Abstract: According to one or more embodiments of the disclosure, techniques herein provide for auto discovery of network proxies. In particular, in one embodiment, a controller in a computer network receives, from both source devices and destination devices, corresponding Transmission Control Protocol/Internet Protocol (TCP/IP) information and associated transaction identifiers (IDs) for packets sent by the source devices and for packets received at the destination devices. The controller may then correlate particular source TCP/IP information to particular destination TCP/IP information based on associated transaction IDs being the same, and can compare the correlated source TCP/IP information and destination TCP/IP information in order to determine whether a proxy device exists (e.g., and which particular type of proxy device exists) between the source device and the destination device.

Abstract: According to one or more embodiments of the disclosure, techniques herein provide for auto discovery of network proxies. In particular, in one embodiment, a controller in a computer network receives, from both source devices and destination devices, corresponding Transmission Control Protocol/Internet Protocol (TCP/IP) information and associated transaction identifiers (IDs) for packets sent by the source devices and for packets received at the destination devices. The controller may then correlate particular source TCP/IP information to particular destination TCP/IP information based on associated transaction IDs being the same, and can compare the correlated source TCP/IP information and destination TCP/IP information in order to determine whether a proxy device exists (e.g., and which particular type of proxy device exists) between the source device and the destination device.

Abstract: According to one or more embodiments of the disclosure, techniques herein provide for auto discovery of network proxies. In particular, in one embodiment, a controller in a computer network receives, from both source devices and destination devices, corresponding Transmission Control Protocol/Internet Protocol (TCP/IP) information and associated transaction identifiers (IDs) for packets sent by the source devices and for packets received at the destination devices. The controller may then correlate particular source TCP/IP information to particular destination TCP/IP information based on associated transaction IDs being the same, and can compare the correlated source TCP/IP information and destination TCP/IP information in order to determine whether a proxy device exists (e.g., and which particular type of proxy device exists) between the source device and the destination device.

Abstract: In one embodiment, an agent process produces synthetic packet traffic and iteratively performs a sub-process that determines isolated network segments of the communication channel between intermediate nodes and computes a set of network metrics for the isolated network segments based at least in part on incrementing TTL expiry error data points. The sub-process also encapsulates, for inclusion within the next packet to be sent, a list of intermediate node IDs along the communication channel up to a latest received node ID and computed sets of network metrics for respective network segments. The agent process may then generate, upon termination of the sub-process, a report, the report including the list of intermediate node IDs along the communication channel up to a latest received node ID and computed sets of network metrics for respective network segments.

Abstract: A cluster analysis feature is provided to monitor and troubleshoot infrastructure issues impacting a distributed business application. Performance trends of one or more tiers of applications may be monitored, analyzed, and reported. By monitoring and reporting performance issues for tiers of applications, valuable time is saved from to individually go through each application individually. Agents installed on individual applications may monitor the performance of applications, collect metrics, aggregate the metrics and report the metrics back to a server. Clustering algorithms may be used to cluster infrastructure metrics and then correlate those metrics with the application nodes using the same algorithms.

Abstract: In one embodiment, a network agent, associated with an operating system of a computing device, tracks socket connection calls made by a plurality of cotenant processes on the computing device that share a common network transport between the computing device and a remote computing device. The network agent may then extract a process identification (ID) for the socket connection calls, the process ID identifying which particular cotenant process of the plurality of cotenant processes is making each particular socket connection call. While monitoring network metrics of network traffic flows over socket connections between the computing device and the remote computing device, the network agent may attribute given network metrics from particular socket connections to a corresponding cotenant process based on the correlated process ID for the socket connection. As such, the network agent may then report the network metrics as attributed to the corresponding cotenant processes.

Abstract: According to one or more embodiments of the disclosure, techniques herein provide for auto discovery of network proxies. In particular, in one embodiment, a controller in a computer network receives, from both source devices and destination devices, corresponding Transmission Control Protocol/Internet Protocol (TCP/IP) information and associated transaction identifiers (IDs) for packets sent by the source devices and for packets received at the destination devices. The controller may then correlate particular source TCP/IP information to particular destination TCP/IP information based on associated transaction IDs being the same, and can compare the correlated source TCP/IP information and destination TCP/IP information in order to determine whether a proxy device exists (e.g., and which particular type of proxy device exists) between the source device and the destination device.

Abstract: A system monitors applications and network flows used during the business transaction to determine distributed business transaction anomalies caused at least in part by network performance issues. A network flow associated with a business transaction is monitored by a network agent. The network agent may capture packets, analyze the packets and other network data to determine one or more baselines, and dynamically compare subsequent network flow performance to those baselines to determine an anomaly. When an anomaly in a network flow is detected, this information may be provided to a user along with other data regarding a business transaction that is utilizing the network flow. Concurrently with the network agent monitoring, application agents may monitor one or more applications performing the business transaction. The present system reports performance data for a business transaction in terms of application performance and network performance, all in the context of a distributed business transaction.

Abstract: In one embodiment, techniques herein monitor activity of one or more applications in a computer network, and identify individual business transactions occurring within the one or more applications. Additionally, network traffic metrics within the computer network may be determined, and particular network traffic metrics can be correlated to each of the individual business transactions. By developing a baseline of network traffic metrics based on network traffic metrics of one or more individual business transactions, a trigger may be detected to perform root cause analysis on the activity of the one or more applications. As such, the techniques herein may initiate, in response to the trigger, root cause analysis on the activity of the one or more applications, where the root cause analysis leverages the correlation of anomalous network traffic metrics to particular business transactions.

