Abstract: The present system includes a system, method and device for inferring connectivity between unconnected network segments. In operation, unconnected network segments are identified. Configuration data related to the unconnected network segments may be examined to facilitate inferring configuration data for an external network connected between the unconnected network segments. The inferred configuration data may be rendered, such as exported or visualized. The inferred configuration data may be related to a communication protocol and/or may be related to network bandwidth. The examined configuration data may be captured directly from one or more of the unconnected network segments and/or may be retrieved from a configuration data file, such as a network configuration model.

Abstract: Embodiments provide systems, methods, and computer program products for inferring node and link information from traceroute data in order to generate topology information. A system receives traceroute data for a data packet that traverses a path from a source to a destination. The system infers port types for the addresses in the traceroute data and groups subsets of the addresses in the traceroute data into logical nodes based on neighbor relationships demonstrated in backward and forward neighbors sets. The system then generates node and link information based on the inferred and grouped information.

Abstract: An edge network device controls the quality-of-service of incoming network traffic flows by limiting the bandwidth of incoming network traffic flows to create a network traffic bottleneck at the edge network device. The bottleneck ensures that this edge network device may control the quality-of-service of incoming network traffic flows. During a slow-start phase of a network traffic flow, the edge network device adds phantom network packets to a scheduler queue in addition to the actual packets of the network traffic flow. Phantom packets occupy transmission slots during packet scheduling and are discarded when selected for transmission. This limits the rate that actual packets are received and acknowledged by the destination knowledge, thereby preventing the network traffic flow source from increasing the flow bandwidth above the limit of the inbound network connection.

Abstract: A network communications protocol to allow endpoints in a computer network to communicate their respective requirements for access to a network resource to each other, and to communicate a policy for access to the network resource by the endpoints. The network protocol may also allow negotiation of access to the network resource for the respective endpoint in accordance with the policy and the requirements information communicated by other endpoints. The network resource may be access to a WAN connection or an Internet connection, or may be a device such as a network printer or network attached storage.

Abstract: Potential paths between a source and destination of a network are identified based on trace-route information, then filtered to eliminate paths or links that are not supported by ancillary information associated with the network so as to identify feasible/actual paths between the source and destination. The ancillary information includes, for example, routing tables and ARP tables. If a feasible path cannot be identified based on the ancillary information, supplemental information regarding nodes further along the potential path is assessed to provide a basis for inferring the nodes that may provide a feasible path. The determined feasible paths are displayed for review, and provided to serve as filters for subsequent path-analysis tools.

Abstract: Network traffic is monitored and an optimal framing heuristic is automatically determined and applied. Framing heuristics specify different rules for framing network traffic. While a framing heuristic is applied to the network traffic, alternative framing heuristics are speculatively evaluated for the network traffic. The results of these evaluations are used to rank the framing heuristics. The framing heuristic with the best rank is selected for framing subsequent network traffic. Each client/server traffic flow may have a separate framing heuristic. The framing heuristics may be deterministic based on byte count and/or time or based on traffic characteristics that indicate a plausible point for framing to occur.

Abstract: A method and system that takes advantage of processes that are efficient for determining the topology of small to medium size networks to determine individual network topologies for such networks, and then merges these individual topologies into a consolidated topology for the entire network. Each of the processes that determines the topology of the smaller networks provides the determined network topology, as well as a list of factors that may be relevant in the determination of how the given topology might be attached to any other given topology, such as the identification of a node that is not included in the given topology, or other indications of external connections. The merging process is configured to substantially restrict its analysis to these factors, thereby limiting the extent, and therefore the time consumed, by this stitching and merging process.

Abstract: Content delivery networks may associate each WAN optimized network connection with a specific client-to-cloud-service connection using connection identifiers. When an edge node of a content delivery network receives or intercepts a network connection request from a client device including an auto-discovery indicator from an upstream WAN optimization module, the edge node stores a connection identifier for this network connection. The edge node sends a connection response back to the client device including an auto-discovery response indicator. In response, the WAN optimization module sends one or more inner connection setup messages including the connection identifier to a second WAN optimization module in the content delivery network to establish a direct connection, referred to as an inner connection. The connection identifier is matched with the previously stored connection identifier to associate an inner connection with the network connection between the client and the cloud service.

Abstract: Network devices include proxies and where multiple proxies are present on a network, they can probe to determine the existence of other proxies. Where more than two proxies are present and thus different proxy pairings are possible, the proxies are programmed to determine which proxies should form a proxy pair. Marked probe packets are used by proxies to discover each other and probing is done such a connection can be eventually formed even if some probe packets fail due to the marking. Asymmetric routing can be detected and proxies configured for connection forwarding as necessary.

Abstract: For an accelerated transaction, a client directs a request to a client-side transaction handler that forwards the request to a server-side transaction handler, which in turn provides the request, or a representation thereof, to a server for responding to the request. The server sends the response to the client via the server-side transaction handler and the client-side transaction handler. When data is to be sent between handlers, the sending transaction handler compares data segments with segments stored in its persistent segment storage and replaces segments with references to entries in its persistent segment storage that match or closely match the segments to be replaced. The transaction accelerators could handle multiple clients and/or multiple servers and the segments stored in the persistent segment stores can relate to different transactions, different clients and/or different servers. Persistent segment stores can be prepopulated with segment data from other transaction accelerators.

