Abstract: Client network traffic data and server network traffic data regarding a number of network nodes is collected and then grouped by IP address. The network nodes are divided into logical groupings and the network traffic data is presented in the aggregate for all IP addresses in each logical group. The logical groupings may be further divided by protocol, application, port and/or logical group-to-group. Each logical group can be further generalized as either a set of IP addresses (e.g., a business group) or a specific logical link between one set of IP addresses to another set of IP addresses (e.g., a business group link). Either or both of these “groups” may be divided in further logical sub-groups: for example, by protocol, application, port and in the case of business groups, group-to-group. The logical groups provide facilities for initial problem detection and identification while the logical sub-groups provide facilities for troubleshooting and problem isolation.

Abstract: A system and method for managing captured network traffic data is provided. The invention comprises a plurality of capture agents, each being configured to capture the network traffic associated with one or more applications. Each application is associated with one or more capture agents according to an application profile that is stored and maintained in a capture server. When analysis of an application's network traffic is required, the capture server contacts the corresponding capture agents according to the application profile. The capture server then effects the identification and archiving of the network traffic that corresponds to a user-defined capture condition. A database at the capture server maintains a record that associates the corresponding network traffic with the user-defined capture condition such that the corresponding network traffic can later be retrieved and analyzed using an analysis engine.

Abstract: Some embodiments of the present invention provide techniques and systems for using scenario reduction in a design flow. The system can use scenario reduction to determine two subsets of scenarios that correspond to two sets of design constraints. Next, the system can optimize the circuit design using one of the sets of design constraints over the associated subset of scenarios. Next, the system can optimize the circuit design using both sets of design constraints over the union of the two subsets of scenarios. In some embodiments, the system can iteratively optimize a circuit design by: performing multiple optimization iterations on the circuit design over progressively larger subsets of scenarios which are determined by performing scenario reduction with relaxation; and performing at least one optimization iteration on the circuit design over a subset of scenarios which is determined by performing scenario reduction without relaxation.

Abstract: Network traffic information from multiple sources, at multiple time scales, and at multiple levels of detail are integrated so that users may more easily identify relevant network information. The network monitoring system stores and manipulates low-level and higher-level network traffic data separately to enable efficient data collection and storage. Packet traffic data is collected, stored, and analyzed at multiple locations. The network monitoring locations communicate summary and aggregate data to central modules, which combine this data to provide an end-to-end description of network traffic at coarser time scales. The network monitoring system enables users to zoom in on high-level, coarse time scale network performance data to one or more lower levels of network performance data at finer time scales.

Abstract: Network traffic information from multiple sources, at multiple time scales, and at multiple levels of detail are integrated so that users may more easily identify relevant network information. The network monitoring system stores and manipulates low-level and higher-level network traffic data separately to enable efficient data collection and storage. Packet traffic data is collected, stored, and analyzed at multiple locations. The network monitoring locations communicate summary and aggregate data to central modules, which combine this data to provide an end-to-end description of network traffic at coarser time scales. The network monitoring system enables users to zoom in on high-level, coarse time scale network performance data to one or more lower levels of network performance data at finer time scales.

Abstract: A method and apparatus are provided for scheduling a heterogeneous communication flow. A heterogeneous flow is a flow comprising packets with varying classes or levels of service, which may correspond to different priorities, qualities of service or other service characteristics. When a packet is ready for scheduling, it is queued in order in a flow queue that corresponds to the communication flow. The flow queue then migrates among class queues that correspond to the class or level of service of the packet at the head of the flow queue. Thus, after the head packet is scheduled, the flow queue may be dequeued from its current class queue and requeued at the tail of another class queue. If the subsequent packet has the same classification, it may be requeued at the tail of the class queue or may remain in place for another servicing round.

Abstract: A network analysis system invokes an application specific, or source-destination specific, path discovery process. The application specific path discovery process determines the path(s) used by the application, collects performance data from the nodes along the path, and communicates this performance data to the network analysis system for subsequent performance analysis. The system may also maintain a database of prior network configurations to facilitate the identification of nodes that are off the path that may affect the current performance of the application. The system may also be specifically controlled so as to identify the path between any pair of specified nodes, and to optionally collect performance data associated with the path.

Abstract: Systems and techniques are described for load balancing between WAN optimization devices. During operation, a mapping is determined based solely or partially on capacities of a set of remote WAN optimization devices and capacities of a set of local WAN optimization devices, wherein the mapping maps each remote WAN optimization device to a local WAN optimization device. Next, connection requests are directed to WAN optimization devices based on the mapping.

Abstract: The embodiments provide for analyzing activity of devices in a network. Activity from a device may result from multiple devices translated to a common address, such as a public internet protocol (IP) address. In some embodiments, the activity from a network or device is analyzed to identify if multiple devices communicate via translated addresses from the common address. The devices may be identified based on various criteria, such as a unique identifier, protocol header information, or a media access control (or “MAC”) address. Other criteria may also be employed. Each device that is mapped to common address is then remapped so that each device has its own address. The activity data is then modified so that each device is correlated with its unique address. Alternatively, a new activity data file may be generated so that the activity of each device is indicated.

Abstract: Network proxies reduce server latency in response to series of requests from client applications. Network proxies intercept messages clients and a server. Intercepted client requests are compared with rules. When client requests match a rule, additional request messages are forwarded to the server on behalf of a client application. In response to the additional request messages, the server provides corresponding response messages. A network proxy intercepts and caches the response messages. Subsequent client requests are intercepted by the network application proxy and compared with the cached messages. If a cached response message corresponds with a client request message, the response message is returned to the client application immediately instead of re-requesting the same information from the server. A server-side network proxy can compare client requests with the rules and send additional request messages. The corresponding response messages can be forwarded to a client-side network proxy for caching.

