Abstract: A global identifier is generated based on the initiation of a communication session in a network. The global identifier is sent during the initiation of the communication session. For example, in a Session Initiation Protocol (SIP) INVITE, the global identifier is passed as the communication session progresses across the network. The communication session is logged based on the global identifier in a communication log. A map of the communication session is built from the session log based on the global identifier. The map includes all the elements that were involved with the communication session. In another embodiment, the global identifier is used to for a communication session that is sent across multiple disparate networks. The global identifier is passed in-band during the establishment of the communication session across the disparate networks.

Abstract: Disclosed herein are systems, methods, and non-transitory computer-readable storage media for determining rogue traffic using flow statistics and a list of authorized media engines. A system configured according to this disclosure receives data associated with a group of packets in a media queue, such as the source network address where the packets originated, the destination network address for the packets, and an indication of an associated queue for the packets. The system then verifies the data received by comparing the source network address to a list of network addresses of known media engines. The system further verifies that the indication of an associated queue for the packets is correct for the packets. Should the system detect failure in the verification of known media engines or the verification of indication of associated queues, the system generates a notification.

Abstract: Systems, methods, and non-transitory computer-readable storage media for performing automatic Differentiated Services Code Point tracing for XoIP elements. A system configured as an agent maintains a cache of destination network addresses based on prior network communications. Then, the system identifies a destination network address to test. The system can identify the destination network address to test based on the cache of destination network addresses. The cache can include additional information, such as network test results, traffic information, port numbers, DSCP trace value, measurements of traffic protection, service provider information, etc. Next, the system automatically sends to the destination network address a network test configured to determine a Differentiated Services Code Point trace. The system can perform the network test for any type of network traffic and port.

Abstract: A system visualizes and generates reports from stored data, concerning various measured parameters related to a network carrying call traffic. The network is displayed in an easily recognized arrangement, with various parameters being indicated by different shapes and colors for each device on the network. The parameters are changed to indicate the status of the network at different times. More detailed information about a parameter, a device or a path between devices may be obtained simply using a mouse or keystrokes. A variety of different types of detailed displays allows the operator to troubleshoot problems in the network.

Abstract: A distributed monitoring system comprises a plurality of agents configured for communication with at least one central server. A given one of the agents obtains measurement data, and applies a statistical test to the measurement data. Based on a result of the statistical test, the given agent determines whether or not an update needs to be sent by the agent to the central server. The agent sends the update to the central server if the determination indicates that the update should be sent.

Abstract: A network analyzer gets configuration information, usually in the form of a configuration packet sent from a network monitor. The configuration information comprises a second device network address and a third device network address. The second device network address is that of the network monitor and the third device network address is that of a communication device that is to be monitored. When the network analyzer sees packets from the monitored communication device, it can send the results to the network monitor for analysis without having to be configured with a unique network address. The network analyzer sends an original packet using the network address of the communication device as the source address and using the network address of the network monitor as the destination address.

Abstract: Disclosed herein are systems, methods, and computer-readable storage media for managing a packet network to deal with rogue applications that produce non-audio packets marked as audio packets. The system analyzes packet flow through the network to identify an unauthorized source of non-audio packets marked as audio packets, and upon identifying the unauthorized source, the system stops subsequent unauthorized transmission of non-audio packets marked as audio packets from the identified unauthorized source. For example, such an unauthorized source is identified by finding that an audio marked packet has a source address that is not found on a list of authorized sources, or by detecting atypical patterns of audio queue utilization, or by determining whether audio marked packets from a source exceed a threshold value related to transmission of audio marked packets.

Abstract: Disclosed herein are systems, methods, and non-transitory computer-readable storage media for determining rogue traffic using flow statistics and a list of authorized media engines. A system configured according to this disclosure receives data associated with a group of packets in a media queue, such as the source network address where the packets originated, the destination network address for the packets, and an indication of an associated queue for the packets. The system then verifies the data received by comparing the source network address to a list of network addresses of known media engines. The system further verifies that the indication of an associated queue for the packets is correct for the packets. Should the system detect failure in the verification of known media engines or the verification of indication of associated queues, the system generates a notification.

Abstract: A method of internet protocol (IP) address de-aliasing that involves obtaining IP addresses from devices in a network, pinging pairs of the IP addresses by sending packets to pairs of the IP addresses, obtaining ping response orders for the packets, and determining whether the pairs of IP addresses are aliases of the same network device based on the obtained ping response orders.

Abstract: The system and method get a packet trace for a failed communication and a packet trace for a successful communication. The two packet traces are generated with packets from a common protocol(s) shared by the two communications. The failed and successful communications have at least some network elements in common. A field(s) in the common protocol(s) is identified. The field(s) is updated to be the same in both packet traces. The two packet traces are then compared to produce a list of remaining differences that can be used to diagnose problems in the failed communication. The list can also be compared to bills of materials for the failed and successful communications to further enhance diagnosis of the failed communication.

Abstract: A technique is discloses that enables a first telecommunications terminal, wireless or otherwise, to report to its user whether a second, wireless telecommunications terminal is receiving the first terminal's packet stream transmissions at a satisfactory quality level. The second terminal receives the packet stream that conveys the media waveform transmitted by the first terminal. The media waveform can be that of the speech signal of the first terminal's user. The second terminal measures a trait of the received signal and encodes the measurement data into the packet stream that the second terminal is already transmitting to the first terminal. The first terminal then decodes the measurement data from the received second stream and presents, to its user, a quality indication that is based on the measurement data. In doing so, the first terminal provides its user with a better idea of whether the second terminal has reliably received the user's communication.

