Abstract: A method and apparatus to estimate application and network performance metrics and distribute those metrics across the appropriate applications, sites, servers, and the like, performs shallow analysis on a majority of traffic and deep analysis on a sampled set of the traffic, and estimates network and application performance metrics for the non-deep analysis data, providing an overall estimate of metrics without requiring deep analysis of all traffic.

Abstract: A method and apparatus for dynamic host operating system firewall configuration provides plural monitoring processes to monitor the firewall configuration of a host operating system and guest operating systems. When any firewall configuration change is detected by a monitor in a monitored guest operating system, a appropriate corresponding firewall change is made by the monitor to the host operating system.

Abstract: A network analyzer determines, analyzes, and displays in streaming and non-streaming modes to provide analysis of specific transactions in that make sense within a primarily streaming or asynchronous flow of data, providing useful and accurate measurements.

Abstract: Network traffic filtering is provided to enable gathering of data and statistics related to client/server traffic corresponding to valid and desired client to server/server to client traffic.

Abstract: End-user response time in a network is determined by an analyzer which measures client data transfer time, server response time, server data transfer time and, if the protocol is a TCP protocol, further measuring server network round trip time. End-user response time may be approximated by the sum of these determined times.

Abstract: A network analyzer reads network packets and extracts characterizing attributes, grouping patents observed in a given amount of time on common attribute values. Grouped attributes are meta data, written to a database, while packets are written to files. Meta data is stored in the database including links to the physical packets related to the meta data, and a user interface enables query of the meta data and retrieval of related physical packets.

Abstract: A network analyzer reads network packets and extracts characterizing attributes, grouping patents observed in a given amount of time on common attribute values. Grouped attributes are meta data, written to a database, while packets are written to files.

Abstract: A network analyzer, system and method determine whether or not network transaction data derived from network analysis should be stored, based on a configuration. Configuration strings (patterns) are entered via a configuration file, including specifying whether the string should be a prefix, suffix, other location or exist anyplace in the data. Storage enabling/disabling is provided for network transaction data. Configuration strings (patterns) can be specified for request/response summary/detail, and for specified parameters.

Abstract: A network analyzer determines, analyzes, and displays in streaming and non-streaming modes to provide analysis of specific transactions in that make sense within a primarily streaming or asynchronous flow of data, providing useful and accurate measurements.

Abstract: Bounding of large queries is provided in a network analysis environment by receiving a user query of a data set of network transactions, submitting a meta data query to the data set to determine whether the query would require an unreasonable amount of time to complete, and notifying the user to re-formulate the query if it would require too much time.

Abstract: Network traffic filtering is provided to enable gathering of data and statistics related to client/server traffic corresponding to valid and desired client to server/server to client traffic.

Abstract: Method and apparatus for continuous collection and correlation of application transactions across multiple tiers of an N-tier application employs an application monitoring appliance that observes application data and stores transactions and statistics. A reporting server aggregates and correlates monitored data from the application monitoring appliance and provides access via a web browser for viewing by a network engineer.

Abstract: Discrimination of application specific network traffic from other from general or unclassified network traffic is provided. Users may specify particular applications or data strings to be monitored.

Abstract: Multiple packets are combined into protocol transactions with request and response detail for enhanced troubleshooting in a network monitoring device. The analysis may be done at a line rate, in an always on operation mode, providing constant gathering of analysis data and information.

Abstract: Network data gap is determined and reported to enable a user to validate that all the traffic that was intended to be monitored is being monitored in monitoring and/or troubleshooting tools for observation of network traffic and network installation and maintenance. Span port oversubscription, incomplete span configuration, incorrectly placed network taps and monitoring device packet drop may thereby be detected and reported as data gap.

Abstract: Network data gap is determined and reported to enable a user to validate that all the traffic that was intended to be monitored is being monitored in monitoring and/or troubleshooting tools for observation of network traffic and network installation and maintenance. Span port oversubscription, incomplete span configuration, incorrectly placed network taps and monitoring device packet drop may thereby be detected and reported as data gap.

Abstract: Network round trip time is measured as an initial value at a start of a network communication flow. If sufficient data is available subsequently during a communication flow, subsequent network round trip time value determinations are made, without TCP stack overhead and time out values being included in the determined value.

Abstract: Method and apparatus of transaction determination for non-tcp protocols employs a network analyzer to observe network traffic. Non-TCP protocol sequential traffic from a client to a server and sequential traffic following from a server to the client are considered to be one transaction for test and measurement analysis purposes.

Abstract: End-user response time in a network is determined by an analyzer which measures client data transfer time, server response time, server data transfer time and, if the protocol is a TCP protocol, further measuring server network round trip time. End-user response time may be approximated by the sum of these determined times.

Abstract: A Combination Cup Sleeve and Plug Assembly is disclosed. Also disclosed is a combination that includes an insulating sleeve for disposable beverage containers, as well as a detachable plug for the dispensing aperture formed in the lid of the container and a lanyard interconnecting the two. The sleeve is provided in a variety of durable, aesthetically pleasing, non-disposable forms. The plug is configured to be insertible into the dispensing aperture of the cup and should be made either from semi-precious or low cost materials, depending upon the target market. The plug further has a portion for displaying trademarks and/or identifying indicia thereon. The sleeve may further include a holder for retaining the plug therein when the plug is not in use for plugging the dispensing aperture. The lanyard is a detachable member made from cord, chain or other material that interconnects the plug and the sleeve. In an alternate embodiment, the plug is detachably clipped to the insulating sleeve.