Abstract: A first capture system that captures network communication events related to an application, and a second capture system that captures internal processing events related to the application. A visualization system analyzes the data captured by each of the capture systems, synchronizes and correlates the data, and presents an integrated display of these communication and processing events. In a preferred embodiment, the communicated messages include an identifier of the application, and the processing components also associate an identifier of the application to each recorded processing event. To facilitate the integrated display of the events, the visualization system synchronizes the recorded communication and processing events to a common time base.

Abstract: A system and method determines correlations within multi-tier communications based on repeated iterations/episodes of executions of a target application. Content-based correlations are determined by encoding the content using a finite alphabet, then searching for similar sequences among the multiple traces. By encoding the content to a finite alphabet, common pattern matching techniques may be used, including, for example, DNA alignment algorithms. To facilitate alignment of the traces, structural and/or semantic breakpoints are defined, and the encoding in each trace is synchronized to these breakpoints. To facilitate efficient processing, a hierarchy of causality among tier-pairs is identified, and messages at lower levels are ranked and temporally filtered, based on activity intervals at higher levels of the hierarchy.

Abstract: According to an aspect of the invention, a system and method is configured to detect time series outliers in network traffic.

Abstract: In a network supporting transactions between clients and servers and proxies that are interposable in a network path, a pair of proxies can modify a packet stream such that packet data from client to server is transformed at a client-side proxy of the pair and untransformed at a server-side of the pair and packet data from server to client is transformed at the server-side proxy and untransformed at the client-side proxy. A discovering proxy transparently discovers its position in a proxy pair by using proxy signals. A discovering proxy might determine that it is a client-side proxy by receipt of a packet from client without a proxy signal, or that it is a server-side proxy by receipt of a packet from server without a return proxy signal. Once a proxy pair is discovered, it might transform traffic from server to client or vice versa, transforming and untransforming the traffic.

Abstract: The present system includes a system, method and device for inferring connectivity between network devices across a third party network. Configuration data related to the network devices is examined and configuration data about the network is inferred. The inferred configuration data may be related to a communication protocol, network bandwidth, and the like. A model representing the network is then created to indicate inferred interfaces and connections through the external network between network devices. The representation may be rendered in various forms, such as a display or data exported to another system. Various studies may also be performed using the model, such as traffic, routing, or planning studies.

Abstract: The embodiments facilitate the analysis of application delays, including delays that occur on multiple paths. A trace file of an application's network events is processed to categorize the causes of delays incurred in the propagation and processing of these events. The system identifies the amount of delay that can be eliminated by eliminating each of the components of delay individually, as well as the amount of delay that can be eliminated by eliminating combinations of the delay components. A user interface displays the amount of reduction that can be achieved by eliminating various delays alone or in combination. The interface also allows the user to view the individual delay components contained in combinations of delay components. In this manner, the user is provided a view of each of the delay components that would need to be addressed, either individually or in combination, to improve the overall application delay.

Abstract: The connectivity information provided by a variety of inference engines is integrated to provide a set of inferred links within a network. A consolidation is performed among inference engines that operate at a base level of connectivity detail to create a model of the network at this base level. The connectivity information provided by inference engines at each subsequent higher level of connectivity abstraction is then overlaid on the base level connectivity. By separately consolidating the connectivity information at each level of abstraction, the rules for dealing with conflicts can be simplified and/or better focused to resolve the conflict. By assuming that the more detailed lower level information is likely to be more accurate, rules can be developed to modify the connectivity models produced by the higher level techniques to conform to the lower level connectivity details while still maintaining the integrity of the higher level connectivity models.

Abstract: Relatively small capacity solid-state storage devices (SSD) are combined with larger capacity magnetic disk storage devices for storing storage block write data to ensure data consistency. Write operations are stored in a sequential write buffer in an SSD to guarantee the storage of write data and then copied from the sequential write buffer to the destination address in a magnetic disk storage device. The sequential write buffer store write data in locations corresponding to the order of receipt of write operations. Write data from the sequential write buffer is transferred to the magnetic disk storage device in the same order and a checkpoint index is frequently updated to indicate the completion of some transfers. During system initialization, the most recent value of the checkpoint index is retrieved and used as a starting location for transferring write data from the sequential write buffer to the magnetic disk storage device.

Abstract: WAN optimization devices and content delivery networks together optimize network traffic on both private networks and public WANs such as the internet. A WAN optimization device intercepts and optimizes network traffic from clients within a private network. The WAN optimization device communicates this first optimized network traffic to the nearest edge computer in the content delivery network via a public WAN, such as the internet. This edge computer further optimizes the network traffic and communicates the doubly optimized network traffic via the content delivery network to a second edge computer nearest to the network traffic destination. The second edge computer converts the doubly optimized network traffic back to its original format and communicates the reconstructed network traffic from the second edge computer to the destination via a public WAN.

Abstract: In address-manipulation enabled transaction accelerators, the transaction accelerators include outer-connection addressing information in packets emitted over an inner connection between transaction accelerators and inner-connection addressing information is added in packets sent over the inner connection. The inner-connection addressing information can be carried in TCP option fields, directly in other fields, or indirectly through data structures maintained by the endpoints processing the connection. Address information can be encoded into header fields originally intended for other purposes but that are unused or encoded into used fields, overlaid in combination with other data that is being carried in those used fields. The existence of inner-connection addressing information in a packet can be signaled by a flag in the packet, by a bit or other designated encoding. The flag can be in an unused header field or overlaid.