Abstract: A system and method is disclosed for seamless network management monitoring when a device or Virtual Machine migrates. As part of a network management monitoring system and method, a separate distinct identifier is designated to each port and each device or VM being monitored. When a device is located a specific port a correlation between the distinct identifier of that port and the distinct identifier of the device is stored in a correlation table and monitored. Once this correlation changes, the network management monitoring system recognizes a migration has occurred and updates the correlation table to correlate the new port's distinct identifier with the device's distinct identifier. Parameters that were set up to be monitored for the device can then continue to be monitored at the new location.

Abstract: In one aspect, the performance of a network within the context of an application using that network is determined for a distributed business transaction. Network data is collected and correlated with a business transaction along with an application that uses the network and implements the distributed business transaction. The collected network data is culled, and the remaining data is rolled up into one or more metrics. The metrics, selected network data, and other data are reported in the context of the distributed business transaction. In this manner, specific network performance and architecture data associated with the distributed business transaction is reported along with application context information.

Abstract: A cluster analysis feature is provided to monitor and troubleshoot infrastructure issues impacting a distributed business application. Performance trends of one or more tiers of applications may be monitored, analyzed, and reported. By monitoring and reporting performance issues for tiers of applications, valuable time is saved from to individually go through each application individually. Agents installed on individual applications may monitor the performance of applications, collect metrics, aggregate the metrics and report the metrics back to a server. Clustering algorithms may be used to cluster infrastructure metrics and then correlate those metrics with the application nodes using the same algorithms.

Abstract: A system monitors applications as well as the network flows used during the business transaction, identifies network flows associate with a particular distributed business transaction, and reports the specific network flow data. A network flow associated with a business transaction is monitored by a network agent. The network agent may capture packets, and analyze the packets. Upon request by a user, packet capture can be performed for the specific data flows associated with a distributed business transaction. Concurrently with the network agent monitoring, application agents may monitor one or more applications performing the business transaction. The present system reports performance data for a business transaction in terms of application performance and network performance, all in the context of a distributed business transaction.

Abstract: A system monitors applications and network flows used during the business transaction to determine distributed business transaction anomalies caused at least in part by network performance issues. A network flow associated with a business transaction is monitored by a network agent. The network agent may capture packets, analyze the packets and other network data to determine one or more baselines, and dynamically compare subsequent network flow performance to those baselines to determine an anomaly. When an anomaly in a network flow is detected, this information may be provided to a user along with other data regarding a business transaction that is utilizing the network flow. Concurrently with the network agent monitoring, application agents may monitor one or more applications performing the business transaction. The present system reports performance data for a business transaction in terms of application performance and network performance, all in the context of a distributed business transaction.

Abstract: The present technology may identify issues in network architectures, such as load balancers operating between machines that process a distributed business transaction, and automatically generate and apply policy updates to such machines. The present system monitors a distributed application through the applications processing the transaction as well as the network flows over which the machines communicate while processing the transaction. By monitoring the network flow and application, the system can tell when an anomaly is caused not by an application but by the network infrastructure itself. Portions of the network infrastructure, such as load balancers, may be singled out as a point of failure and automatically corrected. The failure may be a general degradation of performance or associated with the processing of a particular business transaction.

Abstract: A system monitors applications and network flows used during the business transaction to determine distributed business transaction anomalies caused at least in part by network performance issues. A network flow associated with a business transaction is monitored by a network agent. The network agent may capture packets, analyze the packets and other network data to determine one or more baselines, and dynamically compare subsequent network flow performance to those baselines to determine an anomaly. When an anomaly in a network flow is detected, this information may be provided to a user along with other data regarding a business transaction that is utilizing the network flow. Concurrently with the network agent monitoring, application agents may monitor one or more applications performing the business transaction. The present system reports performance data for a business transaction in terms of application performance and network performance, all in the context of a distributed business transaction.

Abstract: A system and method is disclosed for seamless network management monitoring when a device or Virtual Machine migrates. As part of a network management monitoring system and method, a separate distinct identifier is designated to each port and each device or VM being monitored. When a device is located a specific port a correlation between the distinct identifier of that port and the distinct identifier of the device is stored in a correlation table and monitored. Once this correlation changes, the network management monitoring system recognizes a migration has occurred and updates the correlation table to correlate the new port's distinct identifier with the device's distinct identifier. Parameters that were set up to be monitored for the device can then continue to be monitored at the new location.

Abstract: A desired node is selected from a tree structure or list and then a number of levels from that node are displayed in a map. For edge nodes, the number of undisplayed links from that node is displayed. When another node is selected on the map, the number of levels is recalculated based on that node or the existing nodes remain and the desired level is additionally displayed from the selected node. Multiple nodes can be selected from the list, which may result in separated islands which join when an common node is displayed in each island. Filters can be applied to limit the number of nodes. The filtering may either remove nodes from the display or provide an indication of the number of undisplayed nodes meeting the filter and any displayed nodes meeting the filter. The technique can be used on most linked networks.

Abstract: A desired node is selected from a tree structure or list and then a number of levels from that node are displayed in a map. For edge nodes, the number of undisplayed links from that node is displayed. When another node is selected on the map, the number of levels is recalculated based on that node or the existing nodes remain and the desired level is additionally displayed from the selected node. Multiple nodes can be selected from the list, which may result in separated islands which join when an common node is displayed in each island. Filters can be applied to limit the number of nodes. The filtering may either remove nodes from the display or provide an indication of the number of undisplayed nodes meeting the filter and any displayed nodes meeting the filter. The technique can be used on most linked networks.

Abstract: A network management application implemented in a mobile device which includes a feature for capturing a screen along with information associated with the screen and observed in the application. The capturing feature allows a user to capture a displayed image along with contextual data associated with the image. The user can then share the captured image and data with others to assist in analysis, diagnosis, and other decision making tasks.