Abstract: A network monitoring system is provided that includes a processor and a memory coupled to the processor. A plurality of services provided by a network operator is identified. A plurality of Key Performance Indicators (KPIs) associated with the identified plurality of services is calculated on a per service basis. Individual services provided by the network operator are characterized based on the calculated plurality of KPIs. A root cause of service level failures for one or more of the plurality of services is identified, in response to determining that at least one of the characterized service levels does not meet predefined service level objectives for the one or more of the plurality of services.

Abstract: A method of estimating network latency including receiving intercept data (representing observations of requests sent by a client node and responses to the respective requests from a host node), detecting a burst of network traffic bounded by a first idle interval and/or second idle interval, and estimating download and/or upload latencies associated with the burst, wherein the download latency is estimated to be an amount of time between observation of an inferred first request of the burst from the client node until observation of a first response from the host node following the inferred first request, and the upload latency is estimated to be an amount of time between observation of a last inferred data packet of the burst from the host node to the client node until observation of a last inferred ACK packet from the client node following the last inferred data packet from the host node.

Abstract: A network traffic monitoring system is provided. The system includes a host computer executing a plurality of virtual machines (VMs), including a monitoring VM and a virtual switch (vSwitch). The vSwitch includes a plurality of virtual Network Interface Cards (vNICs) associated with the plurality of VMs. The monitoring VM is coupled to the vSwitch and executed by the host computer. The vSwitch is configured to mirror a plurality of data packets exchanged between two communicating VMs to a vNIC associated with the monitoring VM. The monitoring VM is configured to retrieve the plurality of mirrored data packets from the vNIC associated with the monitoring VM. The monitoring VM is further configured to generate timestamps indicative of packet arrival time at the vSwitch for each data packet in the retrieved plurality based, at least in part, on a computed base time.

Abstract: A computer-implemented method for supervising data stream storage including communicating with a probe that captures network data and outputs a plurality of data streams to a plurality of data repository units, receiving registration data associated with respective data streams that identifies the associated probes, selecting at least one of the data repository units to store the first data stream in real time based on a storage capacity of the data repository units to receive and store data, determining that storage capacity is not sufficient for the data stream in response to a change in the storage capacity of the data repository units to receive and store data, determining a corrective action in response to the determination that the storage capacity is not sufficient, and notifying the probe identified in association with the first data stream about the corrective action.

Abstract: To adaptively self-localize distributed data processing and data distribution and reduce data transfer costs in a network monitoring system, data has a corresponding ownership association. For each data access, an ownership association value for the accessed data may be modified based on whether the access originated with a current owner processing node or a second most-frequently accessing processing node. The ownership association value indicates a strength of the ownership association between the data and the owner and is based on at least a recent history of accesses of the data by the current owner and the second most-frequently accessing node. When the ownership association value traverses a selected cutoff, ownership association of the data is transferred from the current owner to the second most-frequently accessing node. The ownership association transfer contributes to self-localizing data processing based on a source of input regarding the data.

Abstract: A method for determining a cell placement efficiency number for a wireless cell by computing a first radius R1, wherein the first radius R1 defines a first region that comprises a first threshold TH1 of the total cell traffic. A second radius R2 is computed, wherein the second radius R2 defines a second region that comprises a second threshold TH2 of the total cell traffic. A cell placement efficiency value is then computed using R1 and R2.

Abstract: A method for determining location history of a mobile device is provided. A plurality of states corresponding to a plurality of reachable road segments associated with a road network is determined based on one or more initial estimated locations of the mobile device. Mobility model defining transition probabilities between the determined plurality of states is generated. Time series network data associated with the mobile device is received from a network data source. The time series network data is associated with a given period of time. The time series network data is processed using the generated mobility model to estimate an actual route most likely travelled by the mobile device during the given time period.

Abstract: Systems and methods for determining web page download times are described. HTTP transactions data is collected from flow records or PDUs. A subscriber IP address, HTTP URI, and referrer are extracted from the flow records. A subscriber record is identified using the subscriber IP address, and a configured web page is identified using the HTTP URI. A processing path is then determined for the HTTP transaction The processing path is selected from one of: a new page download path for a configured page, a collision path for HTTP transactions that collide with an existing page download, and a page object path for artifacts pages that are already being tracked.

Abstract: A method, computer program product and system for determining quality of experience indicator in a telecommunication network including core network and radio access network (RAN) are provided. Quality of service indicators for a subscriber's session associated with the core network are received. Quality characteristics of a radio signal transmitted through the RAN or obtained from the user equipment and correlated to the subscriber's session are determined. A quality of experience indicator is generated for the subscriber's session based on the quality of service indicators for the core network and the quality characteristics of the radio signal.

Abstract: A method for emulating a jitter buffer by a telecommunications network monitoring probe includes determining an RTP timestamp for each of the plurality of received RTP packets. An actual time of arrival is determined for each of the plurality of RTP packets. An expected time of arrival is determined for each of the plurality of RTP packets based, at least in part, upon a difference between the RTP timestamps of successive RTP packets. One or more of the plurality of RTP packets is discarded from the jitter buffer if the actual time of arrival is greater than the expected time of arrival for the one or more RTP packets.