Abstract: Data representing application deployment attributes, network topology, and network performance attributes based on a reduced set of element attributes is utilized to simulate application deployment. The data may be received from a user directly, a program that models a network topology or application behavior, and a wizard that implies the data based on an interview process. The simulation may be based on application deployment attributes including application traffic pattern, application message sizes, network topology, and network performance attributes. The element attributes may be determined from a lookup table of element operating characteristics that may contain element maximum and minimum boundary operating values utilized to interpolate other operating conditions.

Abstract: First-order effects of hypothesized fault conditions are determined by propagating discrete test packets between select nodes and noting the change of path, if any, taken by the test packet under each condition relative to the fault-free path. Tools are provided to create classes of node pairs of interest, and test packets are created only for select classes. The network is analyzed to identify fault conditions that are likely to impact system performance, and only these fault conditions are simulated. By providing a methodology for selecting classes of node pairs to test, and prioritizing the faults to simulate, a first-order survivability analysis of large networks can be performed efficiently and effectively. The efficiency of this technique is also enhanced by providing test packets that are representative of a wide range of possible source-destination combinations, and by evaluating only the source-destination combinations that may be directly affected by each fault condition.

Abstract: Channel access delays and reception uncertainty are modeled as protocol-independent generic processes that are optimized for improved simulation performance. The generic process components are designed such that each different protocol can be modeled using an arrangement of these components that is specific to the protocol. In this way, speed and/or accuracy improvements to the generic process components are reflected in each of such protocol models. If an accurate analytic model is not available for the generic process component, a prediction engine, such as a neural network, is preferably used. The prediction engine is trained using the existing detailed models of network devices. Once trained, the prediction engine is used to model the generic process, and the protocol model that includes the generic component is used in lieu of the detailed models, thereby saving substantial processing time.

Abstract: Application messages are segregated into message paths, and the delays of the transmitted packets associated with each message path are independently analyzed to distinguish propagation, bandwidth, congestion, and protocol delays. To further distinguish the congestion delays, all of the paths of the application messages are assessed to identify delays induced by the application, including self-congestion delay, corresponding to pre-congestion delays caused by attempting to send data from a source device faster than the bandwidth of the channel allows, and cross-congestion delay, corresponding to post-congestion delays caused by varying delays beyond a bottleneck link in the channel. The remaining congestion delay is identified as network congestion delay, corresponding to delays caused by network devices other than the source device. After identifying each of the components of delay, the effect of each component on the overall delay is determined to identify where improvements can best be made.

Abstract: Devices and methods for modeling and analysis of services provided over a common network include a processor configured to track services connected to the common network through nodes and links; run service models associated with the services under selected conditions, the selected conditions including failure and repair of one of the nodes or links; and propose corrective action and/or change of network resources of the common network to minimize impact of the failure. The processor may also run Network models. The models may be executed successively or simultaneously, and outputs of one model may be used as input to other models, including any necessary conversions for compatibility.

Abstract: A system/method searches a traffic stream for a sequence of “matching” packets that exhibit a high degree of correlation or similarity to a sequence of “reference” packets. The correlation between matching and reference packets is based on a degree of correspondence between individual packets, as well as the sequence-order of the corresponding packets. A variation of the Needleman-Wunsch algorithm is preferably used to select corresponding packets in the traffic stream that provide a sequence-order that best matches the sequence-order of the reference packets, based on a measure of the correspondence for each match, and a penalty associated with each non-match. The algorithm is further modified to reduce the required search-space for finding corresponding packets in the traffic stream.

Abstract: In a network simulation system, a compiler is provided to support incremental updates to the configuration data associated with the modeled network. Each incremental change is identified and logged, to facilitate configuration management and select roll-backs to prior configurations. Because each update is processed and managed individually, and integrated automatically into the overall system configuration, the overhead associated with keeping a configuration database up-to-date is substantially reduced, thereby increasing the likelihood that all configuration changes will be reflected in the modeled network. In a preferred embodiment, the same data is used to incrementally update the configuration model and to execute the change in the actual system, thereby further reducing the overhead and assuring a correspondence between the modeled network and the actual network.

Abstract: A routing validation method and system identifies routers that are likely to be the cause of differences in forwarding tables associated with two versions of a network. Each destination sub-network prefix is processed to identify all the routers that exhibit differences in their forwarding table for this prefix. Each router exhibiting a difference is assessed to determine whether the difference may have been propagated to this router from another router. If the difference could not have been propagated from another router, this router is identified as a potential source of the observed difference. By eliminating routers that could have received the effects of the differences from another router, the task of identifying the root cause of the observed differences is substantially reduced in complexity.

Abstract: First-order effects of hypothesized fault conditions are determined by propagating discrete test packets between select nodes and noting the change of path, if any, taken by the test packet under each condition relative to the fault-free path. Tools are provided to create classes of node pairs of interest, and test packets are created only for select classes. The network is analyzed to identify fault conditions that are likely to impact system performance, and only these fault conditions are simulated. By providing a methodology for selecting classes of node pairs to test, and prioritizing the faults to simulate, a first-order survivability analysis of large networks can be performed efficiently and effectively. The efficiency of this technique is also enhanced by providing test packets that are representative of a wide range of possible source-destination combinations, and by evaluating only the source-destination combinations that may be directly affected by each fault condition.

