Abstract: A system/method searches a traffic stream for a sequence of “matching” packets that exhibit a high degree of correlation or similarity to a sequence of “reference” packets. The correlation between matching and reference packets is based on a degree of correspondence between individual packets, as well as the sequence-order of the corresponding packets. A variation of the Needleman-Wunsch algorithm is preferably used to select corresponding packets in the traffic stream that provide a sequence-order that best matches the sequence-order of the reference packets, based on a measure of the correspondence for each match, and a penalty associated with each non-match. The algorithm is further modified to reduce the required search-space for finding corresponding packets in the traffic stream.

Abstract: In a network simulation system, a compiler is provided to support incremental updates to the configuration data associated with the modeled network. Each incremental change is identified and logged, to facilitate configuration management and select roll-backs to prior configurations. Because each update is processed and managed individually, and integrated automatically into the overall system configuration, the overhead associated with keeping a configuration database up-to-date is substantially reduced, thereby increasing the likelihood that all configuration changes will be reflected in the modeled network. In a preferred embodiment, the same data is used to incrementally update the configuration model and to execute the change in the actual system, thereby further reducing the overhead and assuring a correspondence between the modeled network and the actual network.

Abstract: A routing validation method and system identifies routers that are likely to be the cause of differences in forwarding tables associated with two versions of a network. Each destination sub-network prefix is processed to identify all the routers that exhibit differences in their forwarding table for this prefix. Each router exhibiting a difference is assessed to determine whether the difference may have been propagated to this router from another router. If the difference could not have been propagated from another router, this router is identified as a potential source of the observed difference. By eliminating routers that could have received the effects of the differences from another router, the task of identifying the root cause of the observed differences is substantially reduced in complexity.

Abstract: Traffic flows through an administered network from an off-network source and/or to an off-network destination are simulated and analyzed by selecting an ingress and/or egress node within the administered network, the ingress node capable of collecting traffic from an off-network source, and the egress node capable of routing traffic to an off-network destination. Traffic flow is mapped from the source or ingress node through the administered network to the egress node. The traffic flow may be simulated and analyzed. The ingress and/or egress nodes may be selected in a variety of ways.

Abstract: An existing network configuration is assessed, and potential changes to the existing configuration are identified that provide the greatest incremental improvements to the performance of the network. In a preferred embodiment, the user of the system identifies the maximum number (N) of changes that may be implemented in an existing network, and the system provides a set of possible reconfigurations, each requiring fewer than N changes. The user is presented a display of the potential improvement provided by each set as a function of the number of changes in the set, so that the relative incremental gain can be easily visualized. The objective function of the optimization may include conventional load-balancing objectives, or other objectives, such as a global minimization of path lengths.

Abstract: A distributed network monitoring system includes a central monitoring device configured to fetch network traffic information from one or more remote monitoring devices in response to receiving a notification from the remote monitoring devices that the network traffic information is available, the remote monitoring devices being communicatively coupled to the central monitoring device. The network traffic information is associated with a timestamp which indicates a time period at which the network traffic information was collected by the remote monitoring devices. The central monitoring device further synchronizes the network traffic information from the remote monitoring devices by comparing the timestamp of the network traffic information with a system timestamp provided by a system clock or network time protocol (NTP) server. The network traffic information is identified as unavailable if the timestamp cannot be located when compared to the system timestamp.

Abstract: A system and method for determining a common time base among nodes in a network by iteratively propagating timing constraints among the nodes, and determining a time-shift to apply to the time base of each node that conforms to these constraints. “Trace” files record the time of transmission or reception of packets at each node, based on the time base at the node. A fundamental constraint in a common time-based system is that the time of reception of a packet at a destination node cannot be prior to the time of transmission of the packet from a source node. A further constraint in a common time-based system is that the time of reacting to an event cannot be prior to the time of the event.

Abstract: A control node of a communication network is operated at a packet bandwidth determined according to observations of performance metrics of the network at the control point. These performance metrics may be one or more of throughput, average fetch time and packet loss. The control node is operated so as to set a control bandwidth to corresponding resonance points of the performance metrics. The resonance points are determined by scanning across a range of control bandwidths, until one or more of the performance metrics is/are optimized. The packet bandwidth is set by varying an inter-packet delay time over selected communication links at the control node.

Abstract: A system and method to visually navigate hierarchical data groups are provided. If a user wishes to graphically view network traffic for a particular business group of network nodes, a network topology navigation tool may be provided to display to the user such information that is relevant to the selected business group and the corresponding hierarchy level. The user may also be permitted to access more detailed connection information through appropriate drill-downs.

Abstract: For each of a number of network performance metrics, an associated value rpm that represents a difference between a first correlation coefficient r1 computed for a baseline data set and a second correlation coefficient r2 computed for a second data set that includes the baseline data set and other data points classified as duration outliers is computed. The first and second correlation coefficients for each network performance metric represent correlation between that network performance metric and durations of network connections. The network performance metric that has a largest associated rpm value of all statistically significant rpm values computed is selected as representing the probable root cause of the duration outliers. Statistical significance is measured through comparison of an rpm value with a statistical property of a set of Bayesian correlation coefficients computed for each performance metric.

