Abstract: A network configuration is processed to identify each policy and the criteria associated with each policy. The criteria of the policies are processed to identify a non-overlapping set of ranges of the criteria parameter, each range being associated with a particular policy or set of policies. In a preferred embodiment, the criteria include the protocol, the source and destination IP addresses, and the source and destination ports, and a default range is defined for each criteria parameter.

Abstract: Multiple parent-dependencies are identified for messages that are received on a network that includes nodes that are configured to avoid the conventional strictly-sequential communications techniques and protocols, in order to accelerate network performance. If a network is known, or assumed, to include intermediate/proxy nodes that are configured to provide acceleration, access control, and other services, the system that analyzes traffic on the network is configured to assume that these nodes may/will provide such features, and thereby introduce multiple dependencies among the messages communicated across the network. For each message transmitted from a forwarding node, messages received at the forwarding node are assessed to distinguish messages from the destination node and messages from an other node, and a dependency is defined for each.

Abstract: A system and method optimizes the information flow regarding node location across a network by controlling the propagation of this information based on distance from the node. Location servers that are near to a node receive detailed information regarding the node's location; location servers that are farther from the node receive less detailed information. In like manner, periodic updates are provided less frequently to distant location servers, and preferably also based on the velocity of a mobile node, or on a priority associated with the mobile node. The location information provided in a message addressed to a node can be minimal when the message is transmitted, and additional detail can be added to this location information by routing nodes as the message is routed closer to its destination, based on information provided by the location servers.

Abstract: The physical connection corresponding to IP tunnels in a network are found by tracing through the device configuration and routing tables at the routers in the network to determine the outbound interface associated with each tunnel endpoint, and then inferring a likely return interface associated with the opposite tunnel endpoint. Depending upon the particular configurations, a variety of tests can be applied to validate the inference. Patricia trees are preferably used to store and process the configuration data for efficient tracing through the routing tables at each router.

Abstract: A path-flow formulation of defining MPLS FRR bypass LSPs is presented. The path-flow formulation comprises first identifying a set of candidate bypass LSPs, each of which meets various network constraints and has an explicit route around a network facility to be protected. The constraints may include Quality of Service (QoS) guarantees, implementation requirements, network element resource limitations, and resiliency requirements. The constraints may be user-selected, and may be non-linear. The set of candidate bypass LSPs form a linear programming (LP) problem, or an integer linear programming (ILP) problem if the allowable number of bypass LSPs is constrained. In an optimization step, LP solutions are used to select the bypass LSPs from among the candidate bypass LSPs by allocating bandwidth to them.

Abstract: A graphic user interface facilitates the hierarchical analysis of timing parameters related to network-based applications. At the top level of the hierarchy, the user is presented a summary of the delays incurred while running an application, or while simulating the running of an application, organized by delay categories, including processing delays at each node, as well as propagation delays at each link between nodes. The interface enables a user to “drill down” into lower levels of the timing information hierarchy by ‘clicking’ on currently displayed information. The information is presented in a form most appropriate to the level of analysis. The presentation forms include, for example, pie-charts, multi-variable timing diagrams (in both absolute and relative forms), data exchange charts, and so on, and ‘zoom’ capabilities are provided as appropriate to the particular display form.

Abstract: A system and method to visually navigate hierarchical data groups are provided. If a user wishes to graphically view network traffic data for a particular business group of network nodes, a network topology navigation tool may be provided to display to the user such information that is relevant to the selected business group and the corresponding hierarchy level. The user may also be permitted to access more detailed connection information through appropriate drill-downs.

Abstract: Systems and methods are disclosed for managing services on a network. In one exemplary embodiment, the method includes receiving topologically relevant network information concerning nodes, interfaces, connections and/or protocols; resolving conflicts in the received information; determining and storing a network topology from the received and resolved information; and inferring one or more services based on the stored topology.

Abstract: Channel access delays and reception uncertainty are modeled as protocol-independent generic processes that are optimized for improved simulation performance. The generic process components are designed such that each different protocol can be modeled using an arrangement of these components that is specific to the protocol. In this way, speed and/or accuracy improvements to the generic process components are reflected in each of such protocol models. If an accurate analytic model is not available for the generic process component, a prediction engine, such as a neural network, is preferably used. The prediction engine is trained using the existing detailed models of network devices. Once trained, the prediction engine is used to model the generic process, and the protocol model that includes the generic component is used in lieu of the detailed models, thereby saving substantial processing time.

Abstract: Time-varying latency is estimated based on the round-trip time between the time of sending a message and the time of receiving an acknowledgement of receipt of the message. The round-trip time relative to a transmitter is modeled as a combination of known, or determinable, delays, plus an unknown latency, plus a processing/acknowledgement delay at the receiver. The estimated time-varying latency is further refined to give more weight to estimates based on fewer unknowns or a lesser magnitude of unknowns, and to impose physical constraints, such as assuring that the estimate does not imply an unrealizable event. TCP-specific constraints and assumptions are also applied to further refine the latency estimates.

Abstract: First-order effects of hypothesized fault conditions are determined by propagating discrete test packets between select nodes and noting the change of path, if any, taken by the test packet under each condition relative to the fault-free path. Tools are provided to create classes of node pairs of interest, and test packets are created only for select classes. The network is analyzed to identify fault conditions that are likely to impact system performance, and only these fault conditions are simulated. By providing a methodology for selecting classes of node pairs to test, and prioritizing the faults to simulate, a first-order survivability analysis of large networks can be performed efficiently and effectively. The efficiency of this technique is also enhanced by providing test packets that are representative of a wide range of possible source-destination combinations, and by evaluating only the source-destination combinations that may be directly affected by each fault condition.

