Abstract: A distributed network monitoring system includes a central monitoring device configured to fetch network traffic information from one or more remote monitoring devices in response to receiving a notification from the remote monitoring devices that the network traffic information is available, the remote monitoring devices being communicatively coupled to the central monitoring device. The network traffic information is associated with a timestamp which indicates a time period at which the network traffic information was collected by the remote monitoring devices. The central monitoring device further synchronizes the network traffic information from the remote monitoring devices by comparing the timestamp of the network traffic information with a system timestamp provided by a system clock or network time protocol (NTP) server. The network traffic information is identified as unavailable if the timestamp cannot be located when compared to the system timestamp.

Abstract: A system and method for determining a common time base among nodes in a network by iteratively propagating timing constraints among the nodes, and determining a time-shift to apply to the time base of each node that conforms to these constraints. “Trace” files record the time of transmission or reception of packets at each node, based on the time base at the node. A fundamental constraint in a common time-based system is that the time of reception of a packet at a destination node cannot be prior to the time of transmission of the packet from a source node. A further constraint in a common time-based system is that the time of reacting to an event cannot be prior to the time of the event.

Abstract: A control node of a communication network is operated at a packet bandwidth determined according to observations of performance metrics of the network at the control point. These performance metrics may be one or more of throughput, average fetch time and packet loss. The control node is operated so as to set a control bandwidth to corresponding resonance points of the performance metrics. The resonance points are determined by scanning across a range of control bandwidths, until one or more of the performance metrics is/are optimized. The packet bandwidth is set by varying an inter-packet delay time over selected communication links at the control node.

Abstract: A system and method to visually navigate hierarchical data groups are provided. If a user wishes to graphically view network traffic for a particular business group of network nodes, a network topology navigation tool may be provided to display to the user such information that is relevant to the selected business group and the corresponding hierarchy level. The user may also be permitted to access more detailed connection information through appropriate drill-downs.

Abstract: For each of a number of network performance metrics, an associated value rpm that represents a difference between a first correlation coefficient r1 computed for a baseline data set and a second correlation coefficient r2 computed for a second data set that includes the baseline data set and other data points classified as duration outliers is computed. The first and second correlation coefficients for each network performance metric represent correlation between that network performance metric and durations of network connections. The network performance metric that has a largest associated rpm value of all statistically significant rpm values computed is selected as representing the probable root cause of the duration outliers. Statistical significance is measured through comparison of an rpm value with a statistical property of a set of Bayesian correlation coefficients computed for each performance metric.

Abstract: A simulation method and system partitions network traffic into background traffic and explicit traffic, wherein explicit traffic is processed in detail, and background traffic is processed at a more abstract level. The packets of explicit traffic are modeled in complete detail, so that precise timing and behavior characteristics can be determined, whereas large volumes of traffic are modeled more abstractly as background flows, and only certain aspects, such as routing through the network, are simulated. Tracer packets are used to model the background traffic and carry a number of characteristics of interest for generating simulation results. In this manner, the effect of the background traffic on the explicit traffic can be modeled at each network element. The abstract processing of background traffic is facilitated by techniques that include multi-variate table look-up, neural networks, and the like.

Abstract: Nodes of a network may be allocated to a number of logical groups thereof, and storage space within a network traffic monitoring device coupled to the network then allocated so as to ensure network traffic data for at least a minimum number of the nodes of each of the logical groups is stored.

Abstract: A metric monitoring and analysis system including dynamic sampling agents located in monitored system elements and a service management platform. Each sampling agent includes a data adapter collecting metric data in a common format, a threshold generator for determining dynamic metric threshold ranges, an alarm detector generating an indicator when a metric deviates outside a dynamic threshold range or a static threshold, and a deviation tracker generating an alarm severity scores. The service platform includes an alarm analyzer identifying root causes of system alarm conditions by correlation of grouped metrics or forensic analysis of temporally or statistically correlated secondary forensic data or data items from a service model of the system.

Abstract: A network configuration is processed to identify each policy and the criteria associated with each policy. The criteria of the policies are processed to identify a non-overlapping set of ranges of the criteria parameter, each range being associated with a particular policy or set of policies. In a preferred embodiment, the criteria include the protocol, the source and destination IP addresses, and the source and destination ports, and a default range is defined for each criteria parameter.

