Abstract: The embodiments provide for analyzing activity of devices in a network. Activity from a device may result from multiple devices translated to a common address, such as a public internet protocol (IP) address. In some embodiments, the activity from a network or device is analyzed to identify if multiple devices communicate via translated addresses from the common address. The devices may be identified based on various criteria, such as a unique identifier, protocol header information, or a media access control (or “MAC”) address. Other criteria may also be employed. Each device that is mapped to common address is then remapped so that each device has its own address. The activity data is then modified so that each device is correlated with its unique address. Alternatively, a new activity data file may be generated so that the activity of each device is indicated.

Abstract: The present invention relates to correlating requests between a client and a server to a particular transaction. In one embodiment, transactions in a system of clients and servers are monitored and traced. From this information, a context comprising sets or groupings of transaction call sequences are determined. For example, a sequence of method calls on a client process is traced to a socket carrying data for transmission of a request message to a server. In response to this request message, the server then executes a set of method calls that can be correlated to the request message and the socket. This set of actions is considered part of a causally related grouping, and thus, associated together. In one embodiment, HTTP requests from a client may be comprise a unique custom header that is readily identified and traced. For other protocols, a client socket is associated with a corresponding server socket or to data received over a socket receive call.

Abstract: An interactive virtualization management system provides an assessment of proposed or existing virtualization schemes. A Virtual Technology Overhead Profile (VTOP) is created for each of a variety of configurations of host computer systems and virtualization technologies by measuring the overhead experienced under a variety of conditions. The multi-variate overhead profile corresponding to each target configuration being evaluated is used by the virtualization management system to determine the overhead that is to be expected on the target system, based on the particular set of conditions at the target system. Based on these overhead estimates, and the parameters of the jobs assigned to each virtual machine on each target system, the resultant overall performance of the target system for meeting the performance criteria of each of the jobs in each virtual machine is determined, and over-committed virtual machines and computer systems are identified.

Abstract: Simulation models of media access control and physical layer characteristics facilitate the simulation/emulation of a variety of phenomena that affect transmissions via a wireless media. Such phenomena include media access contention delays, packet drops, and retransmissions that are generally dependent upon changes in transmitter/receiver locations. Each wireless environment is characterized by a model of the communication channel that characterizes transmission effects based on the number of competing transmitters in the environment, which is dynamically determined based on the location of each node in the environment. Additionally, the location of nodes is used to simulate the effects of ‘hidden nodes’, nodes that are unknown to a transmitting node but can interfere with the reception of transmissions at a receiving node. Each device/node model in the wireless environment preferably accesses the same model of the communication channel, thereby minimizing the amount of detail required at each device model.

Abstract: The present system includes a system, method and device for inferring connectivity between network devices across a third party network. Configuration data related to the network devices is examined and configuration data about the network is inferred. The inferred configuration data may be related to a communication protocol, network bandwidth, and the like. A model representing the network is then created to indicate inferred interfaces and connections through the external network between network devices. The representation may be rendered in various forms, such as a display or data exported to another system. Various studies may also be performed using the model, such as traffic, routing, or planning studies.

Abstract: An access discovery method and system discovers and stores the proper access protocol for each device on a network. The discovery process includes progressively sequencing through state transitions until a successful access protocol sequence is determined, and an access script corresponding to this sequence is stored for subsequent access to the device. Preferably, the protocol-discovery algorithm is modeled as a state table that includes a start state and two possible terminal states: success and failure. A state machine executes the state table until a terminal state is reached; if the terminal state is a failure, the system backtracks to attempt an alternative sequence. The process continues until the success state is reached or until all possible sequences are executed without success. An exemplary state model is provided that has been shown to be effective for modeling network devices from a variety of vendor devices.

Abstract: A metric tuning technique optimizes the maximum link utilization of a set of links incrementally. Changes to the metric are constrained to be metric increases to divert routes from select links, thereby minimizing the number of changes required to achieve the optimization by avoiding the potential cascade of changes caused by attracting routes to a link. An interactive user interface is provided to allow a user to specify limits and constraints, and to select the sets of links to be addressed, including, for example, only the links that exceed a given link utilization threshold, the links having the highest link utilizations, the links having the highest failure effect, and so on. This incremental optimization technique is also used to optimize network resiliency by minimizing the network degradation caused by the failure of one or more links.

Abstract: The connectivity information provided by a variety of inference engines is integrated to provide a set of inferred links within a network. A consolidation is performed among inference engines that operate at a base level of connectivity detail to create a model of the network at this base level. The connectivity information provided by inference engines at each subsequent higher level of connectivity abstraction is then overlaid on the base level connectivity. By separately consolidating the connectivity information at each level of abstraction, the rules for dealing with conflicts can be simplified and/or better focused to resolve the conflict. By assuming that the more detailed lower level information is likely to be more accurate, rules can be developed to modify the connectivity models produced by the higher level techniques to conform to the lower level connectivity details while still maintaining the integrity of the higher level connectivity models.

Abstract: A system and method for managing captured network traffic data is provided. The invention comprises a plurality of capture agents, each being configured to capture the network traffic associated with one or more applications. Each application is associated with one or more capture agents according to an application profile that is stored and maintained in a capture server. When analysis of an application's network traffic is required, the capture server contacts the corresponding capture agents according to the application profile. The capture server then effects the identification and archiving of the network traffic that corresponds to a user-defined capture condition. A database at the capture server maintains a record that associates the corresponding network traffic with the user-defined capture condition such that the corresponding network traffic can later be retrieved and analyzed using an analysis engine.

