream to detect abrupt, severe abnormalities as well subtle changes that occur over time.