Abstract: An example method comprises receiving a begin time to initiate storage network traffic data collection from a plurality of data probes integrated within an enterprise network, collecting network data identifying HBA ports used to communicate with storage ports from the probes, analyzing the network data to determine attributes of network traffic, determining for each storage unit: a penalty score for each of the storage ports determining a reconfiguration of a storage unit or HBA based at least in part on the total penalty score, simulating changes of the reconfiguration of the storage unit or the HBA and simulate storage network traffic, applying the simulated storage network traffic on the simulated changes of the reconfiguration of the storage unit or HBA to determine improvements, and outputting instructions to enable reconfiguration of the storage unit or HBA.

Abstract: A method comprises receiving network data from a network traffic monitoring platform of an enterprise network, the network data identifying communication between entities, analyzing the network data to identify applications, and comparing at least a first quality based on the communication between at least two of the plurality of entities to a first threshold to identify at least one application, receiving a request to suspend the application discovery process and creating a bookmark of the last network data received from the network traffic monitoring platform, the request to suspend the application discovery process being sent when one of a plurality of suspension trigger conditions is satisfied, receiving a request to reinitiate the application discovery process and receiving the network data from the network traffic monitoring platform at the bookmark, and creating a discovered application entry from the at least one identified application of the enterprise network.

Abstract: A method comprising: receiving network traffic data from a network traffic monitoring platform, the network traffic data identifying communication between entities of an enterprise network and storage monitoring data from a server-based SAN monitoring platform, the storage monitoring data identifying communication between a software-only server-based SAN and entities of the enterprise network, parsing the received traffic data and storage monitoring data to identify object data and/or metric data, creating a metric table entry from metric data, creating an object table entry from object data linking metric table entries with object table entries, creating a link table entry from the linking of metric table entries with object table entries, for each link table entry, assigning an object performance threshold, comparing each metric table entries to the assigned object performance threshold, if an alarm trigger condition is satisfied based on the comparison, then triggering an alarm event and outputting an alar

Abstract: An example method comprises receiving flow packets from network traffic analyzing platforms, for each particular flow packet: identify the particular flow packet as belonging to one of at least two flow packet types based on a format, if the particular flow packet is sFlow, determine if the particular flow packet is an sFlow sample, counter record, or a third packet type, if the particular flow packet is the sFlow sample or counter record, identify a flow source of the particular flow packet and at least one metric, and update a flow source data structure else ignore the particular flow packet, and if the particular flow packet is a second flow packet type: if the particular flow packet is of a format that matches a template, identify the flow source, and update the flow source data structure to include the identified flow source and the at least one metric.

Abstract: A method comprising: receiving from a third party virtualization platform: virtual machine manager identifiers identifying virtual machine managers, hypervisor identifiers identifying hypervisors and virtual machine identifiers identifying virtual machines, generating a first logical mapping of virtual machine managers to hypervisors, generating a second logical mapping of hypervisors to virtual machines, generating a third logical mapping of virtual machines to other virtual machines, receiving from network probes hypervisor traffic data identifying communication between hypervisors and entities of a switch fabric and virtual machine traffic data identifying communication between virtual machines to entities of the switch fabric, generating a fourth logical mapping of hypervisors to entities of the switch fabric based on the hypervisor traffic data, generating a fifth logical mapping virtual machines to entities of the switch fabric based on the virtual machine traffic data, and outputting a master mapping b

Abstract: A method comprises receiving a virtual machine identifiers, receiving VM identifier indicating an application instance, for each application instance: determining a tier of service, assigning the tier of service to the VM executing that particular application, assigning a polling interval to the application instance based on the assigned tier of service, retrieving metrics from each application instances at the polling interval, for each of the plurality of VM: determining a mapping that maps each virtual machine to a host, assigning the tier of service to the host, assigning at least one polling interval to the VM, retrieving metrics of the VM at the assigned polling interval, assigning a polling interval to each host, retrieving metrics from each hosts at the assigned polling interval, comparing each of the received metrics associated tier metrics thresholds, if an alarm trigger condition is satisfied, then triggering an alarm event, and outputting an alarm notification.

Abstract: A method comprising: receiving from a third party virtualization platform: virtual machine manager identifiers identifying virtual machine managers, hypervisor identifiers identifying hypervisors and virtual machine identifiers identifying virtual machines, generating a first logical mapping of virtual machine managers to hypervisors, generating a second logical mapping of hypervisors to virtual machines, generating a third logical mapping of virtual machines to other virtual machines, receiving from network probes hypervisor traffic data identifying communication between hypervisors and entities of a switch fabric and virtual machine traffic data identifying communication between virtual machines to entities of the switch fabric, generating a fourth logical mapping of hypervisors to entities of the switch fabric based on the hypervisor traffic data, generating a fifth logical mapping virtual machines to entities of the switch fabric based on the virtual machine traffic data, and outputting a master mapping b

Abstract: An example method comprises receiving a begin time to initiate storage network traffic data collection from a plurality of data probes integrated within an enterprise network, collecting network data identifying HBA ports used to communicate with storage ports from the probes, analyzing the network data to determine attributes of network traffic, determining for each storage unit: a penalty score for each of the storage ports determining a reconfiguration of a storage unit or HBA based at least in part on the total penalty score, simulating changes of the reconfiguration of the storage unit or the HBA and simulate storage network traffic, applying the simulated storage network traffic on the simulated changes of the reconfiguration of the storage unit or HBA to determine improvements, and outputting instructions to enable reconfiguration of the storage unit or HBA.

