Abstract: A method and apparatus is disclosed herein for dynamically scaling application performance analysis completeness based on available system resources. In one embodiment, the method comprises monitoring incoming network traffic and a rate at which the traffic is being analyzed and dynamically adjusting application performance analysis completeness, the analysis being performed on the observed network traffic.

Abstract: Network data gap is determined and reported to enable a user to validate that all the traffic that was intended to be monitored is being monitored in monitoring and/or troubleshooting tools for observation of network traffic and network installation and maintenance. Span port oversubscription, incomplete span configuration, incorrectly placed network taps and monitoring device packet drop may thereby be detected and reported as data gap.

Abstract: A method and apparatus for dynamic host operating system firewall configuration provides plural monitoring processes to monitor the firewall configuration of a host operating system and guest operating systems. When any firewall configuration change is detected by a monitor in a monitored guest operating system, an appropriate corresponding firewall change is made by the monitor to the host operating system.

Abstract: A network round trip time measurement apparatus and method employ an allocated storage in the form of a double ended queue, to store data received while awaiting a corresponding receipt of data to allow the network round trip time to be determined. When the allocated size of the storage is exceeded, storage stops until such time as data is received to allow network round trip time to be determined on at least some of the already stored data, whereupon storage can resume. This allows use in high and low volume traffic situations to automatically scale back the amount of data processed, so as to not overtax available resources.

Abstract: Network monitoring method and apparatus determines the zero window event data transfer delay, reporting the amount of data transfer delay caused thereby. Non-data-transfer-delaying zero window events can be separated from those causing actual delay, allowing reporting of actual delay events separate from non-delay causing events.

Abstract: Method and apparatus of transaction determination for non-tcp protocols employs a network analyzer to observe network traffic. Non-TCP protocol sequential traffic from a client to a server and sequential traffic following from a server to the client are considered to be one transaction for test and measurement analysis purposes.

Abstract: A network round trip time measurement apparatus and method employ an allocated storage in the form of a double ended queue, to store data received while awaiting a corresponding receipt of data to allow the network round trip time to be determined. When the allocated size of the storage is exceeded, storage stops until such time as data is received to allow network round trip time to be determined on at least some of the already stored data, whereupon storage can resume. This allows use in high and low volume traffic situations to automatically scale back the amount of data processed, so as to not overtax available resources.

Abstract: Network monitoring method and apparatus estimates the congestion window throughout the life of a TCP flow (socket connection), providing information useful for network performance analysis and troubleshooting.

Abstract: A method and apparatus is disclosed herein for dynamically scaling application performance analysis completeness based on available system resources. In one embodiment, the method comprises monitoring incoming network traffic and a rate at which the traffic is being analyzed and dynamically adjusting application performance analysis completeness, the analysis being performed on the observed network traffic.

Abstract: Exemplary embodiments of methods and apparatuses to split incoming data into a plurality of sub-channels to allow parallel processing are described. A packet is received over a network. The packet is compared against a filter. The packet is routed to a process sub-channel in a memory based on the comparing. The process sub-channel is one of the plurality of process sub-channels that are configured to allow parallel processing. In one embodiment, the filter includes user defined criteria for the packet.

Abstract: A time marker for a data packet stream is generated. The packets are grouped into a block based on the time marker. The block of data packets is stored in a memory. A block of the data packets can be terminated based on the time marker. A block header is generated for the block. Statistics associated with the packet stream is captured based on the time marker.

Abstract: A network round trip time measurement apparatus and method employ request/response timing to determine network round trip time. An initial network round trip value is determined, and subsequent network round trip values are determined for possible better measurement values. Response send time and subsequent next request receipt times are employed to determine network round trip values, as well as response and ack packet times.

Abstract: A network analyzer, system and method determine whether or not network transaction data derived from network analysis should be stored, based on a configuration. Configuration strings (patterns) are entered via a configuration file, including specifying whether the string should be a prefix, suffix, other location or exist anyplace in the data. Storage enabling/disabling is provided for network transaction data. Configuration strings (patterns) can be specified for request/response summary/detail, and for specified parameters.

Abstract: A method and apparatus is disclosed herein for determining the state of a flow of packets in a network. In one embodiment, the method comprises: monitoring, using a monitoring device, a flow of packets that are part of a connection between two network devices in a network, where the monitoring device is located in the network at one side of the connection; and passively determining a state of the flow while monitoring the flow, including determining at least one state of the flow without receiving data in the flow of packets that specifies the flow is in the at least one state.

Abstract: Network traffic is distinguished at a conversation level, providing sampling decision capability. A hash value is determined based on IP addresses and protocol type, giving unique identifiers for individual conversations.

Abstract: Network monitoring method and apparatus determines the zero window event data transfer delay, reporting the amount of data transfer delay caused thereby. Non-data-transfer-delaying zero window events can be separated from those causing actual delay, allowing reporting of actual delay events separate from non-delay causing events.

Abstract: Data acquisition rates are dynamically adjusted in an APM system, by monitoring data acquisition hardware and reducing the data acquisition rate when a determination is made that the data rate is too high for processing by an APM.

Abstract: Network monitoring method and apparatus determines the amount of data outstanding throughout the life of a TCP flow (socket connection). Observing network traffic, calculation of the outstanding data is made, providing information useful for network performance analysis and troubleshooting.

Abstract: Data storage rates are dynamically adjusted in an APM system, by monitoring data storage elements and modulating the data storage when a determination is made that the storage buffer utilization is too high.

Abstract: Network monitoring method and apparatus estimates the congestion window throughout the life of a TCP flow (socket connection), providing information useful for network performance analysis and troubleshooting.