Abstract: Traffic flow between each pair of nodes in a network are determined based on loads measured at each link and based on gravity measures associated with each node. The gravity measures correspond to a relative likelihood of the node being a source or a sink of traffic, and may be assigned based on ‘soft’ characteristics associated with each node, such as the demographics of the region in which the node is located, prior sinking and sourcing statistics, and so on. Because the assigned gravities are relatively subjective, the gravity measures are used to generate an objective function for solving a system of linear equations, rather than as criteria that must be satisfied in the solution. The measured link loads are allocated among the traffic flows between nodes to at least a given allocation efficiency criteria by solving a system of linear equations with an objective of minimizing a difference between the assigned gravities and the resultant gravities corresponding to the determined flows.

Abstract: Time-varying latency is estimated based on the round-trip time between the time of sending a message and the time of receiving an acknowledgement of receipt of the message. The round-trip time relative to a transmitter is modeled as a combination of known, or determinable, delays, plus an unknown latency, plus a processing/acknowledgement delay at the receiver. The estimated time-varying latency is further refined to give more weight to estimates based on fewer unknowns or a lesser magnitude of unknowns, and to impose physical constraints, such as assuring that the estimate does not imply an unrealizable event. TCP-specific constraints and assumptions are also applied to further refine the latency estimates.

Abstract: A sub-system is provided to a discrete event simulator (DES) to expedite simulation execution by first detecting a non-quiescent steady-state condition in the simulated system, and when the steady-state condition is detected, the simulator determines a state, and subsequently simulates the system at a skip-ahead time using this determined state, or a predicted state based on the determined state. Convergence analysis is used to determine whether the system is at, or approaching, a steady-state condition. This convergence skip-ahead process achieves faster analysis by avoiding the computation that would conventionally be required to simulate the system behavior during the time interval that is skipped.

Abstract: A system and methods for displaying data distribution information for time-series data is described. The methods include computing a condensed quantile function that may be used to generate approximate histograms for the time-series data, while decreasing the data storage requirements for generating a series of histograms for time-series data. The methods further include displaying the data distribution information using stack-bar histograms, many of which may be shown in a single display to permit a user to discern trends in the data distribution information. Methods for merging condensed quantile function tables are also described.

Abstract: A method and system for flow propagation analysis uses ‘tracers’ that are iteratively propagated through a simulated network between source and destination elements. These tracers are structured to contain traffic flow information from source to destination, and to reflect changes as the flow is affected by each element along the path from source to destination. The resultant flow information at the destination corresponds to the effective throughput from the source to the destination, and the flow information at the output of each intermediate element in the network corresponds to the potentially achievable throughput through that element for the given source-to-destination flow.

Abstract: A system and method for dynamically generating alarm thresholds for performance metrics, and for applying those thresholds to generate alarms is described. Statistical methods are used to generate one or more thresholds for metrics that may not fit a Gaussian or normal distribution, or that may exhibit cyclic behavior or persistent shifts in the values of the metrics. The statistical methods used to generate the thresholds may include statistical process control (SPC) methods, normalization methods, and heuristics.

Abstract: Methods and an apparatus for instrumenting object oriented software that do not require modification to existing source code or to executable files, nor do they require modification to any existing sequences of object resident instructions. Methods include the class interceptor, doppelganger and method hijacking software instrumentation techniques. The class interceptor technique intercepts and monitors the paths of execution associated with methods inherited by a target class. The class doppelganger technique intercepts and monitors the paths of execution entering a target class. The method hijacking technique creates and adds instrumented methods directly to a target class.

Abstract: A simulation system and method that combines the advantages of both analytical modeling and discrete-event simulation is disclosed. In a preferred embodiment of this invention, traffic on the network is modeled as a combination of background-traffic and explicit-traffic. The background-traffic is primarily processed in an analytical form, except in the “time-vicinity” of an explicit-event. Explicit-events are processed using discrete-event simulation, and the modeled effects are dependent upon the background-traffic. At each occasion that the background-traffic may affect the explicit-traffic, the background-traffic is particularized into events that are modeled at the lower detail level of the explicit-traffic.

Abstract: A method, an apparatus, and a computer-readable medium for performing a discrete-event simulation employs an event list comprising events. In the event list, one event is indicated as a head event, and each event is indicated as uncomputed, pre-computed, or in-computation. An uncomputed event is selected and transferred to one of at least one event pre-computation processes, which computes a computation for the selected uncomputed event. An uncomputed head event is executed, and a pre-computed head event is verified.