Abstract: A simulator simulates routing system protocols to build routing tables corresponding to a modeled network, and a comparator compares the routing tables in the actual network to these simulator-created routing tables. Because the modeled system represents a fault-free version of the actual system, and assuming that the modeled routing system protocols are representative of the algorithms used in the actual routers, these simulator-produced routing tables can represent steady-state routing tables that should be present in the routers of the actual network at steady state. By querying each router in the actual network for its routing table and comparing each routing table to the corresponding simulator-produced routing table, any differences from the steady state can be identified.

Abstract: Systems and methods are disclosed for testing a processor having at least a first interface. In one embodiment, the method includes configuring, at the processor, a second interface, such that the configured second interface has one or more quality of service parameters representative of the first interface; sending one or more packets through the configured second interface, the one or more packets being representative of another packet received at the first interface; and determining, based on the one or more packets, one or more performance parameters corresponding to the first interface under test.

Abstract: A method for remapping a Media Access Control (MAC) address mapped to a virtual IP address. The method includes examining an activity data file to identify the virtual IP address mapped to the MAC address and remapping the identified MAC address to an IP address. The virtual IP address may be identified utilizing a criteria, such as by determining that the virtual IP address may have two or more mapped MAC addresses. Other criteria may also be suitably employed. A portion of the IP address may be automatically generated. A user may be queried to confirm the generated portion of the IP address. The portion of the IP address may be determined based on prior user entrance of an IP address. The portion of the IP address may be predetermined by a user assigning a naming convention.

Abstract: A user interface to a network simulator facilitates the use of application layer parameters and application layer logic. The user interface is configured to allow the user to define the input in a graphic form, or a text/programming form, or a combination of both. Preferably, the user interface provides common graphic forms for both inputting the data to the simulator as well as for displaying the resultant data from the simulator, thereby easing the progression from the analysis of output from one simulation to the generation of new input for a subsequent simulation.

Abstract: A scalable comparison structure and methodology is provided that is suitable for comparing select data content in hundreds or thousands of files in an efficient manner. Section delimiters are defined to identify the sections of the files within which the select data content is located, and sets of unique sections are identified based on the select data content within the section. Thereafter, comparisons and reports are based on these unique content sections. If multiple files include a common set of data, a single unique content section is used to represent these multiple files. File groups are optionally defined, and different sets of select data content can be compared based on these file groups. The result of the comparison is presented in multiple hierarchical forms, including an identification of which files are different from each other, and an identification of the differences among the unique content segments.

Abstract: The physical connection corresponding to IP tunnels in a network are found by tracing through the device configuration and routing tables at the routers in the network to determine the outbound interface associated with each tunnel endpoint, and then inferring a likely return interface associated with the opposite tunnel endpoint. Having determined the physical devices at the source and destination of each tunnel, the physical path between these source and destination devices is traced from the source toward the destination until the path is terminated at the destination device, or at an interface to an external network. If the path ends at an external network, the path is traced from the destination device toward the source device until a corresponding interface to the external network is reached.

Abstract: The present system includes a system, method and device for inferring connectivity between unconnected network segments. In operation, unconnected network segments are identified. Configuration data related to the unconnected network segments may be examined to facilitate inferring configuration data for an external network connected between the unconnected network segments. The inferred configuration data may be rendered, such as exported or visualized. The inferred configuration data may be related to a communication protocol and/or may be related to network bandwidth. The examined configuration data may be captured directly from one or more of the unconnected network segments and/or may be retrieved from a configuration data file, such as a network configuration model.

Abstract: The connectivity information provided by a variety of inference engines is integrated to provide a set of inferred links within a network. A consolidation is performed among inference engines that operate at a base level of connectivity detail to create a model of the network at this base level. The connectivity information provided by inference engines at each subsequent higher level of connectivity abstraction is then overlaid on the base level connectivity. By separately consolidating the connectivity information at each level of abstraction, the rules for dealing with conflicts can be simplified and/or better focused to resolve the conflict. By assuming that the more detailed lower level information is likely to be more accurate, rules can be developed to modify the connectivity models produced by the higher level techniques to conform to the lower level connectivity details while still maintaining the integrity of the higher level connectivity models.

Abstract: A system and method for managing captured network traffic data is provided. The invention comprises a plurality of capture agents, each being configured to capture the network traffic associated with one or more applications. Each application is associated with one or more capture agents according to an application profile that is stored and maintained in a capture server. When analysis of an application's network traffic is required, the capture server contacts the corresponding capture agents according to the application profile. The capture server then effects the identification and archiving of the network traffic that corresponds to a user-defined capture condition. A database at the capture server maintains a record that associates the corresponding network traffic with the user-defined capture condition such that the corresponding network traffic can later be retrieved and analyzed using an analysis engine.

Abstract: Network survivability is quantified in such a way that failure cases can be compared and ranked against each other in terms of the severity of their impact on the various performance measures associated with the network. The degradation in network performance caused by each failure is quantified based on user-defined sets of thresholds of degradation severity for each performance measure. Each failure is simulated using a model of the network, and a degradation vector is determined for each simulated failure. A comparison function is defined to map the degradation vectors into an ordered set, and this ordered set is used to create an ordered list of network failures, in order of the network degradation caused by each failure.

Abstract: A simulator simulates routing system protocols to build routing tables corresponding to a modeled network, and a comparator compares the routing tables in the actual network to these simulator-created routing tables. Because the modeled system represents a fault-free version of the actual system, and assuming that the modeled routing system protocols are representative of the algorithms used in the actual routers, these simulator-produced routing tables will represent the ‘ideal’ routing tables that should be present in the routers of the actual network. By querying each router in the actual network for its routing table and comparing each routing table to the corresponding simulator-produced routing table, any differences from the ‘ideal’ can be identified.