Abstract: Network monitoring views can be recorded, replayed and shared. A monitoring system receives monitoring data, in response to which a monitoring view can be constructed. The monitoring data is maintained in memory or mass storage. One or more monitoring views can later be constructed in response to user preferences, even if those users would not have known to select those particular preferences or construct those particular monitoring views at the time. The monitoring views constructed in response to that monitoring data can be presented to users in a simulation of the problem, as if it were occurring at that time. Users can send particular monitoring views to others, with both the effects that the monitoring view can be preserved as part of a trouble report, and the persons receiving the monitoring view can have useful insight into what problem the user has pointed to.

Abstract: A network monitoring device responds to a network status data (whether “pushed” from the network device or “pulled” from the network device), maintaining a buffer of saved status data. The status data is reordered, manipulated, and presented to users in order. The monitoring device can thus report an accurate momentary report of the status of the network environment. When status data is delayed too long, the monitoring device can discard it, or reduce its weighted consideration. The monitoring device adjusts its wait for status data, either as an average or individually per device, attempting to balance accuracy and latency. The monitoring device also records of how much status data it is required to process, in response to the amount it can process reliably, and maintains a sampling rate for status data, somewhere between evaluating all of the status data, and evaluating only a small portion of the status data, when capable, attempting to balance the degree of sampling, against both error and latency.

Abstract: One network monitoring system maintains information regarding historical activity and emergent activity of the network. Comparison of recent with historical activity allows the system to determine whether recent activity is within the realm of normal. The system maintains data structures representing a p.d.f. for observable values of network parameters. Another network monitoring device includes data structures for maintaining information regarding historical and emergent activity of a network. This network monitoring device maintains those data structures including information regarding historical and emergent activity of a network only for those source/destination pairs, and only for those nodes, for which maintaining that information would be substantially meaningful.

Abstract: A network monitoring device responds to a network status data (whether “pushed” from the network device or “pulled” from the network device), maintaining a buffer of saved status data. The status data is reordered, manipulated, and presented to users in order. The monitoring device can thus report an accurate momentary report of the status of the network environment. When status data is delayed too long, the monitoring device can discard it, or reduce its weighted consideration. The monitoring device adjusts its wait for status data, either as an average or individually per device, attempting to balance accuracy and latency. The monitoring device also records of how much status data it is required to process, in response to the amount it can process reliably, and maintains a sampling rate for status data, somewhere between evaluating all of the status data, and evaluating only a small portion of the status data, when capable, attempting to balance the degree of sampling, against both error and latency.

Abstract: A network monitoring device includes a data structure for maintaining information about endpoints involved in network flows. Each endpoint, either a source or a destination for a network flow, has information maintained in a modified binary trie, having a branch for each bit of the source or destination address, but with interior nodes having only a single child node elided. A pruning thread is given a limited amount of time for operation, with the effect that the data structure is maintained available for use except for only that limited amount of time. In the event that the pruning thread is unable to prune the entire data structure, it maintains a marker indicating where last it left off, and returns to that location in the data structure at a later pruning operation.

Abstract: A network monitoring system maintains both information regarding historical activity of a network, and information regarding emergent activity of the network. Comparison of historical activity of the network with emergent activity of the network allows the system to determine whether network activity is changing over time. The network monitoring system maintains data structures representing a p.d.f. for observable values of network parameters. Recent activity of the network can be compared with both the p.d.f. for historical activity and for emergent activity to aid in determining whether that recent activity is within the realm of normal, and whether network activity is changing over time. The network monitoring system adjusts that information regarding historical activity of a network in response to emergent activity of that network.

Abstract: A network monitoring device includes a flow processing element, disposed to receive flow information relating to network flows, and to generate a set of virtual packets, each representing a portion of a network flow. The virtual packets are maintained in a time-sequential order, and read by elements of the network monitoring device to generate information relating to network traffic, such as symptoms affecting the communication network, problems affecting the communication network, and otherwise. The network monitoring device randomly samples virtual packets, with at least one of two effects: (1) flow information from traffic reporting devices that are themselves sampling at differing rates can be equalized, with the effect of standardizing information from all of them; (2) the network monitoring device itself can restrict its attention to a fraction of all virtual packets, with the effect of keeping up with a relatively large number of virtual packets.

Abstract: A network monitoring system includes devices receiving network traffic information, and generating at least partial results relating to network symptoms. Those partial results are forwarded to devices processing those partial results and generating information relating to problems in response to those symptoms. Problems are reported to users or sent as notifications. In one embodiment, information relating to network traffic is monitored both by a first set of devices associated with source addresses for that network traffic and a second set of devices associated with destination addresses for that network traffic. Information received by that first set of devices includes information relating to both the source address and destination address of network traffic. That first set of devices processes information relating to the source address of network traffic and forwards information relating to the destination address of network traffic to that second set of devices.

Abstract: The invention provides apparatus and methods for defending against attacks in a distributed computing environment, including (1) distinguishing attack traffic patterns from legitimate traffic patterns, (2) responsive to nature of message patterns; (3) attack traffic has few origination points, and does not divide further from target device; (4) detectors of illegitimate traffic can cooperate to confirm the suspected attack, with the effect of providing more information to each other.

Abstract: Detecting and protecting against denial of service flooding attacks that are initiated against an end system on a computer network. In accordance with one aspect of the invention, a filter is established at a network location. The filter prevents data packets received at a first network location and deemed responsible for the denial of service flooding condition from being forwarded to a subsequent network location. Data packets received at the first network location are then monitored to determine whether the flow of any data packets from a network source exhibit a legitimate behavior, such as where the flow of data packets exhibits a backoff behavior. The filter is then modified to permit data packets that exhibit legitimate behavior to pass through the filter.