Abstract: Serial clustering uses two or more network devices connected in series via a local and/or wide-area network to provide additional capacity when network traffic exceeds the processing capabilities of a single network device. When a first network device reaches its capacity limit, any excess network traffic beyond that limit is passed through the first network device unchanged. A network device connected in series with the first network device intercepts and will process the excess network traffic provided that it has sufficient processing capacity. Additional network devices can process remaining network traffic in a similar manner until all of the excess network traffic has been processed or until there are no more additional network devices. Network devices may use rules to determine how to handle network traffic. Rules may be based on the attributes of received network packets, attributes of the network device, or attributes of the network.

Abstract: Performance metrics related to the processing and propagation of messages related to select applications are collected during a simulation of a network. Each message associated with an application is tagged, and each simulated packet that contains some or all of a tagged message is correspondingly tagged to facilitate the creation of transmit records and receive records. A post processor is configured to collate transmit and receive records of each tagged message to identify delays associated with each node that processes the message, and each link that propagates the message from node to node within the network. The processed timing information is provided to the user via an interactive user interface that allows the user to view the timing information from an application layer perspective.

Abstract: Network devices include hosted virtual machines and virtual machine applications. Hosted virtual machines and their applications implement additional functions and services in network devices. Network devices include data taps for directing network traffic to hosted virtual machines and allowing hosted virtual machines to inject network traffic. Network devices include unidirectional data flow specifications, referred to as hyperswitches. Each hyperswitch is associated with a hosted virtual machine and receives network traffic received by the network device from a single direction. Each hyperswitch processes network traffic according to rules and rule criteria. A hosted virtual machine can be associated with multiple hyperswitches, thereby independently specifying the data flow of network traffic to and from the hosted virtual machine from multiple networks.

Abstract: Network traffic information from multiple sources, at multiple time scales, and at multiple levels of detail are integrated so that users may more easily identify relevant network information. The network monitoring system stores and manipulates low-level and higher-level network traffic data separately to enable efficient data collection and storage. Packet traffic data is collected, stored, and analyzed at multiple locations. The network monitoring locations communicate summary and aggregate data to central modules, which combine this data to provide an end-to-end description of network traffic at coarser time scales. The network monitoring system enables users to zoom in on high-level, coarse time scale network performance data to one or more lower levels of network performance data at finer time scales.

Abstract: A method and apparatus are provided for scheduling a heterogeneous communication flow. A heterogeneous flow is a flow comprising packets with varying classes or levels of service, which may correspond to different priorities, qualities of service or other service characteristics. When a packet is ready for scheduling, it is queued in order in a flow queue that corresponds to the communication flow. The flow queue then migrates among class queues that correspond to the class or level of service of the packet at the head of the flow queue. Thus, after the head packet is scheduled, the flow queue may be dequeued from its current class queue and requeued at the tail of another class queue. If the subsequent packet has the same classification, it may be requeued at the tail of the class queue or may remain in place for another servicing round.

Abstract: Network devices include hosted virtual machines and virtual machine applications. Hosted virtual machines and their applications implement additional functions and services in network devices. Network devices include data taps for directing network traffic to hosted virtual machines and allowing hosted virtual machines to inject network traffic. Network devices include unidirectional data flow specifications, referred to as hyperswitches. Each hyperswitch is associated with a hosted virtual machine and receives network traffic received by the network device from a single direction. Each hyperswitch processes network traffic according to rules and rule criteria. A hosted virtual machine can be associated with multiple hyperswitches, thereby independently specifying the data flow of network traffic to and from the hosted virtual machine from multiple networks.

Abstract: All of the transit services that each device is expected to provide are determined and contrasted with the transit configuration of each device. Because the transit configuration of each device may be state-dependent, the service items within each application service are processed in sequential order. Sequences of service items are associated with connection groups, and each of the routes associated with each connection group is determined based on the sequential order of the service items. The configuration of each device along each route is processed to determine the services that will be permitted or denied, based on its current configuration. Each desired transit service item is compared to the transit configuration provided by each device to identify any inconsistencies and/or violations.

Abstract: Networks and devices may communicate with each other using virtual connections. In one embodiment, a computer-implemented model is generated and includes a representation of the path of a virtual connection. The path of a virtual connection, such as an IP tunnel, is traced between its source and destination. The physical connection corresponding to such IP tunnels are found by tracing through the device configuration and routing tables at routers in the network. The path between the source and destination devices is traced until the path is terminated at the destination device, or at an interface to an external network. If the path ends at an external network, the path is traced from the destination device toward the source device until a corresponding interface to the external network is reached.

Abstract: Proxy devices associate their direct connection with a client/server connection passing through one or more NAT devices. First proxy device receives a network connection request from a client. First proxy device stores connection information in association with a connection identifier. Connection information may reflect the usage of NAT devices between the two proxy devices. First proxy device sends a connection response including the connection identifier to the client. Second proxy device sends a direct connection request to first proxy device to establish a direct connection. Direct connection request includes the connection identifier, which is used by first proxy device to associate the direct connection with stored connection information. First proxy device may use the connection information to direct network traffic received via this direct connection to the correct destination and to divert network traffic from the server to the client through the direct connection and first and second proxy devices.

Abstract: The embodiments improve the results of an auto-detection of network devices responsive to the causes of detection failures in preceding runs of the auto-detection process. The network may comprise various devices that are believed to be in the network. If a device that is believed to be in the network, but is undiscovered, the embodiments identify the device and information regarding the cause or causes of non-discovery. In response, the discovery parameters are modified, based on the causes associated with the undiscovered devices. The extent to which the discovery parameters are modified is based various criteria, such as the characterization of the network, or upon the detection of changes to the network.