Abstract: A simulation method and system partitions network traffic into background traffic and explicit traffic, wherein explicit traffic is processed in detail, and background traffic is processed at a more abstract level. The packets of explicit traffic are modeled in complete detail, so that precise timing and behavior characteristics can be determined, whereas large volumes of traffic are modeled more abstractly as background flows, and only certain aspects, such as routing through the network, are simulated. Tracer packets are used to model the background traffic and carry a number of characteristics of interest for generating simulation results. In this manner, the effect of the background traffic on the explicit traffic can be modeled at each network element. The abstract processing of background traffic is facilitated by techniques that include multi-variate table look-up, neural networks, and the like.

Abstract: A multi-functional graphical user interface facilitates the analysis and assessment of application delays, including delays that occur on multiple paths. A trace file of an application's network events is processed to categorize the causes of delays incurred in the propagation and processing of these events. The system identifies the amount of delay (‘component delay’) that can be eliminated by eliminating each of the components of delay individually, as well as the amount of delay (‘parallel delay’) that can be eliminated by eliminating combinations of the delay components. A user interface displays the amount of reduction that can be achieved by eliminating each component delay individually and the amount of reduction that can be achieved by eliminating combinations of the individual component delays.

Abstract: In a network that includes static bandwidth and dynamic bandwidth links, traffic flow at the OSI network layer is simulated at a traffic-flow level at interfaces to fixed bandwidth links, and simulated at a discrete-packet level at interfaces to dynamic bandwidth links. The resultant discrete-packet reception events at the receiving interface(s) of the dynamic bandwidth link are processed to determine the effective bandwidth/throughput of the link, as well as the allocation of this bandwidth among the individual flows through the link. The discrete-packet level receptions are used to reconstruct the parameters of the traffic flow at the network layer of the receiving interface, and this determined traffic flow is simulated accordingly at the next link, depending upon whether the next link is a static or dynamic bandwidth link.

Abstract: Channel access delays and reception uncertainty are modeled as protocol-independent generic processes that are optimized for improved simulation performance. The generic process components are designed such that each different protocol can be modeled using an arrangement of these components that is specific to the protocol. In this way, speed and/or accuracy improvements to the generic process components are reflected in each of such protocol models. If an accurate analytic model is not available for the generic process component, a prediction engine, such as a neural network, is preferably used. The prediction engine is trained using the existing detailed models of network devices. Once trained, the prediction engine is used to model the generic process, and the protocol model that includes the generic component is used in lieu of the detailed models, thereby saving substantial processing time.

Abstract: A search system analyzes a user's search requests and identifies prior semantically-similar search requests that have provided well-received results. Each search request is classified, based on the semantics of the search request, and the user's satisfaction with the effectiveness of the search request is monitored and recorded within the determined class (or set of classes). As a particular user's search session continues, the classification of the user's search request is also used to identify other searches in the determined class, and the user is provided the option of modifying or replacing the user's current request with one of these semantically similar searches. The system may also be configured to identify the most favored results provided by these semantically similar searches, and allow the user to select from among these results. The system may also provide incremental updates over time, as new results or new semantically-similar search requests are found.

Abstract: Network survivability is quantified in such a way that failure cases can be compared and ranked against each other in terms of the severity of their impact on the various performance measures associated with the network. The degradation in network performance caused by each failure is quantified based on user-defined sets of thresholds of degradation severity for each performance measure. Each failure is simulated using a model of the network, and a degradation vector is determined for each simulated failure. A comparison function is defined to map the degradation vectors into an ordered set, and this ordered set is used to create an ordered list of network failures, in order of the network degradation caused by each failure.

Abstract: A system for analyzing network activity by displaying in a first portion of a display, network objects according to an activity characteristic, receiving a selection of one or more of the network objects, and displaying in a second portion of the display, a further activity characteristic of the selected network objects according to at least a first criteria. The display of the network objects may be altered according to second criteria that may include filtering criteria that removes network objects displayed in the first portion. The results of the altered display may be displayed in a third portion of the display providing further details of the selected network objects. The selection of the network object may be a selection of a plurality of objects and the displayed activity characteristic may be a sum of the selected network objects activity characteristics.

Abstract: A network configuration is processed to identify each policy and the criteria associated with each policy. The criteria of the policies are processed to identify a non-overlapping set of ranges of the criteria parameter, each range being associated with a particular policy or set of policies. In a preferred embodiment, the criteria include the protocol, the source and destination IP addresses, and the source and destination ports, and a default range is defined for each criteria parameter.

Abstract: Traffic flow between each pair of nodes in a network are determined based on loads measured at each link and based on gravity measures associated with each node. The gravity measures correspond to a relative likelihood of the node being a source or a sink of traffic, and may be assigned based on ‘soft’ characteristics associated with each node, such as the demographics of the region in which the node is located, prior sinking and sourcing statistics, and so on. Because the assigned gravities are relatively subjective, the gravity measures are used to generate an objective function for solving a system of linear equations, rather than as criteria that must be satisfied in the solution. The measured link loads are allocated among the traffic flows between nodes to at least a given allocation efficiency criteria by solving a system of linear equations with an objective of minimizing a difference between the assigned gravities and the resultant gravities corresponding to the determined flows.

Abstract: A simulation system includes a cache structure that stores determined characteristics related to the propagation of an event. If a similar event occurs, and the factors affecting the determination of these characteristics have not changed, the characteristics associated with the new event are retrieved from the cache, rather than being re-determined from the underlying factors. In the example of mobile transceivers, if multiple transceivers share a common set of underlying factors, the determined characteristics of one transceiver can be shared among all of the other transceivers. If the underlying factors are dependent upon geographic area, mobile transceivers that enter a geographic area having associated cached characteristics can use the cached characteristics of other transceivers that are, or had been, in the area.