Abstract: Application messages are segregated into message paths, and the delays of the transmitted packets associated with each message path are independently analyzed to distinguish propagation, bandwidth, congestion, and protocol delays. To further distinguish the congestion delays, all of the paths of the application messages are assessed to identify delays induced by the application, including self-congestion delay, corresponding to pre-congestion delays caused by attempting to send data from a source device faster than the bandwidth of the channel allows, and cross-congestion delay, corresponding to post-congestion delays caused by varying delays beyond a bottleneck link in the channel. The remaining congestion delay is identified as network congestion delay, corresponding to delays caused by network devices other than the source device. After identifying each of the components of delay, the effect of each component on the overall delay is determined to identify where improvements can best be made.

Abstract: An interactive system and method automates the control and management of routing changes that are focused on specific routes or particular network hot spots. Based on the premise that the user is aware of a particular problem that needs to be solved, the system leads the user through an end-to-end process from the identification of the problem to the generation of configuration instructions for effecting a selected solution. A graphic user interface provides a visualization of the current routing and alternative routings, to facilitate the analysis and selection of an improved routing, if any. Throughout the process, the effect of each proposed routing change on the overall network performance is determined, so that the selection of a preferred solution can be made in the appropriate context, and globally sub-optimal solutions can be avoided.

Abstract: A Composite Pattern with BLOB data types is used to model a hierarchical network, and includes a path-like construct for locating each component within the network model. Database procedures are used to efficiently search, modify and retrieve individual nodes from the network model using the database server's memory pool so that client applications are not required to retrieve and deserialize the entire Composite-BLOB hierarchy in order to make modifications or search for individual elements, thereby substantially reducing the transfer of data between the application layer and database. To avoid the need for dynamic memory restructuring during deserialization, the size required to store component data at each composite is stored when the composite is serialized, and during deserialization, the size is retrieved and used to obtain sufficient memory for the deserialized composite.

Abstract: A system/method searches a traffic stream for a sequence of “matching” packets that exhibit a high degree of correlation or similarity to a sequence of “reference” packets. The correlation between matching and reference packets is based on a degree of correspondence between individual packets, as well as the sequence-order of the corresponding packets. A variation of the Needleman-Wunsch algorithm is preferably used to select corresponding packets in the traffic stream that provide a sequence-order that best matches the sequence-order of the reference packets, based on a measure of the correspondence for each match, and a penalty associated with each non-match. The algorithm is further modified to reduce the required search-space for finding corresponding packets in the traffic stream.

Abstract: A network monitoring device configured to collect a new packet from one or more observation points of a network and to compare the new packet with a list of a number of received packets based on a packet arrival rate and to identify a duplicate packet. In particular, the number of received packets in the list is equivalent to a number of packets received within a time period, i.e. the packet arrival rate. Stated differently, the network monitoring device is to compare the new packets with received packets stored in a queue of a buffer and wherein the queue has a size based on a packet arrival rate collected at one or more observation points. In addition, the time period is further adjusted according to a threshold value. The threshold value is a variable parameter that can be adjusted to compensate for different network deployment. In one embodiment, the threshold value is a time value that is not more than a transmission time of a TCP retransmitted packet.

Abstract: In a network simulation system, a compiler is provided to support incremental updates to the configuration data associated with the modeled network. Each incremental change is identified and logged, to facilitate configuration management and select roll-backs to prior configurations. Because each update is processed and managed individually, and integrated automatically into the overall system configuration, the overhead associated with keeping a configuration database up-to-date is substantially reduced, thereby increasing the likelihood that all configuration changes will be reflected in the modeled network. In a preferred embodiment, the same data is used to incrementally update the configuration model and to execute the change in the actual system, thereby further reducing the overhead and assuring a correspondence between the modeled network and the actual network.

Abstract: A routing validation method and system identifies routers that are likely to be the cause of differences in forwarding tables associated with two versions of a network. Each destination sub-network prefix is processed to identify all the routers that exhibit differences in their forwarding table for this prefix. Each router exhibiting a difference is assessed to determine whether the difference may have been propagated to this router from another router. If the difference could not have been propagated from another router, this router is identified as a potential source of the observed difference. By eliminating routers that could have received the effects of the differences from another router, the task of identifying the root cause of the observed differences is substantially reduced in complexity.

Abstract: Traffic flows through an administered network from an off-network source and/or to an off-network destination are simulated and analyzed by selecting an ingress and/or egress node within the administered network, the ingress node capable of collecting traffic from an off-network source, and the egress node capable of routing traffic to an off-network destination. Traffic flow is mapped from the source or ingress node through the administered network to the egress node. The traffic flow may be simulated and analyzed. The ingress and/or egress nodes may be selected in a variety of ways.

Abstract: An existing network configuration is assessed, and potential changes to the existing configuration are identified that provide the greatest incremental improvements to the performance of the network. In a preferred embodiment, the user of the system identifies the maximum number (N) of changes that may be implemented in an existing network, and the system provides a set of possible reconfigurations, each requiring fewer than N changes. The user is presented a display of the potential improvement provided by each set as a function of the number of changes in the set, so that the relative incremental gain can be easily visualized. The objective function of the optimization may include conventional load-balancing objectives, or other objectives, such as a global minimization of path lengths.