Abstract: Disclosed herein are systems, methods, and non-transitory computer-readable storage media for determining rogue traffic using flow statistics and a list of authorized media engines. A system configured according to this disclosure receives data associated with a group of packets in a media queue, such as the source network address where the packets originated, the destination network address for the packets, and an indication of an associated queue for the packets. The system then verifies the data received by comparing the source network address to a list of network addresses of known media engines. The system further verifies that the indication of an associated queue for the packets is correct for the packets. Should the system detect failure in the verification of known media engines or the verification of indication of associated queues, the system generates a notification.

Abstract: Disclosed herein are systems, methods, and computer-readable storage media for managing a packet network to deal with a problem of dropped audio packets. A triggering event signal indicates that audio marked packet traffic in the packet network has exceeded a capacity limit. Upon receiving the triggering event signal, a transmitting device transmits audio packets marked as non-audio packets through the packet network. The transmitting device, for example, is a VoIP telephone. The triggering event signal, for example, is generated when the audio marked packet traffic exceeds a dropped packet threshold, or when monitoring of audio marked packet traffic indicates that audio marked packet traffic approaches a committed data rate (CDR) threshold.

Abstract: Disclosed herein are systems, methods, and non-transitory computer-readable storage media for generating an end-to-end quality indication associated with a communication session. Based on a real-time transport control protocol message, the system identifies a media path associated with a communication session. Next, the system determines a respective media leg quality for a plurality of media legs in the media path. Based on the respective media leg quality, the system then determines a media path quality. The system can also generate a media quality indication based on the media path quality, and display the media quality indication.

Abstract: Systems, methods, and non-transitory computer-readable storage media for implementing real-time transport control protocol to obtain end-to-end session information. The system receives a real-time transport control protocol extension associated with a real-time transport control protocol packet in a communication session, wherein the real-time transport control protocol extension comprises an instruction for transmitting real-time transport control protocol data based on a triggering event, and wherein the real-time transport control protocol extension is configured to propagate along the communication session. Next, in response to the triggering event, the system transmits the real-time transport control protocol data to an address defined by the instruction as a destination address for receiving information associated with the triggering event.

Abstract: A system discovers the topology of devices in a network, such as all of the layer-2 and layer-3 devices, including routers and switches. The devices are mapped, as well as the links that join them. The devices are polled using SNMP requests. Route tables are derived from each router to determine addresses of the devices. A spanning tree process is used to discover layer-2 devices. Connections between layers are then discovered. Where information is incomplete, an undiscovered router cloud is recognized.

Abstract: Systems, methods, and non-transitory computer-readable storage media for verifying service contracts by measuring rates of out-of-contract traffic. The method is discussed in terms of a system implementing the method. The system determines, based on packet markings, a number of network packets that are classified as out-of-contract by a network device, wherein the packet markings indicate a classification associated with respective network packets. The packet markings can be Differentiated Services Code Point markings Moreover, the classification associated with respective network packets can include a class of service and at least one of an in-contract status and an out-of-contract status. Next, the system measures network packets sent to the network device. Finally, the system determines how the network device is configured to classify incoming packets based on the number of network packets that are classified as out-of-contract by the network device and the network packets sent to the network device.

Abstract: Systems, methods, and non-transitory computer-readable storage media for creating dynamic session maps. The method is discussed in terms of a system implementing the method. The system generates a dynamic session map token for a packet in a communication session, wherein the dynamic session map token instructs a node to send a copy of the packet to a specified destination. The dynamic session map token includes a unique dynamic session map identifier, a port number, and an IP address associated with the specified destination. Next, the system adds the dynamic session map token to the packet to yield a tracing packet. The dynamic session map token can be incorporated into the header portion of the packet, for example. Finally, the system transmits the tracing packet to the node. In one embodiment, the system also sends the copy of the packet to the specified destination.

Abstract: Systems, methods, and non-transitory computer-readable storage media for performing automatic Differentiated Services Code Point tracing for XoIP elements. A system configured as an agent maintains a cache of destination network addresses based on prior network communications. Then, the system identifies a destination network address to test. The system can identify the destination network address to test based on the cache of destination network addresses. The cache can include additional information, such as network test results, traffic information, port numbers, DSCP trace value, measurements of traffic protection, service provider information, etc. Next, the system automatically sends to the destination network address a network test configured to determine a Differentiated Services Code Point trace. The system can perform the network test for any type of network traffic and port.

Abstract: Disclosed herein are systems, methods, and non-transitory computer-readable storage media for determining rogue traffic using flow statistics and a list of authorized media engines. A system configured according to this disclosure receives data associated with a group of packets in a media queue, such as the source network address where the packets originated, the destination network address for the packets, and an indication of an associated queue for the packets. The system then verifies the data received by comparing the source network address to a list of network addresses of known media engines. The system further verifies that the indication of an associated queue for the packets is correct for the packets. Should the system detect failure in the verification of known media engines or the verification of indication of associated queues, the system generates a notification.