Abstract: A simulation method and system partitions network traffic into background traffic and explicit traffic, wherein explicit traffic is processed in detail, and background traffic is processed at a more abstract level. The packets of explicit traffic are modeled in complete detail, so that precise timing and behavior characteristics can be determined, whereas large volumes of traffic are modeled more abstractly as background flows, and only certain aspects, such as routing through the network, are simulated. Tracer packets are used to model the background traffic and carry a number of characteristics of interest for generating simulation results. In this manner, the effect of the background traffic on the explicit traffic can be modeled at each network element. The abstract processing of background traffic is facilitated by techniques that include multi-variate table look-up, neural networks, and the like.

Abstract: A metric monitoring and analysis system including dynamic sampling agents located in monitored system elements and a service management platform. Each sampling agent includes a data adapter collecting metric data in a common format, a threshold generator for determining dynamic metric threshold ranges, an alarm detector generating an indicator when a metric deviates outside a dynamic threshold range or a static threshold, and a deviation tracker generating an alarm severity scores. The service platform includes an alarm analyzer identifying root causes of system alarm conditions by correlation of grouped metrics or forensic analysis of temporally or statistically correlated secondary forensic data or data items from a service model of the system.

Abstract: Nodes of a network may be allocated to a number of logical groups thereof, and storage space within a network traffic monitoring device coupled to the network then allocated so as to ensure network traffic data for at least a minimum number of the nodes of each of the logical groups is stored.

Abstract: A metric monitoring and analysis system including dynamic sampling agents located in monitored system elements and a service management platform. Each sampling agent includes a data adapter collecting metric data in a common format, a threshold generator for determining dynamic metric threshold ranges, an alarm detector generating an indicator when a metric deviates outside a dynamic threshold range or a static threshold, and a deviation tracker generating an alarm severity scores. The service platform includes an alarm analyzer identifying root causes of system alarm conditions by correlation of grouped metrics or forensic analysis of temporally or statistically correlated secondary forensic data or data items from a service model of the system.

Abstract: A network configuration is processed to identify each policy and the criteria associated with each policy. The criteria of the policies are processed to identify a non-overlapping set of ranges of the criteria parameter, each range being associated with a particular policy or set of policies. In a preferred embodiment, the criteria include the protocol, the source and destination IP addresses, and the source and destination ports, and a default range is defined for each criteria parameter.

Abstract: Traffic flow between each pair of nodes in a network are determined based on loads measured at each link and based on gravity measures associated with each node. The gravity measures correspond to a relative likelihood of the node being a source or a sink of traffic, and may be assigned based on ‘soft’ characteristics associated with each node, such as the demographics of the region in which the node is located, prior sinking and sourcing statistics, and so on. Because the assigned gravities are relatively subjective, the gravity measures are used to generate an objective function for solving a system of linear equations, rather than as criteria that must be satisfied in the solution. The measured link loads are allocated among the traffic flows between nodes to at least a given allocation efficiency criteria by solving a system of linear equations with an objective of minimizing a difference between the assigned gravities and the resultant gravities corresponding to the determined flows.

Abstract: Time-varying latency is estimated based on the round-trip time between the time of sending a message and the time of receiving an acknowledgement of receipt of the message. The round-trip time relative to a transmitter is modeled as a combination of known, or determinable, delays, plus an unknown latency, plus a processing/acknowledgement delay at the receiver. The estimated time-varying latency is further refined to give more weight to estimates based on fewer unknowns or a lesser magnitude of unknowns, and to impose physical constraints, such as assuring that the estimate does not imply an unrealizable event. TCP-specific constraints and assumptions are also applied to further refine the latency estimates.

Abstract: A network analysis system provides for a user-definable display of information related to messages communicated on the network. The network analysis system includes one or more display formats that provide a display of message exchanges between nodes of a network, and a display augmenter that provides additional information on the display based on a user-defined visualization. The user defined visualization includes augmenting the display based on user-defined coloring characteristics and/or augmenting the display with user-defined labels. To further facilitate user control of the augmentation of the display, the system accepts user-defined programs for discriminating among messages, for controlling the labeling of messages, and for controlling the coloring of messages and labels. Commonly used user-defined characteristics and labels are stored in a library, for use via a selection from among the library entries.

Abstract: A sub-system is provided to a discrete event simulator (DES) to expedite simulation execution by first detecting a non-quiescent steady-state condition in the simulated system, and when the steady-state condition is detected, the simulator determines a state, and subsequently simulates the system at a skip-ahead time using this determined state, or a predicted state based on the determined state. Convergence analysis is used to determine whether the system is at, or approaching, a steady-state condition. This convergence skip-ahead process achieves faster analysis by avoiding the computation that would conventionally be required to simulate the system behavior during the time interval that is skipped.

Abstract: A system and methods for displaying data distribution information for time-series data is described. The methods include computing a condensed quantile function that may be used to generate approximate histograms for the time-series data, while decreasing the data storage requirements for generating a series of histograms for time-series data. The methods further include displaying the data distribution information using stack-bar histograms, many of which may be shown in a single display to permit a user to discern trends in the data distribution information. Methods for merging condensed quantile function tables are also described.