Abstract: An example method comprises receiving flow packets from network traffic analyzing platforms, for each particular flow packet: identify the particular flow packet as belonging to one of at least two flow packet types based on a format, if the particular flow packet is sFlow, determine if the particular flow packet is an sFlow sample, counter record, or a third packet type, if the particular flow packet is the sFlow sample or counter record, identify a flow source of the particular flow packet and at least one metric, and update a flow source data structure else ignore the particular flow packet, and if the particular flow packet is a second flow packet type: if the particular flow packet is of a format that matches a template, identify the flow source, and update the flow source data structure to include the identified flow source and the at least one metric.

Abstract: A method comprising: receiving network traffic data from a network traffic monitoring platform, the network traffic data identifying communication between entities of an enterprise network and storage monitoring data from a server-based SAN monitoring platform, the storage monitoring data identifying communication between a software-only server-based SAN and entities of the enterprise network, parsing the received traffic data and storage monitoring data to identify object data and/or metric data, creating a metric table entry from metric data, creating an object table entry from object data linking metric table entries with object table entries, creating a link table entry from the linking of metric table entries with object table entries, for each link table entry, assigning an object performance threshold, comparing each metric table entries to the assigned object performance threshold, if an alarm trigger condition is satisfied based on the comparison, then triggering an alarm event and outputting an alar

Abstract: A method comprises receiving network data from a network traffic monitoring platform of an enterprise network, the network data identifying communication between entities, analyzing the network data to identify applications, and comparing at least a first quality based on the communication between at least two of the plurality of entities to a first threshold to identify at least one application, receiving a request to suspend the application discovery process and creating a bookmark of the last network data received from the network traffic monitoring platform, the request to suspend the application discovery process being sent when one of a plurality of suspension trigger conditions is satisfied, receiving a request to reinitiate the application discovery process and receiving the network data from the network traffic monitoring platform at the bookmark, and creating a discovered application entry from the at least one identified application of the enterprise network.

Abstract: A network monitor is used to determine resource (e.g., CPU, memory, storage, or network) utilization of one or more virtual machines on one or more corresponding servers. Using resource utilization data for an original configuration of the virtual machines on the servers, the described system and methods simulate reconfigurations of various VMs on servers, determines resource utilization of the simulated reconfigurations, and proposes a reconfiguration that results in lower resource utilization across the one or more corresponding servers.

Abstract: Automatically identifying a location of a network monitor within a network topology is described. A location of a network monitor within a network topology (which can, and often does, change structure, constituent devices, or both) is determined by monitoring transmissions passing through the network link to which the network monitor is connected. The network monitor uses locally unique device identifiers present in a network transmission to identify the devices or ports most commonly communicating with each other.

Abstract: An information system identifies redundant communication paths between a server and a storage device in a storage area network and classifies the state of the paths according to the distribution of workload amongst them. To make the classification, the information system pairs up active paths. For each pair of active paths, the information system identifies traffic data of the two paths. The information system compares the traffic data of the two paths. Based on the comparison, the information system determines whether workload is balanced or imbalanced between the two paths.

Abstract: A system for improving performance of a network includes a monitor that obtains data sets corresponding to network performance, infers characteristics from the data set and generates visualizations and recommendations. In one aspect, the network is a storage area network and the system generates a box plot showing response time based on inferred queue depth, and recommending a queue depth setting if possible.

Abstract: A network monitoring system for a multimode optical data network includes a filter based splitter and an avalanche photodiode detector-based detection subsystem. The system takes a very small amount of the energy from the main data stream to use as monitoring data signal. The filter based splitter operates in a manner that is fairly uniform among modes and permits very low energy levels to be diverted for monitoring without disrupting either the main or monitor data streams for any modes.

Abstract: For each monitored entity in a storage area network (SAN), metric data associated with the entity is collected. Based on the metric data of an entity, a determination is made as to whether the entity experienced abnormal events. For each entity for which one or more abnormal events are identified, the information system determines an aggregated event score based on the abnormal events identified for the entity. Representation of the entities are presented to a user, where the representations are ordered based on the aggregated event scores of the entities.

Abstract: A monitoring system maintains multiple counts. Each of these counts is associated with a range and indicates a number of network transactions that occurred in a storage area network (SAN) during a time period with values that are within the associated range. When the monitoring system identifies the occurrence of a network transaction between devices in the SAN, the monitoring system determines a time duration and/or a size of the network transaction. The monitoring system identifies a count associated with a time range that includes the determined time duration and increments the identified count. Additionally, the monitoring system identifies a count associated with a size range that includes the determined size and increments the identified count.

Abstract: Methods and systems are described for storing network device identities and application assignments as a function of time to facilitate analysis of network devices and applications even in a temporally dynamic network. Server assignments are stored as a function of time for various applications executed within a network. Performance data are indexed according to a server and/or port unique identifier and stored as a function of time. Using the time-based server assignments and time-based performance data, the system can be queried using at least one of an application and intermediate entity identifier to determine the performance of the application, the entity, or both at one or more points in time.

Abstract: A link in a storage area network (SAN) is identified that is being affected by one or more slow draining devices. Devices in the SAN are identified as candidates for potentially being a slow draining device affecting the link. For each identified candidate device, metric data is identified that describes, for example, traffic activity of the candidate device, such as data transmission rates of the candidate device. Additionally, metric data is identified for the link. For each candidate device, a correlation value is determined that indicates the likelihood that the candidate device is a slow draining device affecting the link. The correlation value of a candidate device is determined based on the correlation between the metric data of the device and the metric data of the link. One or more of the correlation values are presented to a user via a user interface.